Privacy

Privacy Policy

Information under Art. 13 & 14 EU GDPR · Last updated: November 2026

This English Privacy Policy is provided for international transparency. Because the controller is established in Germany, the German version (Datenschutzerklärung) governs in case of any divergence.

1. Data Controller

PYCIE Studio, Owner: Refik Emre Ak, Rötestraße 20, 74321 Bietigheim-Bissingen, Germany. Email: contact@pycie.com, Phone: +49 152 24759168.

We are not legally required to appoint a Data Protection Officer. For any privacy questions or data subject requests, contact us directly via the details above.

2. Hosting, Edge Delivery & Server Logs

We deliver this platform using Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA; primarily served via European edge nodes) and an encrypted PostgreSQL database hosted in the EU. Data Processing Agreements under Art. 28 GDPR are in place; any US data transfers rely on the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses (Art. 46 GDPR).

Each page request processes essential connection metadata (IP address, timestamp, requested URL, HTTP status, referrer, and user-agent) based on Art. 6 (1) (f) GDPR (operational stability and abuse defense). Raw server logs are deleted within 14 days.

3. Cookies, Local Storage & Self-Hosted Fonts

We do not use advertising cookies, cross-site trackers, or third-party analytics suites. Consequently, no cookie consent banner is required.

Language cookie (“MANUAL_NEXT_LOCALE”, 1 year): set only when you manually switch the site language so your preference is remembered (§ 25 (2) No. 2 TDDDG).

Browser localStorage: your provider shortlist and checked items in the relocation roadmap stay strictly inside your own browser and are never transmitted to our servers. Strictly necessary session cookies and device tokens are only used on restricted administrative routes (§ 25 (2) No. 2 TDDDG).

All fonts and photographs are served directly from our own domain; your browser makes zero background requests to Google Fonts.

4. Privacy-Preserving Impression & Referral Telemetry

When a listing is displayed or you click an outbound WhatsApp or website link, we record the provider slug, category, UI language, and a daily-rotating truncated HMAC-SHA256 digest (“ip_hash”). Plaintext IP addresses are never stored in our analytics tables (Art. 6 (1) (f) GDPR — fraud prevention and aggregate referral proof).

5. VIP 3-Quote Match (/concierge) & Transfers to the UAE

When you submit a VIP Match request, we process your name, WhatsApp number, selected category, optional district, preferred language, timeline, optional project note, and an anti-bot proof-of-work token.

Your brief is shared with at most three verified, UAE-licensed partner companies in Dubai matching your selected discipline so they can respond to you directly via WhatsApp.

Third-country transfer notice: The European Commission has not issued an adequacy decision under Art. 45 GDPR for the United Arab Emirates, where local data protection rules (such as the UAE PDPL) apply rather than EU GDPR. Sharing your request with up to three selected firms in Dubai takes place strictly at your initiative to take steps prior to entering into a contract (Art. 6 (1) (b), Art. 49 (1) (b) GDPR) and on the basis of your explicit consent in the request form (Art. 6 (1) (a), Art. 49 (1) (a) GDPR).

6. Partner Applications & Profile Claims (/partner/apply)

When a business reserves a Podium slot or claims an existing listing, we process the company name, website, UAE licensing authority, licence number, contact person, business email, business WhatsApp number, and billing preference to verify trade licences and prepare the B2B agreement (Art. 6 (1) (b) and (f) GDPR).

7. Outbound Links (WhatsApp & Provider Websites)

Only when you actively click a WhatsApp button (“wa.me”, operated by WhatsApp Ireland Ltd. / Meta Platforms Inc.) or an external company website does your browser connect to those third parties under their own privacy policies.

8. Retention Periods

  • VIP Match requests: retained until matching and follow-up questions are concluded (typically up to 6 months), or deleted earlier upon request
  • B2B partner applications & invoices: for the duration of the contract plus statutory German commercial and tax retention periods of 6 to 8 years (§ 257 HGB, § 147 AO)
  • Short-lived rate-limit and login-protection counters: several minutes up to a maximum of 24 hours

9. Your GDPR Rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), withdrawal of consent at any time with future effect (Art. 7 (3)), and objection to processing based on legitimate interests (Art. 21). Simply email contact@pycie.com.

You also have the right to lodge a complaint with a supervisory authority, in particular at our place of establishment: State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.