Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

For data protection inquiries or to exercise your rights, you may contact us using the details above.

2. Scope of this Privacy Policy

This Privacy Policy explains how we process personal data when you visit colossalops.com or contact us through the website. We process personal data in accordance with applicable data protection law, including the EU General Data Protection Regulation (GDPR) where it applies.

We do not operate an office or other establishment in Germany. The website is primarily a business-to-business website for our influencer-marketing services.

3. Website Hosting

The website is hosted by Namecheap, Inc. Namecheap may process technical information generated when the website is accessed, such as IP address, date and time of access, requested resources, browser information, operating system information, referrer information, and security or log information, to the extent such information is processed in connection with hosting and security.

The purpose of this processing is to provide the website securely and reliably, maintain availability, detect and prevent abuse, and protect the website and infrastructure against technical attacks.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in providing a secure, stable and functional website.

Namecheap acts as a processor for customer data where applicable. Namecheap states in its Data Processing Addendum that it may transfer customer data to the United States and that Standard Contractual Clauses apply to transfers outside the EEA where required. The applicable contractual and technical safeguards are governed by Namecheap's current terms and data-processing documentation.

4. Contact Form

You can contact us through the contact form on our website. The form asks for your name, email address and information you choose to include in the project/message field.

We process this information to receive, evaluate and respond to your inquiry and, where applicable, to discuss or prepare a potential business relationship.

Where your inquiry relates to the steps necessary to enter into a contract or to respond to a request made by you in that context, the legal basis is Article 6(1)(b) GDPR. For other business inquiries, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in responding to business inquiries and maintaining business communications.

5. Formspree

Our contact form is technically processed using Formspree. When you submit the form, the information you enter is transmitted to Formspree for processing and delivery to us.

Formspree states that its services are hosted on Amazon Web Services in the United States and that it uses Standard Contractual Clauses as a data processor for GDPR purposes. Formspree also states that it uses encryption and other technical and organisational security measures.

Formspree may process form-submission data and associated technical information necessary to provide and secure the form service. Formspree's own privacy policy and current service terms govern its processing as a service provider.

Formspree: https://formspree.io/

Formspree privacy policy: https://formspree.io/legal/privacy-policy

6. Business Email / Google Workspace

We use Google Workspace for business email. If you contact us by email, or if we respond to a form submission by email, Google may process the email address, name, message content, attachments and related account or technical information as necessary to provide the email service.

The purpose is to communicate with you, respond to inquiries, and, where applicable, establish or perform a business relationship.

The legal basis is Article 6(1)(b) GDPR where the communication concerns steps to enter into or perform a contract, and Article 6(1)(f) GDPR for other business communications.

Google Workspace is subject to Google's applicable data-processing terms. Depending on the Workspace edition, configuration and service, Google may process or store data in different locations. Google provides contractual data-protection safeguards for processing subject to the GDPR, including its Data Processing Amendment and, where applicable, Standard Contractual Clauses.

7. Cookies and Similar Technologies

Our website does not intentionally use non-essential analytics, advertising or behavioural-tracking cookies. We do not use Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag or similar advertising or analytics services.

The website uses locally hosted font files. No connection to Google servers is required to load the fonts used on the website.

If technically necessary cookies or similar technologies are used for the operation, security or transmission of the website or for a service explicitly requested by you, they are used only to the extent permitted without consent under applicable law. Any non-essential storage or access to information on your device will be subject to consent where required by applicable law, including Section 25 TDDDG in Germany.

8. International Data Transfers

Because our company is established in Canada and some of our service providers operate internationally, personal data may be processed outside the European Economic Area (EEA), including in the United States.

Where a transfer of personal data from the EEA to a third country is subject to Chapter V GDPR, we rely on an applicable legal transfer mechanism, such as an adequacy decision where available or appropriate safeguards such as Standard Contractual Clauses.

In particular, Namecheap states that its covered services may involve processing in the United States and that its Data Processing Addendum contains Standard Contractual Clauses for relevant transfers. Formspree states that its services are hosted in the United States and that it relies on Standard Contractual Clauses as a data processor. Google Workspace provides contractual data-processing safeguards and transfer mechanisms under its applicable terms.

9. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, including responding to an inquiry, maintaining necessary business correspondence, establishing or performing a business relationship, or complying with legal obligations.

Contact-form submissions and related correspondence may be retained for the duration of the communication and for a reasonable period thereafter where necessary for legitimate business record-keeping or the establishment, exercise or defence of legal claims. Where statutory retention obligations apply, data may be retained for the period required by law.

The retention periods of Formspree and other service providers are also subject to their applicable terms and privacy documentation.

10. Recipients and Service Providers

Depending on how you interact with the website, personal data may be processed by the following service providers:

• Namecheap, Inc. — website hosting and related technical infrastructure.
• Formspree — processing and delivery of contact-form submissions.
• Google / Google Workspace — business email and related email infrastructure.

We do not sell personal data and do not use contact-form information for third-party advertising or behavioural profiling.

11. Your Rights under the GDPR

Where the GDPR applies, you have the following rights, subject to the statutory conditions and exceptions:

• Right of access (Article 15 GDPR).
• Right to rectification (Article 16 GDPR).
• Right to erasure (Article 17 GDPR).
• Right to restriction of processing (Article 18 GDPR).
• Right to data portability (Article 20 GDPR).
• Right to object to processing based on legitimate interests (Article 21 GDPR).
• Right to withdraw consent at any time where processing is based on consent (Article 7(3) GDPR).

To exercise these rights, contact us using the details in Section 1. We may need to verify your identity where reasonably necessary to protect your personal data.

12. Right to Lodge a Complaint

Where the GDPR applies, you have the right to lodge a complaint with a competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of an alleged infringement.

13. Automated Decision-Making and Profiling

We do not use the website to carry out automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals.

14. Security

We take reasonable technical and organisational measures appropriate to the risks of processing to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

No method of transmission over the Internet or electronic storage is completely secure. We therefore cannot guarantee absolute security.

15. Changes to this Privacy Policy

We may update this Privacy Policy where our website, services, processing activities or applicable legal requirements change. The current version will be published on this website.

Last updated: August 2026

16. Important Information for Website Visitors

Please do not submit sensitive personal data through the contact form unless it is strictly necessary and specifically requested. In particular, please do not submit health information, financial account information, government identification numbers or other special-category personal data through the form.