Privacy notice

Controller

Arved Lanz (Coloqa)

Address

Pestalozzistr. 8, 80469 München, Germany

Privacy contact

info@coloqa.com

Coloqa is hosted by Vercel Inc.; static content is delivered by Vercel’s global network.

With every request, Vercel processes technically necessary data: IP address, date and time, the address requested, referrer, and browser and device type. This serves the delivery, stability and security of the website. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

The registered office, the transfer basis and, where known, the storage location of Vercel and our other processors are listed under Service providers.

For sign-in and organisations, we use Clerk, Inc. As soon as you open the website, your browser loads Clerk’s sign-in function; in the process, Clerk receives your IP address and technical browser data.

If you use an account, Clerk processes your name, email address, organisation membership and sign-in sessions.

During registration, Clerk uses Cloudflare Turnstile to check whether a human is filling in the form. For this, your browser loads a verification script from Cloudflare, Inc., USA, which receives your IP address and technical browser data. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework.

The legal basis is the provision of your account (Art. 6(1)(b) GDPR) and our legitimate interest in a secure sign-in (Art. 6(1)(f) GDPR).

To detect and fix errors, we use Sentry by Functional Software, Inc.

Sentry receives technical error messages, the browser, the operating system and the affected page. In addition, with every page view your browser reports the start of a session, so that we can see how many sessions remain free of errors. Only with your consent to product analytics does it also send, for about one in ten page views, loading times and the addresses requested. We remove names, email addresses and similar details before sending; session recordings are disabled. During transmission, Sentry also receives your IP address.

The legal basis for error reports and session starts is our legitimate interest in a stable and secure application (Art. 6(1)(f) GDPR); for loading times and the addresses requested, it is your consent (see “Consent and withdrawal”).

On the public pages and on sign-in and sign-up, we count without consent how the website is used: which page was viewed in which language, whether a visit came directly, from a search engine, a social network, an AI assistant or another website (naming well-known services such as google.com or linkedin.com), the campaign parameters of a link (utm_source, utm_medium, utm_campaign) and which kind of link was clicked, for example to contact us or to sign up. When the contact form is sent, we also count how it ended (sent, incomplete or not deliverable), together with the entry page and the origin of that visit; what you type is never included.

Your browser sends only these fixed details to our server, which passes them on to PostHog Inc. without your IP address, any identifier or browser data. Nothing is stored in your browser for this; only the open tab knows where a visit came from, and nothing can be attributed to a person.

The legal basis is our legitimate interest in understanding which content visitors look for and how they use the website (Art. 6(1)(f) GDPR).

With your consent, we use PostHog Inc. to analyse page views, usage events, technical browser data and recordings of visits to our public pages and to improve Coloqa.

PostHog receives page views, timestamps, time on page and scroll depth, the referring page and campaign parameters, clicked links as a fixed label, random session identifiers and technical browser data. During transmission, the provider also receives your IP address.

On the public pages such as the home page, product, guides or contact, PostHog also records how you use the page: page layout, mouse movements, clicks and scrolling. Your browser masks inputs in form fields and text inside forms before anything is sent; network requests, console output and canvases are not recorded. Nothing is recorded in the planning workspace, at sign-in or sign-up, or in the demo. The recordings show us where visitors get stuck and which content is unclear.

Usage events contain your organisation’s identifier: started and completed searches, viewed recommendations, exported or shared decision memos, and started and confirmed bookings with their type (flight, train or hotel). Inputs, names, destinations, prices and person profiles are not collected.

Coloqa only sets technically necessary cookies: Clerk uses them to store your sign-in. Without them, no login is possible; they are therefore permitted without consent (Section 25(2) no. 2 TDDDG).

We store your choices on product analytics and on maps and city photos in your browser’s local storage until you change them or clear the site data. PostHog does not set cookies; its identifiers stay only in the memory of the open browser window. We do not use advertising or tracking cookies.

The legal basis for the product analytics, including Sentry’s loading-time measurement, and for maps and city photos in the browser is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Both start only after you agree; Coloqa can also be used without consent.

You can withdraw your consent at any time: for the product analytics via “Analytics settings” and “Decline”, for maps and city photos via “Maps and photos” and “Don’t load”. The lawfulness of processing carried out before the withdrawal is not affected.

If you write to us by email or via the contact form, or request a pilot project or a travel check, we process your details in order to answer the enquiry and prepare the pilot project or the travel check. The legal basis is Art. 6(1)(b) GDPR and, for other enquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR).

The contact form transmits your name, email address, optionally your company, and your message; they reach us as an email. Until delivery we hold them for at most one day.

To protect against abuse, we limit the number of messages per sender and in total. For this purpose, we store a hash of your IP address (for IPv6, of the /64 network) for no longer than ten minutes. The legal basis for this is our legitimate interest in protecting the form and email delivery from abuse (Art. 6(1)(f) GDPR).

Which service providers deliver, count and receive messages is listed under Service providers.

We approach consultancies directly. For this, we keep a sales database of companies and contacts: name, company, role, publicly available details from professional profiles such as LinkedIn, notes and the history of our contact. The details come from publicly available sources or from our contact with you. For a travel check, we also process a company’s offices and how many people travel from each; people appear in a travel check only as placeholders.

The legal basis is our legitimate interest in approaching and looking after potential customers (Art. 6(1)(f) GDPR). We keep the details for as long as we are preparing or maintaining a working relationship and delete them as soon as you object or no further contact is expected. You can object to this processing at any time (Art. 21 GDPR). The database is run by Notion; see Service providers for details.

Organisations use Coloqa to plan project meetings and prepare trips. For this, we process the data an organisation provides: names, business email addresses, offices and home locations, project memberships, travel periods and travel preferences, for office networking the office days and whom a person follows, and, for bookings, details from the travel profile, such as the passport number. We store travel profiles in encrypted form.

The respective organisation is the controller for this data; we process it on the organisation’s behalf (Art. 28 GDPR) and use the companies listed under “Service providers” for this purpose.

Airlines, hotels and rail operators receive the details required for a booking and process them under their own responsibility.

If a person connects their Google or Outlook calendar, Coloqa enters the flight, rail and hotel bookings on which they themselves travel, as well as their accepted networking meetings, in the “Coloqa Reisen” calendar in their account. This also applies to administrators; Coloqa does not transfer bookings for other travellers. An entry for a booking contains the title, time, place, connection or hotel, project name, project code and booking reference, and for flights the PNR; an entry for a networking meeting contains the title, time, place, the invitation message and the names of both participants. Google or Microsoft, as applicable, receives these details for this purpose. If a person subscribes to their private calendar feed, for example in Apple Calendar, the calendar service they choose for this retrieves the same details via the secret feed address whenever it refreshes the calendar.

Only the operator of Coloqa uses AI tools for development, maintenance and error analysis. Whatever these tools read from Coloqa in the process is received by the respective provider in order to generate the response. Which providers these are and what their tools can access is listed under Service providers.

In this context, we process the organisations’ data on their behalf (Art. 28 GDPR), and otherwise on the basis of our legitimate interest in a secure and error-free application (Art. 6(1)(f) GDPR).

These service providers process data on our behalf, for the website as well as for the organisations that use Coloqa. For each of them, the list states the registered office, the basis for transfers outside the EU and, where known to us, the storage location.

• Hosting: Vercel Inc., USA

  Operates the website and the application; the server functions run in the Frankfurt am Main region. The company is certified under the EU-US Data Privacy Framework.

• Sign-in and organisations: Clerk, Inc., USA

  Manages accounts, organisations and roles as well as the access permissions of connected calendars, and stores this data in the USA. The company is certified under the EU-US Data Privacy Framework.

• Database and file storage: Supabase Pte. Ltd., Singapore

  Stores the application data in the Frankfurt am Main region. Access from outside the EU is covered by the EU Standard Contractual Clauses.

• Cache: Upstash, Inc., USA

  Temporarily caches search results from travel providers, limits requests to these providers, counts contact form messages and holds them until delivery; the data is stored in the Frankfurt am Main region. The company is certified under the EU-US Data Privacy Framework.

• Background tasks: API Hero Ltd (Trigger.dev), United Kingdom

  Runs searches, bookings with a travel expense overview, HR imports, calendar sync, meeting suggestions for office networking, notifications and anonymisation once retention periods expire in the background; the data is stored in the USA. An adequacy decision of the European Commission exists for the United Kingdom. For storage in the USA, the provider agrees EU Standard Contractual Clauses with its sub-processors.

• Background service: Railway Corporation, USA

  Operates a background service of the application in the Amsterdam region. The company is certified under the EU-US Data Privacy Framework.

• Email delivery: Brevo GmbH, Germany

  Sends emails about trips, bookings and cancelled office networking meetings as well as contact form messages via servers in the EU. The company has its registered office in the EU.

• Email mailboxes: IONOS SE, Germany

  Operates our email mailboxes, which receive enquiries by email and contact form messages. The company has its registered office in the EU.

• Sales database: Notion Labs, Inc., USA

  Runs our sales database of companies, contacts and travel checks. Processing may also take place in the USA. Transfers to third countries are covered by the EU Standard Contractual Clauses.

• Error monitoring: Functional Software, Inc. (Sentry), USA

  Receives sanitised error reports and session reports from the browser, the application and background tasks and performance data from the application and background tasks, including the organisation’s identifier, and stores them in Frankfurt am Main. Sentry receives performance data from the browser (load times and requested addresses) only with consent to product analytics. The company is certified under the EU-US Data Privacy Framework.

• Product analytics and operating metrics: PostHog, Inc., USA

  Receives the website’s anonymous visit statistics without IP address or identifier, with consent the website’s product analytics and, from the background tasks, the event name, duration, result and a fixed reason such as an error code with the organisation’s identifier, and for the contact form only whether a message was accepted and delivered, without any data on persons; hosting in Frankfurt am Main (PostHog Cloud EU). The company is certified under the EU-US Data Privacy Framework. EU hosting alone does not rule out access from third countries.

• Import from HR systems: Merge API, Inc., USA

  Transfers personal data from an organisation’s HR system via the EU instance of Merge if the organisation uses the integration. The transfer is covered by the EU Standard Contractual Clauses.

• Planning chat and AI tools: OpenAI Ireland Ltd, Ireland

  Processes messages and the planning data retrieved for them when someone uses the planning chat. The planning chat is available to all organisations. In addition, during development, maintenance and error analysis, the AI tool Codex can read data from the production database. Processing may also take place in the USA and other countries. Transfers to third countries are covered by the EU Standard Contractual Clauses.

• AI tools: Anthropic Ireland, Limited, Ireland

  During development, maintenance and error analysis, the AI tools Claude and Claude Code can read data from the production database and other production systems, such as user management, runtime logs, error reports and background tasks. The data is stored in the USA; requests may also be processed in Europe, Asia and Australia. Transfers to third countries are covered by the EU Standard Contractual Clauses.

• Flights: Duffel Technology Limited, United Kingdom

  Searches flight offers and transmits bookings to airlines. An adequacy decision of the European Commission exists for the United Kingdom.

• Hotels: Nuitée Travel Limited (LiteAPI), Ireland

  Searches hotel and flight offers and transmits hotel bookings to hotels. The company has its registered office in the EU.

• Rail: All Aboard AB, Sweden

  Searches rail connections and transmits bookings to rail operators. The company has its registered office in the EU.

With your consent, Coloqa shows maps from Google Maps (Google Cloud EMEA Limited, Ireland) and city photos from Unsplash (Unsplash Inc., Canada). Your browser then loads this content directly from the providers; they receive your IP address and technical browser data in the process. Without consent, Coloqa shows no city photos and, instead of Google Maps, a drawn overview or the list. In that case, your browser does not load maps and city photos from these providers.

Independently of this, we query the Google Maps Platform on the server side for coordinates of office and meeting point addresses (Geocoding), places near offices (Places) and travel times between places (Routes). In doing so, we transmit addresses and coordinates, not names of persons. The legal basis for this is our legitimate interest in accurate travel planning (Art. 6(1)(f) GDPR). For the CO₂ values of flights, we query Google’s Travel Impact Model and transmit only airports, airline, flight number and date, no details about persons.

Both providers process this data under their own responsibility. Google LLC is certified under the EU-US Data Privacy Framework; for Canada, an adequacy decision of the European Commission exists.

Your browser loads hotel photos directly from the image servers that the hotel provider LiteAPI specifies for them, and restaurant photos from the address that employees gave with their suggestion, even if it is hosted by Google or Unsplash. Your browser loads airline logos directly from the image server of our flight service provider Duffel; Coloqa itself delivers the Lufthansa and City Airlines logos. Your browser loads this content regardless of your choice on maps and city photos; the image servers receive your IP address and technical browser data in the process. The legal basis is our legitimate interest in making hotels and restaurants comparable with photos and airlines recognisable by their logo (Art. 6(1)(f) GDPR).

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods. In detail:

Server log data and error data

Vercel keeps runtime logs for us for no longer than one day. Sentry deletes error reports, session reports and performance data after 90 days at the latest.

Account

Until your account is deleted.

Product analytics

PostHog deletes the analytics data after one year and recordings of the public pages after 30 days.

Enquiries by email

Until the enquiry has been dealt with; business correspondence for the statutory retention periods.

Organisations’ data

For as long as the organisation uses Coloqa. We automatically anonymise persons whom an organisation deactivates after 90 days and delete their profile pictures.

Technical logs of the application

They contain only event names, status values and counters, no inputs and no details about persons.

Subject to the statutory requirements, you can request access, rectification, erasure, restriction of processing and data portability. You can object to processing based on our legitimate interest on grounds relating to your particular situation (Art. 21 GDPR). For privacy enquiries, please use the contact details given above.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is: