DEStart a brief

Legal / Privacy

How we process personal data.

This notice explains which data Propaganda Solutions processes on the public website, why it is needed, which service providers are involved and the rights available to individuals.

Publication status
Approved
Version
1.1 approved analytics notices
Last reviewed
17 July 2026

Current / 17 July 2026

This notice reflects the approved production setup with Cloudflare, Turnstile, operational email, consent-gated Klaviyo and Google Analytics 4 after analytics consent. Google Ads, Meta and other advertising tags remain disabled.

01

Propaganda Solutions GmbH is the controller for personal data processed through this website and its forms. Propaganda Solutions Global Limited is a separate company and becomes a controller only where it initiates its own business relationship or processing.

Privacy questions and requests to exercise data rights can be sent to info@propaganda-solutions.com. No data protection officer is currently published.

Controller
Propaganda Solutions GmbH Uhlandstraße 53 10719 Berlin Germany

02

The contact form processes name, email address, optional telephone number, message, language, source path and consent choices. The project brief can additionally include company, role, website, markets, business stage, budget range, timing, platforms, selected options and the requested starting route.

The processing is used to review, route and answer the enquiry and, where relevant, to take steps before entering into a contract. The legal basis is Article 6(1)(b) GDPR where the request concerns a contract, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in orderly business communication.

Enquiries pass through a signed internal endpoint and are sent to info@propaganda-solutions.com using Cloudflare Email Service. HubSpot is disabled and receives no form data. Closed correspondence is normally deleted 90 days after the last reply unless a business relationship, statutory retention duty, or the establishment, exercise or defence of legal claims requires longer retention.

Legal basis
Article 6(1)(b) or 6(1)(f) GDPR
Operational recipient
info@propaganda-solutions.com through Cloudflare Email Service
Normal period
90 days after the enquiry closes; longer legal or contractual duties remain unaffected

03

The website runs on Cloudflare Workers. Cloudflare processes information including IP address, request data, device and browser information, timestamps and technical errors to deliver content, secure connections and investigate faults. Worker logs are retained for up to seven days on the paid plan in use.

To limit form attempts to five in ten minutes, the IP address is converted with a secret key into a value that cannot be reversed. Only this value reaches the private Cloudflare counting service and it expires with the ten-minute window. A random submission ID and technical delivery steps are kept without form content for 90 days to prevent duplicate delivery.

Cloudflare Turnstile protects the contact form and project brief against automated misuse. Cloudflare processes signals including IP address, TLS fingerprint, user-agent, sitekey and origin. The legal basis for hosting, logs, rate limiting and Turnstile is Article 6(1)(f) GDPR, based on our legitimate interest in providing a secure, stable and abuse-resistant website.

Service provider
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA
Worker logs
Up to 7 days
Rate-limit value
10 minutes / no raw IP address in the counting service
Delivery record
Submission ID and technical steps / 90 days / no form content

04

Newsletter and marketing communications are sent only after separate, voluntary consent under Article 6(1)(a) GDPR. Without that choice, contact details are not sent to Klaviyo. With consent, we transfer email address, first and last name, language, an optional internationally formatted telephone number and, for project briefs, company and role. Klaviyo then starts the double-opt-in process.

Klaviyo processes this information as a processor in the United States. Klaviyo states that transfers are supported by mechanisms including the EU-US Data Privacy Framework and contractual safeguards. Consent can be withdrawn at any time through the unsubscribe link in each message or by emailing info@propaganda-solutions.com. Withdrawal applies to the future. Unsubscribe and suppression records are preserved so a person is not resubscribed without a new lawful basis.

Service provider
Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA
Legal basis
Article 6(1)(a) GDPR
Process
Separate consent and double opt-in
Retention
Until withdrawal or a deletion request; necessary consent and suppression evidence remains for the legally required period

05

The website stores separate analytics and advertising-measurement choices in the essential first-party ps_consent_v1 cookie for 180 days. It contains the choices, decision time and consent version. The functional first-party ps_locale cookie stores the selected language for the browser session.

Google Analytics 4 is loaded only after voluntary analytics consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Before that choice, neither Google Tag Manager nor Google Analytics is requested and no analytics cookies are set. Consent can be withdrawn for the future at any time through the cookie settings in the footer.

After consent, the website loads Google Tag Manager container GTM-PL94DSLF and Google Analytics 4 property G-Q8Y7TYW3S3. Measurement helps us understand aggregated reach, page use, interactions, journeys and technical performance. Data can include page and event data, timestamps, referrer, browser and device information, approximate location and a cookie identifier. Names, email addresses, telephone numbers and form messages are not sent to Google Analytics.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data through Google LLC and other subprocessors outside the European Economic Area. Google states that these transfers rely in particular on the EU-US Data Privacy Framework and Standard Contractual Clauses. For EU traffic, Google uses the IP address to derive an approximate location and discards it before logging or storage. Event and user data retention in the property is set to 14 months. Google Ads, Meta, personalised advertising and other advertising tags are not active; advertising consent remains a separate choice.

ps_consent_v1
Consent choices / first party / 180 days
ps_locale
Language preference / first party / browser session
Google Analytics 4
G-Q8Y7TYW3S3 / only after analytics consent
Google Tag Manager
GTM-PL94DSLF / loads only after analytics or advertising consent
GA4 cookies
_ga and _ga_Q8Y7TYW3S3 / first party / default up to 2 years; browsers may shorten the lifetime
Retention
Event and user data: 14 months; aggregated standard reports may remain available longer
Advertising measurement
Google Ads, Meta and other advertising tags not active

06

Subject to the GDPR, individuals have rights including access, correction, deletion, restriction, portability and objection. Consent can be withdrawn at any time for the future. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.

Where processing relies on legitimate interests, an individual can object for reasons arising from their particular situation. Please send requests to info@propaganda-solutions.com. Individuals also have the right to complain to a data-protection authority, particularly in the place where they live, work or believe an infringement occurred.

Review basis / Official

These links support the review process. They do not replace advice on the final company, provider and processing configuration.