Legal and privacy
Legal notice, privacy posture, and customer-document status for private beta.
Imprint
Michael Glück | Hörzing 23 | 83374 Traunwalchen | Germany | Contact: michi@geist.company
Privacy
The operator named in the imprint is responsible for personal data processed through this website and email contact. This notice covers the public marketing website; customer product processing is addressed separately during onboarding. Contact the privacy address below with questions. Updated: 26 October 2026.
Website delivery and security
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, hosts this website through Workers Static Assets and processes connection data such as IP address, requested URL, time, browser information and security events to deliver and protect it. Our legal basis is Article 6(1)(f) GDPR: reliable delivery and protection against abuse. Cloudflare acts as a processor for this service under its data processing addendum. Its global network can process data outside the EEA, including in the USA; its addendum sets out the applicable transfer safeguards, including EU standard contractual clauses. We do not promise EU-only website processing.
Email enquiries
When you email us, we process your address, message and any information you choose to provide to answer your enquiry. Business email uses Microsoft 365 / Exchange Online, provided in the EEA by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes mailbox data under its data protection addendum, which describes subprocessors and safeguards for international transfers. Article 6(1)(b) GDPR applies to steps toward a contract with you; otherwise Article 6(1)(f) applies to our interest in answering business enquiries. Providing information is voluntary, but we need a reply address to respond. Please do not send sensitive information that is unnecessary for your enquiry.
Scorecard, browser storage and usage counts
We do not enable advertising trackers or visitor profiling on this website. For the interactive fit scorecard we count anonymous usage events, such as a step reached or a PDF exported, as daily totals per language. These counts use no cookies and no identifiers, and we store no IP address or user agent with them. The scorecard saves your entries in your browser's local storage so you can continue your evaluation; your evidence notes never leave your browser. Before the first PDF or CSV export, the scorecard asks for your work email. We store that email, the optional company name and a summary of the scorecard (process, suppliers, scores and open items, without notes) as a lead so we can follow up with you; the legal basis is Article 6(1)(f) GDPR, our interest in answering business interest in Geist. Fonts and demonstration assets are served with the site. Use the scorecard's reset control or clear this site's browser data to remove local entries. Cloudflare may process technical security information when protecting the site. There is no customer login on this marketing website.
Retention
We retain correspondence while handling the enquiry and any resulting business relationship. Afterwards, retention is limited to applicable statutory obligations or the establishment, exercise or defence of legal claims; data no longer needed for those purposes is deleted. Technical service data follows the providers' documented security and operational retention criteria. Scorecard leads follow the same rule as correspondence. Usage counts are aggregate daily totals without personal data; we do not maintain a visitor-level analytics database. Locally saved scorecard entries remain on your device until you reset them or clear site data.
Your rights
Subject to the GDPR's conditions, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing relies on consent, you may withdraw it for the future. Contact the privacy address below. You may complain to a supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA). We do not use website or enquiry data for automated decisions with legal or similarly significant effects.
Company research privacy notice
For customer-directed company and transaction research, Geist processes public information from official registers, published regulatory and enforcement decisions, published tax facts, officially published proceedings concerning legal entities, and attributable press reporting. The customer organization determines the case purpose and legal basis and records that decision for each restricted research domain; Geist acts as processor for that customer-directed case content. Restricted material is case-scoped, access-controlled, and not published as a target list. Raw source artifacts use short source- and domain-specific retention windows. Case records and findings from campaigns used only by that case are retired 90 days after the confidential case closes; records shared with another active case remain governed by that case. People may contact the privacy address below to exercise applicable access, correction, objection, or erasure rights. A response never confirms whether an unauthorized confidential case exists.
Terms
Private beta access is invitation-based. Commercial terms, service descriptions, and production commitments are agreed before customer rollout.
Security
Security posture and the compliance roadmap are published on the Security & Trust page. Sensitive architecture details are shared during qualified procurement reviews.
DPA
A data processing agreement is prepared as part of customer onboarding when Geist processes personal data on a customer's behalf.
Legal and privacy contact: privacy@geist.company
Security disclosure: security@geist.company
Cloudflare DPA · Cloudflare Privacy · Microsoft DPA · BayLDA