Privacy Policy

Responsible person

Contact

Email: hello@prettyscrum.org

Privacy – General Information

Protecting your personal data is important to me. I treat personal data confidentially and in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

This website can generally be used without providing personal data. If personal data (such as your name or email address) is collected on my website, it is always provided voluntarily. I do not share this data with third parties without your express consent.

Getting in touch

If you contact me, for example by email, the information you provide will be stored solely to process your enquiry and any follow-up questions. This data will not be shared without your consent.

Hosting and Content Delivery Network (CDN)

I use the services of Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (“Vercel”) to host and deliver this website.

Vercel processes personal data as a data processor in this context. When you visit the website, technically necessary access data is processed, including, for example:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

This data is required to display the website correctly and ensure its stability and security. The legal basis is Article 6(1)(f) GDPR (legitimate interests).

As Vercel is a US company, personal data may be transferred to the USA. To ensure an adequate level of data protection, I have entered into a Data Processing Agreement (DPA) with Vercel incorporating Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) GDPR.

Vercel’s DPA is available at: https://vercel.com/legal/dpa

Vercel Analytics

This website uses Vercel Analytics, an analytics service provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

Vercel Analytics collects anonymised usage statistics to improve the website’s performance and usability. No cookies are set and no personal profiles are created.

The data collected includes, in particular:

• Pages viewed
• Approximate location (country/region)
• Device type and browser
• Loading times and technical performance data

IP addresses are not stored permanently or used to identify individual users.

Processing is based on Article 6(1)(f) GDPR (legitimate interests), as there is a legitimate interest in anonymously analysing the use of this website.

As Vercel is a US company, data may be transferred to the USA. To ensure an adequate level of data protection, I have entered into a Data Processing Agreement (DPA) with Vercel incorporating Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) GDPR.

For more information about Vercel Analytics, visit:

https://vercel.com/docs/analytics

https://vercel.com/legal/dpa

Web analytics with PostHog

This website uses PostHog, an analytics tool provided by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. For European users, all data is processed in PostHog’s EU cloud.

I use PostHog to better understand how visitors use my website and to improve its usability.

Data collected

PostHog may process the following data in particular:

• Pages visited and clicks
• Interactions with page elements (Autocapture)
• Technical information such as browser, device type and operating system
• Session duration and navigation paths
• Performance and Web Vitals data
• Pseudonymous usage identifiers

Under my current configuration:

• IP addresses are not stored (“Discard client IP data” is enabled)
• No personal profiles are created
• Users are recorded only in pseudonymised form

Session Replay (session recordings)

I also use PostHog’s “Session Replay” feature. This allows usage sessions to be recorded to better understand errors or usability issues.

Recordings may include:

• Mouse movements and clicks
• Scrolling behaviour
• Page views and navigation

The contents of sensitive input fields are not deliberately stored. Where necessary, data may also be masked using technical measures.

Cookies and tracking

PostHog may use cookies or similar technologies to associate activity with sessions. In addition, “Cookieless Tracking” is enabled in my project, allowing privacy-friendly identification using hashing.

Purpose of processing

The data is used solely to:

• Better understand how my website is used
• Identify errors and technical problems
• Improve usability
• Optimise features and content

The data is not used for advertising or for profiling beyond these purposes.

Legal basis

Processing is based on Article 6(1)(f) GDPR (legitimate interests). My legitimate interest is to analyse and improve my services and to ensure the secure and error-free operation of the website.

If a cookie consent banner is introduced in the future, processing will be based on Article 6(1)(a) GDPR (consent).

Data processing in third countries

PostHog is a US company. However, as I use PostHog’s EU cloud, data is generally processed within the European Union. If data is transferred to the USA in exceptional cases, appropriate safeguards are used, in particular Standard Contractual Clauses (SCCs) in accordance with Article 46 GDPR.

Data processing on behalf of the controller

I have entered into a Data Processing Agreement with PostHog in accordance with Article 28 GDPR.

Retention period

Analytics data and session recordings are stored only for as long as necessary for the purposes described above and in accordance with the retention periods configured in PostHog.

Right to object

You can object to data collection by PostHog at any time by blocking tracking in your browser or using appropriate privacy add-ons.

For more information about privacy at PostHog, visit: https://posthog.com/privacy

Cookie settings

You can change your choice regarding PostHog tracking at any time.

Supabase

This website uses Supabase, a backend platform provided by Supabase Inc., 970 Toa Payoh North, #07-03, Singapore 318992 (“Supabase”).

Supabase is used to:

• Provide content such as quiz questions and learning materials
• Store and restore users’ individual learning progress

Personal data may be processed in this context, in particular:

• A technical user identifier (such as an anonymous ID or account ID)
• Saved learning status, answered questions or progress data

No data is processed for advertising purposes and no profiles are created outside the learning context.

Legal basis

Article 6(1)(b) GDPR (performance of a contract), where learning progress is associated with a registered user account.

Article 6(1)(f) GDPR (legitimate interests), where learning progress is stored anonymously or pseudonymously, as this is necessary for the learning platform’s functionality.

Supabase processes the data as a data processor. A Data Processing Agreement (DPA) has been concluded in accordance with Article 28 GDPR.

Depending on the configuration, data may be transferred to third countries (such as the USA). Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) GDPR are used to ensure an adequate level of data protection.

Further information:

https://supabase.com/privacy

https://supabase.com/dpa

Signing in with LinkedIn (LinkedIn OAuth)

This website offers the option to sign in using “Sign in with LinkedIn”. This service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”).

If you choose to sign in with LinkedIn, you will be redirected to LinkedIn. LinkedIn will then send me certain information from your LinkedIn profile, provided you consent. This generally includes:

• Your name
• Your email address
• Your LinkedIn profile ID

This data is used solely to create your user account or authenticate you. It is not used for any other purpose, in particular advertising.

Legal basis

Processing is based on Article 6(1)(b) GDPR (performance of a contract), as the data is necessary to provide a user account.

Data transfers to third countries

LinkedIn is a company based in the USA. It therefore cannot be ruled out that personal data may be transferred to the USA. LinkedIn uses appropriate safeguards, in particular Standard Contractual Clauses (SCCs) in accordance with Article 46 GDPR.

For more information about privacy at LinkedIn, visit: https://www.linkedin.com/legal/privacy-policy

Server log files

When you visit this website, information sent by your browser to the server is collected automatically. This data includes, among other things:

• Browser type and version
• Operating system
• Referrer URL
• IP address or hostname
• Time of the server request

This data is not combined with other data sources. Processing is carried out in accordance with Article 6(1)(f) GDPR to ensure security and protect against misuse.

Your rights

You have the right, at any time and free of charge, to:

• Obtain access to your stored personal data (Article 15 GDPR)
• Request the rectification of inaccurate data (Article 16 GDPR)
• Request the erasure of your data (Article 17 GDPR)
• Request the restriction of processing (Article 18 GDPR)
• Withdraw your consent with effect for the future
• Receive your data in a structured, commonly used format (Article 20 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority.