Privacy

How we handle your data

This page lists everything we do with personal data on this site — the landing pages, the quiz, the workshop, the booking page and the mails we send — why we do it, who else sees it, and for how long. It is generated from the same register we keep for ourselves, so the two cannot disagree.

Last updated: 2026-11-03

Who is responsible

The controller for everything on this page is the company below. Write to us at the address or email for any question about your data.

Company: konek.to GbR
Partners: Nicolas Traeder, Haithem Bel Haj & Steffen Dietz
Address: Corinthstr. 63, 10245 Berlin, Germany
Contact: we@konek.to
Legal notice: Imprint

What we process, and why

One section per thing we do. Each says what we process, on what legal basis, who receives it, whether it leaves the EU, and how long we keep it.

Measuring which of our ads work (Meta)

If you allow it, we tell Meta which of its ads brought you and what you did next, so we can see which ads are worth paying for. Only our server talks to Meta's server (Meta's Conversions API): on none of our pages does anything from Meta load in your browser, and no Meta cookie (such as _fbp or _fbc) is set. In the workshop, our server tells Meta that you started one, with your email address in hashed form, the ad click id from the link you arrived on if there is one, and the address of the page you arrived on; a call you book from it is reported as on the booking page, below. On the AI readiness quiz (/ai-readiness and the quiz itself), our server tells Meta that you completed the quiz (event “CompleteRegistration”) and, if you ask for the report or book a call, that you did (event “Lead”, with your email address in hashed form), each with the ad click id from the link you arrived on, your IP address and browser type, so Meta can match it to its ad. Your quiz answers, your score and the offer we suggest are never sent to Meta. On the booking page (/book/…), however you got there, our server tells Meta that you booked a call (events “Lead” and “Schedule”, or only “Schedule” if you came from a workshop or from the scorecard we emailed you), with your email address in hashed form, the ad click id from the link you arrived on if there is one, the page address, your IP address and browser type. Your name, your company and your note are never sent. Nothing is sent to Meta before you choose, and nothing is sent if you say no.

Legal basis: Your consent. Art. 6(1)(a) GDPR, and § 25(1) TDDDG for anything stored on or read from your device. Nothing happens under this heading until you say yes, and you can withdraw at any time with effect for the future.
Who receives it: Meta Platforms Ireland Ltd
Transfer outside the EU/EEA: Controller established in the EU (Ireland); onward transfer to Meta Platforms Inc. under the EU-US Data Privacy Framework.
How long: No Meta cookie on your device. The events we send: up to 3 months
What you are asked: “Let us tell Meta when one of its ads led you here. We send Meta the steps you take with us: that you started a workshop or asked for your film, that you watched the film to its end, and, if you book a call, that you booked one, so we can see which ads are worth running. Telling Meta whether you later become a customer is a separate choice. Recipient: Meta Platforms Ireland Ltd. Stored for up to 3 months. You can change your mind at any time.”

Change or withdraw this choice at any time under "Privacy choices" at the foot of every page and in the workshop header.

Reaching businesses like yours (Meta)

If you allow it and then start a workshop, ask for the AI readiness quiz report or book a call, we give Meta your email address, hashed (nothing else), for one audience list. We use that list to show our ads to businesses similar to yours, and to stop showing them to people who are already on it (for example, people who have already filled in the quiz). Your quiz answers and score are never shared. Withdrawing removes you from that audience again.

Legal basis: Your consent. Art. 6(1)(a) GDPR, and § 25(1) TDDDG for anything stored on or read from your device. Nothing happens under this heading until you say yes, and you can withdraw at any time with effect for the future.
Who receives it: Meta Platforms Ireland Ltd
Transfer outside the EU/EEA: Controller established in the EU (Ireland); onward transfer to Meta Platforms Inc. under the EU-US Data Privacy Framework.
How long: Until consent is withdrawn, or 12 months, whichever is sooner
What you are asked: “Help us reach businesses like yours. We share your contact details with Meta so we can show this workshop to similar people. Recipient: Meta Platforms Ireland Ltd. Kept until you withdraw, and no longer than 12 months. Withdrawing also removes you from the audience.”

Change or withdraw this choice at any time under "Privacy choices" at the foot of every page and in the workshop header.

Telling Meta when someone becomes a customer

A separate choice. If you allow it and later hire us, our server tells Meta that the person who came from its ad became a customer, and what they paid, so our ads reach businesses that buy rather than just businesses that click.

Legal basis: Your consent. Art. 6(1)(a) GDPR, and § 25(1) TDDDG for anything stored on or read from your device. Nothing happens under this heading until you say yes, and you can withdraw at any time with effect for the future.
Who receives it: Meta Platforms Ireland Ltd
Transfer outside the EU/EEA: Controller established in the EU (Ireland); onward transfer to Meta Platforms Inc. under the EU-US Data Privacy Framework.
How long: Until consent is withdrawn, or 12 months, whichever is sooner
What you are asked: “Let us tell Meta if you become a customer. If you later hire us, we tell Meta that the person who came from its ad became a customer, and what you paid, so our ads reach businesses like yours rather than just people who click. This is separate from the choices above. Recipient: Meta Platforms Ireland Ltd. Kept until you withdraw, and no longer than 12 months. You can change your mind at any time.”

Change or withdraw this choice at any time under "Privacy choices" at the foot of every page and in the workshop header.

Running the workshop and sending what you asked for

For the AI readiness quiz: the report you ask for, with your email address and your answers. For the workshop: the company email address you give us on the landing page, the code we send to it, the workshop board it opens and everything you and the workshop write on that board, the one-page summary if you ask us to email it, and the share link if you create one. If you book a call, the booking and the mails that arrange it. If you become a customer, access to the board you worked on together. Without the email address there is no workshop: the code is how we check the address is yours, and your website is read off its domain.

Legal basis: The service you asked for. Art. 6(1)(b) GDPR: we need this to provide what you requested, or to take the steps you asked for before a contract.
Who receives it: Fastmail Pty Ltd (transactional email delivery via SMTP)
Transfer outside the EU/EEA: Fastmail Pty Ltd is Australian with servers in the United States; transfer under Standard Contractual Clauses per their DPA.
How long: Not yet finally fixed; our working figure is 2 years. Until it is fixed, we delete on request — see "Your rights".

Generating your workshop (Anthropic)

The workshop is written by a large language model run by Anthropic PBC on our behalf. To do that we send it your company's domain, the text of up to five public pages of your website, your own corrections, votes and answers on the board, and what the board has already written. Anthropic processes this as our processor under a data processing agreement. Your website may name other people (founders, staff); for them we rely on our legitimate interest in describing your firm from what it published about itself, we do not use their names for anything else, and we do not contact them.

Legal basis: The service you asked for. Art. 6(1)(b) GDPR: we need this to provide what you requested, or to take the steps you asked for before a contract.For other people named in what we process. Art. 6(1)(f) GDPR: our legitimate interest, and yours, in describing your firm from what it published about itself. You, or anyone named, can object (see "Your rights").
Who receives it: Anthropic PBC (model inference API)
Transfer outside the EU/EEA: United States; Anthropic PBC Data Processing Addendum with Standard Contractual Clauses
How long: Not yet finally fixed; our working figure is 6 months. Until it is fixed, we delete on request — see "Your rights".

You can object to this at any time; see "Your rights" below.

Inviting your colleagues

If you are a customer and invite a colleague to your board, we send them the invitation. We keep their address until they accept, or for 14 days.

Legal basis: The service you asked for. Art. 6(1)(b) GDPR: we need this to provide what you requested, or to take the steps you asked for before a contract.
Who receives it: Fastmail Pty Ltd (transactional email delivery via SMTP)
Transfer outside the EU/EEA: Fastmail Pty Ltd is Australian with servers in the United States; transfer under Standard Contractual Clauses per their DPA.
How long: Until accepted or 14 days, whichever comes first

Protecting the booking page from abuse

Each time someone submits the booking form we store a shortened IP address (the last part removed, so it cannot single out a household) and whether the booking went through, to stop automated fake bookings. No name, no email. Deleted after 30 days.

Legal basis: Our legitimate interest. Art. 6(1)(f) GDPR. You can object at any time (see "Your rights"), and we will send you the balancing test we wrote for it on request.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: 30 days

You can object to this at any time; see "Your rights" below.

Protecting the workshop sign-up from abuse

When you ask for a workshop we store a shortened IP address (the last part removed) next to your request, so we can stop someone flooding other people's inboxes with codes or starting workshops in bulk. It is used for nothing else and blanked after 30 days.

Legal basis: Our legitimate interest. Art. 6(1)(f) GDPR. You can object at any time (see "Your rights"), and we will send you the balancing test we wrote for it on request.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: 30 days

You can object to this at any time; see "Your rights" below.

Checking the address is yours

When you ask for a workshop we email a six-digit code to the address you typed. Until you type it back we hold the address, the website we read off it and the campaign you arrived from. If you never do, we erase all of it seven days after the code ran out.

Legal basis: The service you asked for. Art. 6(1)(b) GDPR: we need this to provide what you requested, or to take the steps you asked for before a contract.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: 7 days after the code expires

Counting how far visitors get

We count how many visits reach each step of the landing page, the quiz, the workshop and the booking page, per ad campaign. The count uses a random number that lives only in the open browser tab and disappears when you close it; no cookie, no IP address, and nothing that links the count to you. Deleted after 90 days.

Legal basis: Our legitimate interest. Art. 6(1)(f) GDPR. You can object at any time (see "Your rights"), and we will send you the balancing test we wrote for it on request.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: 90 days

You can object to this at any time; see "Your rights" below.

Notes from a sales call

If you book a call, the person you speak to may keep short notes so the conversation can continue where it left off. Only our staff can read them, and every read is logged.

Legal basis: Our legitimate interest. Art. 6(1)(f) GDPR. You can object at any time (see "Your rights"), and we will send you the balancing test we wrote for it on request.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: Not yet finally fixed; our working figure is 6 months. Until it is fixed, we delete on request — see "Your rights".

You can object to this at any time; see "Your rights" below.

Transcribing our video calls

When you join a video call on your workshop board we ask whether we may transcribe what you say. Only if you say yes is your speech turned into text, by a speech-recognition model that runs on our own servers, and you can change your answer at any time during the call. Each person is transcribed separately. No recording of the audio is kept and nothing is sent to anyone else; we keep the text, who said it and when, and only our staff can read it. We also keep a record of your answer and the wording you were shown.

Legal basis: Your consent. Art. 6(1)(a) GDPR, and § 25(1) TDDDG for anything stored on or read from your device. Nothing happens under this heading until you say yes, and you can withdraw at any time with effect for the future.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: Not yet finally fixed; our working figure is 3 months. Until it is fixed, we delete on request — see "Your rights".
What you are asked: “May we transcribe what you say in this call? Your speech is turned into text on our own servers so we can read the conversation back. No audio is recorded, and only our team can read the text. You can change your answer at any time during the call.”

Change or withdraw this choice at any time under "Privacy choices" at the foot of every page and in the workshop header.

Who read the call notes

A log of which member of our staff opened, wrote or deleted a call note, and when. It never contains the note itself. It exists so we can tell you who has seen your notes.

Legal basis: Our legitimate interest. Art. 6(1)(f) GDPR. You can object at any time (see "Your rights"), and we will send you the balancing test we wrote for it on request.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: Not yet finally fixed; our working figure is 4 years. Until it is fixed, we delete on request — see "Your rights".

You can object to this at any time; see "Your rights" below.

Our record of what we sent

A log of each mail or event we tried to send (a mail through Fastmail, an event to Meta only with your consent), under which purpose, and whether it went out or was blocked. The content is erased from this log once the send is finished; what stays is the decision and its reason.

Legal basis: Our legitimate interest. Art. 6(1)(f) GDPR. You can object at any time (see "Your rights"), and we will send you the balancing test we wrote for it on request.
Who receives it: None — the row itself is not disclosed. The effects it describes name their own recipients (Meta Platforms Ireland Ltd, Fastmail Pty Ltd).
Transfer outside the EU/EEA: No transfer outside the EEA
How long: Not yet finally fixed; our working figure is 12 months. Until it is fixed, we delete on request — see "Your rights".

You can object to this at any time; see "Your rights" below.

Handling your privacy requests

When you ask us for a copy of your data or to delete it, we keep a record that you asked and what we did, so we can show that we answered.

Legal basis: A legal obligation. Art. 6(1)(c) GDPR: we are required to keep this, and to be able to show it.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: 3 years

Proof of your privacy choices

When you make a choice in the privacy panel, we store the choice, the exact wording you were shown, the time, a shortened IP address and your browser type, so we can prove what you agreed to or refused. This is kept for four years: one year while the choice is valid, plus the three-year period in which a claim about it can be brought.

Legal basis: Our legitimate interest. Art. 6(1)(f) GDPR. You can object at any time (see "Your rights"), and we will send you the balancing test we wrote for it on request.
Who receives it: None — not disclosed to any third party
Transfer outside the EU/EEA: No transfer outside the EEA
How long: 4 years

You can object to this at any time; see "Your rights" below.

What we store on your device

Only what the thing you asked for needs, plus Meta’s cookies if — and only if — you allow them.

consent_v1 (cookie): Your privacy choices, so we do not ask again and so our server knows what you chose before the page loads. Strictly necessary; no consent needed. (12 months after you accept anything, 6 months after you refuse everything)
funnel_session (session storage): A random number and the campaign you arrived from, used only to count how far visits get. It cannot recognise you on a later visit. (Until you close the tab)
quiz_state (session storage, quiz pages only): On the quiz: your answers and how far you got, the ad click id the page was opened with and when it was first seen, the campaign you arrived from, and a random id for the finished quiz (so that, if you allowed ad measurement, our server tells Meta about one finished quiz once, not once per reload). Strictly necessary for the quiz. Your answers are never sent to Meta. (Until you close the tab)
Workshop board (browser database): The workshop keeps your board and a random identity for it in your browser, so the board works and syncs. Only on the workshop itself, never on the landing pages. Strictly necessary for the service you asked for. (Until you clear your browser’s site data)
Workshop questions (local storage): Whether you already answered a question the workshop asked you (for example about the playbooks mail), so it is not asked twice. (Until you clear your browser’s site data)
No Meta cookies (_fbp, _fbc): We do not load Meta’s pixel or any other Meta code on any of our pages, so Meta sets no cookie through our site, whatever you choose. What we tell Meta goes from our server to Meta’s, and only if you allow “Measuring which of our ads work”. (Nothing stored)

Your rights

You can ask us at any time for a copy of the data we hold about you (Art. 15 GDPR), to correct it (Art. 16), to delete it (Art. 17), to restrict how we use it (Art. 18), to receive it in a portable format (Art. 20), and you can object to any processing based on our legitimate interest (Art. 21) — for direct marketing, always and without giving a reason.

For a copy or for deletion, enter your address below: we email a confirmation link to it, and nothing happens until you click it. For anything else, email us at we@konek.to.

Withdrawing consent

Where we rely on your consent, you can withdraw it as easily as you gave it: "Privacy choices" at the foot of every page, and in the header of the workshop, reopens the same panel with your current choices. Withdrawing stops the processing from that moment; it does not make what happened before unlawful (Art. 7(3) GDPR). When you withdraw from the Meta audience, we also ask Meta to remove you from it.

Complaining to a supervisory authority

You have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work or where you think the infringement happened. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
https://www.datenschutz-berlin.de

Also worth knowing

You do not have to give us any data. Without a company email address we cannot run a workshop for you — the code we send to it is how we check the address is yours, and we read your website off its domain — and without a name and an email address we cannot book a call. Nothing else depends on anything.

We make no decisions about you by automated means that have legal or similarly significant effects (Art. 22 GDPR). The workshop is written by a language model, but what it writes is a suggestion for you to read, not a decision about you.