Opens in a new tab

Privacy Policy

Version: October 2026

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data-protection laws is:

Signwire Media
Owner: Volker Burhoff
Am Lindenkreuz 43
50259 Pulheim
Germany
Phone: +49 1512 0177214
E-mail: info@signwire-media.com

We have not appointed a data protection officer because we are not required to. The owner is responsible for data protection. Signwire Media is established in Germany; the GDPR therefore applies to all our processing, wherever you are located.

Overview: data processing on this website

This website deliberately uses no tracking, no advertising cookies and no embedded third-party services. Fonts are served from this website itself; simply visiting the site sends no data to Google, Meta or any other advertising or analytics provider. Only our hosting provider processes technical access data (see “Hosting and server log files”). There is no contact form on this site. We process personal data only when you actively give it to us, for example by e-mail, by phone or when booking a call.

Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you access the site, the hosting provider automatically collects information your browser transmits and stores it in server log files:

  • IP address
  • date and time of the request
  • page or file requested
  • browser type and version, operating system
  • referrer URL (the page you visited before)

This data is not combined with other data sources. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the technically correct, stable and secure delivery of this website (for example defending against attacks). Log files are stored by the hosting provider only briefly and deleted automatically unless a security incident requires longer retention. The transfer to the USA relies on the EU-US Data Privacy Framework, under which Vercel Inc. is certified.

Booking a call via Google Calendar

To arrange a first call we link to a booking page of Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The booking page is not embedded in our website; it opens in a new tab at Google only after you actively click the booking link. Simply visiting our website sends no data to Google.

When booking you enter your name and e-mail address, optionally a phone number and a note. Google processes this data to create the appointment and to send the confirmation and reminder; we receive it in our calendar. Google's processing is governed by Google's privacy policy at policies.google.com/privacy. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework.

Purpose: arranging and holding a first call and, where applicable, preparing a contract.
Legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract at your request) and Article 6(1)(f) GDPR (legitimate interest in simple scheduling).
Retention: the appointment stays in our calendar until the matter is closed or you ask us to delete it. Statutory retention periods remain unaffected.

Contact by e-mail or phone

If you contact us by e-mail or phone, we process your message and contact details to handle your request (Article 6(1)(b) and (f) GDPR). We keep your request until it has been fully dealt with and no follow-up questions are to be expected; statutory retention periods for business correspondence remain unaffected.

Cookies and local storage

This website sets no cookies and uses no comparable technologies (local storage, session storage, fingerprinting or similar), neither technically necessary ones nor any for analytics, tracking or advertising. No information is stored on or read from your device that would require consent (§ 25 TDDDG, the German implementation of the ePrivacy rules). A cookie banner is therefore not needed.

Business contacts and direct marketing

This section is the information under Articles 13 and 14 GDPR for people we contact for business purposes. If you have received a call, an e-mail or a direct message from us or from a sales representative working on our behalf, this is where you find out where your data comes from, what we do with it and how to stop it.

Why we contact you

Signwire Media is a sales outsourcing company based in Germany. We contact businesses, mainly coaches, consultants, software vendors and solar or trade companies, to offer our services. We contact you in your business capacity only.

What data we hold and where it comes from

We hold business contact data only: your company name and, where published, your name and role; the business phone number, e-mail address and website published for your company; your public Instagram or other social-media handle if you publish one for your business; your location (city, country) and the number of public reviews of your business; an internal note on whether your business appears to fit our service (for example whether your website shows a program price, a booking page or an open sales position); and the history of our contact with you (date, channel, outcome, notes taken by the representative).

We collected this data from publicly available sources: Google Maps listings, your company website (including its imprint or contact page) and your public social-media profile. We did not buy your data from a list broker, and we do not collect private data, financial data or special categories of data.

Purpose and legal basis

We process your business contact data to contact you once or a few times about our services, to note the outcome, and to make sure we do not contact you again if you ask us not to.

The legal basis is Article 6(1)(f) GDPR, our legitimate interest in direct marketing to businesses; recital 47 GDPR recognises direct marketing as a legitimate interest. We have weighed this interest against yours: we use only contact data you have published for business purposes, we contact you in a business capacity, we do not create profiles beyond the question whether your business fits our service, we limit the number of contact attempts, and you can stop the contact at any time with one sentence. A business owner who publishes contact details can reasonably expect occasional business-to-business contact through those channels.

Where you book a call or ask us for an offer, the legal basis is Article 6(1)(b) GDPR. Keeping a record of your objection is based on Article 6(1)(c) and (f) GDPR: we must be able to honour it.

Who receives your data

Sales representatives working for us as independent contractors make the calls and send the messages. They are located in South Africa, Canada, the United States, Ireland, the United Arab Emirates and Australia and are bound by written confidentiality and data-protection obligations towards us. They access your data through our sales platform.

Service providers (processors) run our systems: Supabase Inc. (database, hosted in Frankfurt, Germany), Vercel Inc. (hosting, USA), Twilio Inc. (telephony, USA), Resend Inc. (e-mail delivery, USA) and Google (Google Workspace e-mail and calendar, Ireland/USA). If call recording is switched on (see below), Deepgram Inc. (transcription, USA) and Anthropic PBC (summaries, USA) would also process the recording.

We do not sell your data and we do not share it with other companies for their own marketing.

Transfers outside the European Union

Our platform database is hosted in Frankfurt, Germany. Some providers and our representatives are located outside the EU. For providers in the USA we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. For representatives outside the EU we rely on the Standard Contractual Clauses combined with technical safeguards (access only through our platform, no local copies of full lists). You can ask us for a copy of the relevant clauses.

Call recording

Our platform can record calls, but recording is switched off by default. If we ever record a call with you, you will hear an announcement at the start of the call and can object before the conversation continues. Recordings are kept for no longer than 90 days.

How long we keep your data

  • If you do not respond or decline: we delete your record 6 months after our last contact attempt.
  • If we collected your data but never contacted you: we delete it 6 months after collection.
  • If you ask us not to contact you: we delete your record immediately and keep only your phone number and/or e-mail address on a do-not-contact list, permanently, so that we can honour your request.
  • If you become a client: contract and invoicing data is kept for 10 years under German commercial and tax law.

Your right to object

You can object at any time to the processing of your data for direct marketing (Article 21(2) GDPR). This right is absolute: if you object, we stop, and you do not have to give a reason. Tell the person who contacted you, reply to our e-mail, or write to info@signwire-media.com. Your further rights are listed under “Your rights as a data subject”.

Sales representatives and applicants

This section is the information under Article 13 GDPR for people who apply to work with us as independent sales representatives (setters and closers) and for representatives who work with us under an Independent Contractor and Commission Agreement. It covers your own data. The data of the business contacts you call is covered by the section “Business contacts and direct marketing” and by Annex 12 to your agreement. The owner, Volker Burhoff, is responsible; for all data questions write to info@signwire-media.com.

What data we process and why

  • Application data (name, e-mail, phone or WhatsApp number, country, profile or CV, interview notes): to decide whether to offer you an agreement. Article 6(1)(b) GDPR.
  • Contract data (legal name, postal address, country and state, signed agreement and annexes, business registration or self-declaration, tax identifiers you give us, proof of identity where we ask for it): to conclude and perform the agreement. Article 6(1)(b) and, where tax law requires the record, Article 6(1)(c) GDPR.
  • Payment data (bank details on your invoices, invoices, commission statements, payouts, clawbacks): to pay you and to keep the records German commercial and tax law requires. Article 6(1)(b) and (c) GDPR.
  • Platform account data in our sales platform (login e-mail, password stored only as a hash, two-factor setting, sessions, IP address, browser and device, security log): to give you secure access and to protect the data in the platform. Article 6(1)(b) and (f) GDPR, our legitimate interest in IT security.
  • Activity and performance data (calls with number, time, duration and outcome; e-mails, notes, tasks, meetings booked, deals closed; online status; role-play scores, course progress, leaderboard; reports page): to calculate commission, to coach the team and to prove that calls followed the calling rules. Article 6(1)(b), (c) and (f) GDPR.
  • Weekly report and communication (your Friday report, e-mails, messages in the team chat and on WhatsApp): to run the working relationship. Article 6(1)(b) and (f) GDPR.

Your voice passes through our telephony provider while you call; calls are not recorded. The platform can technically record calls and let an administrator listen in; both are switched off. If we ever switch either on, we will tell you in advance in text form and the person called will hear an announcement. No decision about your agreement or your commission is made solely by automated means (Article 22 GDPR). Contract and payment data are required to conclude the agreement; everything else you give voluntarily.

Recipients and transfers

Our processors: Supabase Inc. (platform database, hosted in Frankfurt, Germany), Vercel Inc. (hosting, USA), Twilio Inc. (telephony, USA), Resend Inc. (platform e-mails, USA), Google (Google Workspace, Ireland/USA) and Anthropic PBC (AI features of the platform such as role-play, USA, only if you use them). If you write to us on WhatsApp, WhatsApp Ireland Ltd. processes the message metadata as its own controller. When you work a client mandate, the client sees your name and the outcome of your calls and meetings with its leads. Our tax adviser, bank and the tax authorities receive what the law requires. For providers in the USA we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Standard Contractual Clauses. We do not sell your data.

How long we keep it

  • Applicants without an agreement: 6 months after we tell you our decision.
  • Contract, communication, activity and performance data: 3 years after the end of the agreement.
  • Invoices, commission statements and payment records: as long as German commercial and tax law requires (up to 10 years).
  • Platform account: deactivated and all sessions ended on the last day of the agreement.

Your rights

You have the rights listed under “Your rights as a data subject”, including the right to object to processing based on our legitimate interest, and the right to lodge a complaint with a supervisory authority, for example the LDI NRW named under “Right to lodge a complaint”. A short e-mail to info@signwire-media.com is enough.

Payments by clients

Clients can pay Signwire's fees through a payment link. The payment page is operated by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes the name, company, billing address, e-mail address and card details entered there; Signwire does not receive full card numbers. Signwire stores the order, the amount, the payment status and the invoice for performing the contract (Art. 6(1)(b) GDPR) and keeps invoices for the statutory retention periods under German commercial and tax law (Art. 6(1)(c) GDPR). Stripe acts as an independent controller for fraud prevention and its legal obligations and may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Details: stripe.com/privacy.

Disclosure to third parties, transfers outside the EU

We do not sell or rent your personal data. We disclose it only where necessary to perform a contract (for example to our hosting provider as a processor under Article 28 GDPR), where you have consented, or where we are legally obliged to. Where processors are located in the USA, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

TLS encryption

For security and to protect the transmission of confidential content, this website uses TLS encryption. You recognise an encrypted connection by “https://” and the lock symbol in your browser's address bar.

Your rights as a data subject

Under the GDPR you have the following rights:

  • Access to the data we process about you (Article 15 GDPR)
  • Rectification of inaccurate data (Article 16 GDPR)
  • Erasure of your data (Article 17 GDPR)
  • Restriction of processing (Article 18 GDPR)
  • Data portability (Article 20 GDPR)
  • Objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR); for direct marketing the objection is absolute
  • Withdrawal of consent with effect for the future (Article 7(3) GDPR)

An informal e-mail to info@signwire-media.com is enough. We answer within one month.

Right to lodge a complaint

Under Article 77 GDPR you have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

Data security

We take technical and organisational measures under Article 32 GDPR to protect your data against loss, manipulation and unauthorised access, including encrypted transmission, restrictive security headers (Content Security Policy), personal accounts with limited access for our representatives, and regular updates of the software we use.

Information for the USA and Canada

California. Our processing is governed by the GDPR because we are established in Germany. We do not currently meet the thresholds that would make the California Consumer Privacy Act (CCPA/CPRA) apply to us. Whether or not it applies, we honour requests from California residents to know what data we hold, to delete it and to stop contacting them, under the conditions described above. We do not sell or share personal information within the meaning of the CCPA.

Canada. We contact Canadian businesses through published business contact information. Under Canada's anti-spam legislation (CASL) every commercial e-mail we send names us, includes our postal address and offers a working unsubscribe. If you unsubscribe, we stop within 10 business days at the latest, usually immediately.

Changes to this policy

We may update this privacy policy so that it always reflects the current legal requirements or changes to our services. The version published here at the time of your visit applies.