Privacy policy

Last updated: Oktober 2026

1. Controller

Jonathan Koss, Ostpreußenstraße 14, 31188 Holle, Deutschland, jonathan.koss@outlook.de

2. What this website does not do

This website sets no cookies and stores nothing in your browser. It uses no tracking and no analytics tools. Fonts and images are hosted on our own web space; no data is sent to third parties such as Google when you visit.

3. Hosting

The website is hosted by Cloudflare, Inc., USA (Cloudflare Pages). When you visit, Cloudflare processes technically necessary data (IP address, time, page requested, browser information) to deliver the site and protect it against abuse, for example by limiting excessive sign-ups. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. Delivery uses a worldwide network of data centres. Cloudflare is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); we have a data processing agreement with Cloudflare.

4. Waitlist with confirmation (double opt-in)

When you sign up, we process your email address, your language, optionally your role and the size of your organisation, the times of sign-up and confirmation, the version of the consent text, the version of the page you signed up on and, if present, the campaign parameter in the link you used (e.g. “utm_source=linkedin”). This information is part of the link itself; no cookies are set for it. Purpose: to inform you about the trial phase and the launch of Passa. The legal basis is your consent (Art. 6(1)(a) GDPR). The confirmation email serves as proof of your consent (Art. 7(1) GDPR).

Data is stored and emails are sent via Resend, Inc., USA. Resend is certified under the EU-U.S. Data Privacy Framework; we have a data processing agreement with Resend.

Unconfirmed sign-ups are deleted automatically after 30 days. Confirmed sign-ups are deleted when you withdraw your consent or the waitlist ends.

You can withdraw your consent at any time with effect for the future: via the link in every email or by simply emailing jonathan.koss@outlook.de.

5. Booking a call

To book a call we link to Calendly (Calendly LLC, USA, https://calendly.com/jonathan-koss/30-minutes-call). Nothing is loaded on this website for this; Calendly's page only opens when you click the link. There you enter your name, email address and any other details yourself so that we can arrange the call (Art. 6(1)(b) GDPR). Calendly is certified under the EU-U.S. Data Privacy Framework. Calendly's own privacy notice also applies to processing on its page.

6. Contact by email

If you write to us, we process your details to reply (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed for that purpose.

7. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent (Art. 7(3))
• Complaint to a data protection supervisory authority (Art. 77), in particular in the member state of your habitual residence, place of work or the alleged infringement

A short email to jonathan.koss@outlook.de is enough. There is no automated decision-making and no profiling. Information on the waitlist is voluntary.

8. Encryption

The website is only served encrypted (HTTPS).