Contact

Privacy policy

This English version is provided for convenience. The German version is legally binding.

1. Controller

The controller for data processing on this website is: Tim Leonsteyn, Panthera Metamorphic Advisory, Schedelstr. 2, 80687 Munich, Germany. Email: t.leonsteyn@panthera-metamorphic.de, phone: +49 151 28747317.

No data protection officer has been appointed, as the requirements of Art. 37 GDPR / § 38 BDSG are not met. Please send any data protection requests to the contact details above.

2. Overview

This website presents Panthera Metamorphic and its services. We process personal data in three cases only: when you visit the site (technically necessary access data), for audience measurement without cookies, and when you write to us via the contact form, by email or by phone. This website sets no cookies, embeds no advertising tags and sells no data.

3. Individual processing activities

a) Hosting and server logs

This website is hosted by Vercel Inc. (USA). When you visit it, the host automatically processes technically necessary access data (IP address, date and time, page requested, browser identifier) in server logs. The purpose is delivery, stability and security of the website; the legal basis is Art. 6 (1) (f) GDPR. The logs are not combined with other data and are deleted after a short time. All transmission is encrypted (TLS).

b) Contact form, email and phone

Data processed: name, email address, optionally your company, and your message. Purpose: answering your enquiry and, where applicable, preparing an engagement. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (answering general enquiries). The form sends your details to our mailbox via the email service Resend, Inc. (USA) acting as our processor, and sends you a confirmation of receipt at the address you provide. The website itself does not store your enquiry in a database. If you email or call us directly, we process your details for the same purposes.

c) Audience measurement

We use PostHog (EU cloud, hosted in the EU) for audience measurement, without cookies, without storing anything on your device and without cross-device profiles. We record page views, clicks and scroll depth (heatmaps), technical errors and recordings of how the page is used, in which all form inputs are masked and never transmitted in plain text. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in improving our services).

d) Fonts, images and external links

Fonts and images are served from our own web server; visiting the site does not connect you to Google Fonts or similar services. Links to LinkedIn and to our product pages at ki.panthera-metamorphic.de only transmit data to the respective provider once you click them. The product pages have their own privacy policy.

4. Recipients / processors

We use carefully selected service providers who process personal data solely on our instructions (Art. 28 GDPR):

  • Vercel Inc. (USA) – website hosting
  • Resend, Inc. (USA) – sending contact form emails
  • PostHog (EU cloud) – audience measurement

5. Transfers to third countries

Vercel and Resend are based in the USA. Where personal data is transferred to the USA, this is based on the standard contractual clauses provided by the European Commission (Art. 46 (2) (c) GDPR) and, where applicable, certification under the EU-US Data Privacy Framework. PostHog processes data within the EU.

6. Retention

Server logs are deleted automatically after a short time. We keep enquiries for as long as needed to handle them; if no engagement results, we delete them no later than twelve months after the last contact. Statutory retention obligations (e.g. for business correspondence under § 257 HGB and § 147 AO) remain unaffected.

7. Obligation to provide data

Providing your data is voluntary. Without a name, email address and message, however, we cannot answer an enquiry sent via the form.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, simply contact us at the details given in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Version

This privacy policy was last updated in September 2026. We update it whenever the website or the services we use change.