Telewa Logo
DEEN
Back to homepage

Privacy Policy

As of: July 2026. This is a courtesy translation; the legally binding version is the German original.

1. Controller & Scope

The Nexus Collective GmbH (operator of the Telewa brand)

Poststraße 14-16, 20354 Hamburg, Germany

E-mail: [email protected]

Registering court: Local Court of Hamburg (Amtsgericht Hamburg), HRB 196591

VAT ID: DE459881075

Authorised managing director: Daniel Hanelt

Web: www.telewa.de

This privacy policy applies to our website, our landing pages (including industry-specific landing pages) and to the internal SaaS/CRM processing in connection with our services (lead generation, appointment scheduling, communication, payment processing).

2. Principles of data processing

We process personal data in accordance with the GDPR and the German TDDDG (formerly TTDSG). Purposes, legal bases, recipients, retention periods and data subject rights are described below for each processing activity. Cookies/trackers that are not technically necessary are only used after consent (opt-in with a reject option).

3. Hosting, infrastructure & server logs

Hosting:

  • IONOS SE (DE/EU) – hosting of individual web presences/landing pages
  • Vercel, Inc. (USA/EU) – hosting/deployment of projects (edge/global CDN)

Server logs: When our pages are accessed, the respective host processes, among other things, IP address, date/time, user agent, referrer and requested resource. Purpose: technical provision, security (Art. 6(1)(f) GDPR). Retention period: until revoked (administrative deletion routine).

Recipients/role: hosts acting as processors (data processing agreement). For transfers to third countries, DPF/SCCs apply (see section 10).

4. Consent management & cookies/tracking

On your first visit to this website, our own consent notice (no third-party tool) asks whether we may set cookies for audience measurement. Until you decide, no cookies are set and no usage data is collected. Technically necessary cookies (e.g. for page delivery) are based on Art. 6(1)(f) GDPR.

Audience measurement (PostHog): We use PostHog (PostHog Inc.; data processing on EU servers) to understand which content is read and through which channels visitors find us. If you consent, PostHog sets a first-party cookie that lets us recognise you on a later visit (Art. 6(1)(a) GDPR; Section 25(1) TDDDG). If you decline, we only collect anonymous statistics: PostHog then counts you via a privacy-preserving checksum computed on its servers, without any storage on your device (Art. 6(1)(f) GDPR – legitimate interest in audience statistics). No recording of operating sessions (session replay) takes place on this website.

Marketing (Google Ads and Meta Pixel): If you consent, we additionally load the Google Ads and Meta tags to measure the effectiveness of our ads and to show you relevant advertising (details in section 7). Without your consent they are not loaded.

Your options: browser cookie settings and withdrawal of your consent – at any time and with effect for the future: .

5. Contact, forms & communication

Forms (web/landing pages, e.g. Tally.so):

Data: name, e-mail, phone, message/details about the business/appointment, etc.

Purposes: responding to enquiries, appointment scheduling, quotation, onboarding.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contractual communication) or (f) (legitimate interest in efficient communication); where consent is given, (a).

Retention period: until revoked or until the purpose is fulfilled; statutory retention obligations remain unaffected.

Demo call by our AI telephone assistant:

On our landing pages you can enter your phone number to receive a one-time demo call from our AI telephone assistant. The phone number, the selected industry and campaign parameters are processed. The call runs via our self-operated voice-AI platform on servers in Germany; as processors we use Twilio (telephony), Deepgram (speech recognition, EU endpoint), Cartesia (speech synthesis) and OpenRouter/OpenAI (language model) (USA — DPF/SCCs, see section 10).

Legal basis: your consent in the form (Art. 6(1)(a) GDPR). The call is made once for demo purposes; storage until revoked or until the purpose is fulfilled.

WhatsApp Business API:

Communication via WhatsApp (Meta/WhatsApp Ireland). Content/metadata is processed to handle your enquiry. Legal basis: Art. 6(1)(b) or (f); where consent is given, (a). Note: WhatsApp processes data as an independent controller (platform operation). Details are available from WhatsApp.

E-mail newsletter/broadcasts (e.g. Brevo or similar):

Sent to prospects/customers only with (double) opt-in; withdrawal/unsubscribe at any time. Legal basis: Art. 6(1)(a) GDPR (consent) or Section 7 UWG in conjunction with Art. 6(1)(f) GDPR (advertising to existing customers, where permitted).

Appointment booking (Google Calendar):

For scheduling demo/consultation appointments we use the Google Calendar scheduling service (Google Ireland Limited). Your appointment and contact data are processed for slot allocation/reminders (where applicable via e-mail). Legal basis: Art. 6(1)(b) (appointment scheduling) or (f). Any data transfer to the USA is based on the EU-US Data Privacy Framework (Google LLC is certified).

Product integration with Google Calendar and Microsoft Outlook:

Workspace administrators can voluntarily connect their Google or Microsoft calendar to Telewa via OAuth. In doing so, Telewa processes the e-mail address of the connected account, server-side encrypted access and refresh tokens, and the appointment data that a user explicitly releases within Telewa for creation (e.g. title, description, start, end and time zone).

The calendar permission is used solely to query free/busy times of the connected calendar for appointment suggestions, to create user-initiated appointments in the primary calendar, and to maintain the authorisation required for this. Telewa does not create a full copy of existing calendars, does not use calendar data for advertising or AI model training, and does not sell it.

Tokens and connection metadata are stored with restricted access in our SaaS database and are only transmitted to Google or Microsoft to the extent necessary to perform the selected calendar function. They are retained until the integration is disconnected or the workspace is deleted. Upon disconnection, we delete the stored connection data without undue delay and revoke the provider authorisation, to the extent the provider offers a technical interface for this.

If a caller books an appointment via a workspace's AI telephone assistant, free/busy times and booking confirmations of the connected calendar are transmitted to the language model used for the purpose of conducting the conversation (OpenRouter, Inc. as API gateway, model by OpenAI; USA — DPF/SCCs). For this processing, zero data retention is enabled and/or it is contractually assured that transmitted data is not used to train or improve AI models. Raw calendar data such as titles, descriptions or attendees of existing appointments are not transmitted.

Telewa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements.

Product analytics and session replay (PostHog):

In the Telewa app (app.telewa.de) we use PostHog (PostHog Inc.; data processing on EU servers) to collect usage statistics and to review operating sessions for product improvement. All input fields are masked in recordings, so that content such as messages or contact data of your customers is not captured; attribution only takes place for logged-in user accounts. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving and securing the application).

6. CRM, data sources & automation

Data sources:

(1) directly via our forms/landing pages, (2) lead import by partner businesses, (3) communication channels (WhatsApp/e-mail).

CRM/database: Supabase and — for individual landing-page processes — Vercel Blob / Notion (storage/processing of leads/customer data).

Automation: Make.com (lead ingestion, cross-channel responses).

Legal bases: Art. 6(1)(b) (pre-contractual/contractual), (f) (efficient sales/support processes), where applicable (a) (newsletter/tracking).

Retention period: leads/contacts until revoked or until the purpose is fulfilled. Contract/billing data in accordance with statutory periods (regularly up to 10 years).

7. Online marketing & reach measurement

These services are only activated after consent (TDDDG/Art. 6(1)(a) GDPR). Without consent, no storage/reading of non-essential identifiers on your device.

Meta Ads / Conversions API (Facebook/Instagram):

Purposes: campaign management, conversion measurement and remarketing. Once you have consented, we load the Meta Pixel, which sets cookies (including _fbp, _fbc) and reports page views and conversions to Meta. We additionally report the same conversions server-side via the Conversions API using pseudonymised or hashed information (e.g. your phone number as a hash value) and campaign parameters. Both reports carry the same event identifier so that Meta recognises them as a single event and does not count them twice. Without your consent the pixel is not loaded and no marketing cookies are set.

Legal basis: consent (Art. 6(1)(a) GDPR); withdrawal at any time.

Recipient: Meta Platforms Ireland Ltd. (EU) / Meta Platforms Inc. (USA); DPF/SCCs.

Google Ads (conversion tracking):

We use Google Ads conversion tracking provided by Google Ireland Limited to measure the performance and conversions of our ads and, where used, to build remarketing audiences. The Google tag is loaded exclusively after you consent. We use Consent Mode v2 in Basic Mode: before you consent, the tag is not loaded and no data is sent to Google.

For a demo request, we may use Enhanced Conversions. Your normalised e-mail address or phone number is hashed using SHA-256 before transmission and sent to Google with the conversion event. We also store and process campaign parameters and click IDs (in particular gclid, gbraid and wbraid) to attribute an enquiry to an ad.

Legal basis: your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via .

Recipient: Google Ireland Limited (EU) / Google LLC (USA). Transfers to the USA are based on the EU-US Data Privacy Framework, under which Google LLC is certified.

Note on profiling/remarketing: where used, this only takes place after consent; you can adjust/deactivate personalised advertising in the respective platform settings.

8. Payment processing (Stripe)

Purposes: processing of one-time payments, subscriptions, payment links; fraud prevention; invoicing.

Data: identity/contact and payment data (e.g. name, e-mail, billing address; payment token; mandate data); transaction/communication data; webhooks to our systems (e.g. payment success).

Roles: depending on the process, Stripe may act as a (joint) controller and/or processor (DPA available).

Legal basis: Art. 6(1)(b) GDPR (contract/performance), Art. 6(1)(c) (retention/tax), where applicable (f) (fraud prevention).

Retention period: in accordance with statutory retention periods (regularly up to 10 years).

9. Joint controllership with partner businesses (Art. 26 GDPR)

For jointly operated landing pages/campaigns, Telewa and the respective partner business are joint controllers for the collection of leads. Essential content of the arrangement:

  • joint purposes: lead capture/forwarding, campaign evaluation;
  • designation of the primary point of contact for data subject rights: [email protected];
  • information obligations are fulfilled jointly towards the data subjects;
  • technical/organisational measures are coordinated;
  • data protection responsibilities (in particular for responding to data subjects, deletion concepts) are coordinated.

We will provide the contact details of the respective partner business on request.

For pages/processes operated by Telewa alone, Telewa is the sole controller.

10. Recipients, processors & third-country transfers

Typical recipients/processors:

  • IONOS SE (DE/EU) – hosting/CDN
  • Vercel, Inc. (USA/EU) – hosting/edge delivery
  • Supabase, Inc. (USA/EU) – SaaS database, authentication and edge functions
  • Vercel Blob / Notion (US/EU, region-specific) – database/storage
  • Make.com (EU/Global) – automation/integrations
  • Tally.so (BE/EU) – forms
  • Google Ireland Ltd. (EU/US) – appointment booking (Google Calendar)
  • Meta / WhatsApp / Instagram (EU/US) – ads & communication
  • Google (EU/US) – ads/conversion
  • Hetzner Online GmbH (DE) – hosting of the voice-AI platform
  • PostHog Inc. (EU hosting) – audience measurement (website) and product analytics & session replay (Telewa app)
  • Twilio (USA) – telephony
  • Deepgram (USA, EU endpoint) – speech recognition (AI telephone assistant)
  • Cartesia (USA) – speech synthesis (AI telephone assistant)
  • OpenRouter / OpenAI (USA) – language models (AI assistants; zero data retention, no training)
  • Stripe (EU/US) – payments

Third-country transfers: where data is transferred to the USA or other third countries, this is done on the basis of:

  • the EU-US Data Privacy Framework (DPF), where the service is certified; and/or
  • Standard Contractual Clauses (SCCs), including where applicable a Transfer Impact Assessment (TIA) and supplementary measures. Details are provided by the respective provider in its privacy policy.

11. Retention periods & deletion

  • Server logs: until revoked (administrative routines).
  • Leads/communication: until revoked or until the purpose is fulfilled/the matter is concluded.
  • Customer/contract/payment data: regularly up to 10 years in accordance with statutory obligations.
  • Newsletter consents/records: until withdrawal + evidence periods.

We delete/anonymise data after the respective periods have expired or upon your withdrawal/deletion request, provided no obligations prevent this.

12. Data security

We use appropriate technical and organisational measures (TOMs) (TLS encryption, access controls/RBAC, 2FA, logging, backups, need-to-know). With processors we ensure data processing agreements and adequate safeguards (DPF/SCCs).

13. Rights of data subjects

You have the right to information (access), rectification, erasure, restriction, data portability, and to object to processing based on Art. 6(1)(e) or (f), and to object to direct marketing (including profiling for direct marketing). You can withdraw consent at any time (without affecting the lawfulness of processing carried out until then).

Contact: [email protected]

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is generally the one at the company's registered seat (Berlin).

15. Social media presences

We maintain company pages on Facebook, Instagram and LinkedIn. For page insights, etc., there may be joint controllership with the respective platform provider. The privacy notices of the platforms apply in addition. Legal basis: Art. 6(1)(f) (external presence/communication) or (a) (where you consent, e.g. to tracking).

16. Currency of this policy

We adapt this policy when the legal situation, services or processing activities change. The current version is published here (as of: July 2026).

Transparency notes & references (selection)

  • Renaming of TTDSG to TDDDG on 13 May 2024.
  • EU-US Data Privacy Framework (adequacy decision of 10 July 2023; most recently confirmed by the General Court, 3 September 2025).
  • Provider information: Vercel (DPF), Tally (EU, data storage in Europe), Make.com (SCC/DPF reference), Google (DPF, Calendar/Privacy), Vercel Blob / Notion (Privacy/regions), IONOS (data protection/security).