Data Policy and GDPR

Privacy Policy — blocksize.info

Effective date: 30 October 2026

1. Controller

Blocksize Capital GmbH, Bockenheimer Landstr. 17-19, 60325 Frankfurt am Main, Germany Commercial Register: HRB 113470 (Amtsgericht Frankfurt am Main) Managing Director: Christian Labetzsch

Contact:

• Website: https://blocksize.info/contact/
• Phone: +49 (0)69 870 0990 80
• Mail: Blocksize Capital GmbH, Bockenheimer Landstr. 17-19, 60325 Frankfurt am Main, Germany

2. Data Protection Officer

You can reach our Data Protection Officer at: dataprivacy@blocksize-capital.com

3. Scope

This policy applies to the website blocksize.info. Processing within our data platform (matrix.blocksize.capital) is covered by the separate privacy policy available there.

4. Hosting and server logs

Our website is hosted by Netlify (Netlify, Inc., USA), whose infrastructure runs on Amazon Web Services. When you visit the site, technical data (IP address, date and time of access, requested page, browser type, operating system, referrer URL) is processed in server logs to deliver the website, ensure stability, and detect abuse.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in the secure and functional provision of the website. Retention: server logs are deleted after 30 days.

Content management is provided via Directus Cloud (Directus GmbH, Germany). Any processing on infrastructure outside the EU is covered by the transfer safeguards in Section 11.

5. Cookies and consent

Technically necessary cookies are used without consent (Section 25(2) TDDDG). All other cookies and marketing technologies, and all analytics except the cookieless counting described in Section 9, are only used with your prior consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), given via our cookie banner. Your consent choice is stored for 12 months, after which you will be asked again. You can withdraw or change your consent at any time via the cookie settings; withdrawal does not affect processing carried out before it.

6. Analytics

Google Analytics / Google Tag Manager (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). We measure how the website is used (pages visited, session duration, approximate location, device information). IP addresses are anonymized. Google Tag Manager is used to deploy analytics and marketing tags and does not itself store personal data beyond what is technically required.

Legal basis: consent (Art. 6(1)(a) GDPR). Privacy: https://policies.google.com/privacy

7. Marketing and advertising technologies

With your consent (Art. 6(1)(a) GDPR), we use the following technologies to measure the performance of our advertising and to optimize ad delivery. They set cookies or similar identifiers and process data such as IP address, device information, pages visited, and, where a sign-up occurs, a hashed email address for conversion matching.

• LinkedIn Insight Tag — LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy: https://www.linkedin.com/legal/privacy-policy
• Reddit Pixel — Reddit, Inc., San Francisco, CA, USA. Privacy: https://www.reddit.com/policies/privacy-policy
• X Pixel — X Internet Unlimited Company, Dublin, Ireland (EU users). Privacy: https://x.com/privacy

We may add further advertising platforms of the same type (e.g. Telegram Ads) in future; any such technology will likewise only be used with your consent and will be reflected here.

Attribution cookies: we set first-party cookies (bs_channel, bs_campaign; 90 days) to record which marketing channel and campaign brought you to our site, so sign-ups can be attributed to the correct source. Legal basis: consent (Art. 6(1)(a) GDPR).

8. Forms, newsletter, CRM and automation

HubSpot (HubSpot, Inc., Cambridge, MA, USA; European office Dublin, Ireland). We use HubSpot for contact and inquiry forms, newsletter, and customer relationship management. When you submit a form or subscribe, the data you provide (e.g. name, email, company) is stored in HubSpot together with the marketing source of your visit. Newsletter emails may contain measurement pixels recording opens and clicks.

Zapier (Zapier, Inc., USA). We use Zapier to synchronize data from HubSpot and to trigger automated emails, which are sent via our own mailbox. Zapier acts as a processor on our behalf.

Legal basis: consent (Art. 6(1)(a) GDPR) for newsletter and marketing email; performance of pre-contractual measures (Art. 6(1)(b) GDPR) for inquiries. You can unsubscribe at any time via the link in each email. Privacy: https://legal.hubspot.com/privacy-policy · https://zapier.com/privacy

9. Web analytics

Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). We use Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization and fraud/security purposes. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

Legal basis: consent (Art. 6(1)(a) GDPR). Microsoft Clarity is only loaded after you consent via our cookie banner.

PostHog (PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA). We use PostHog, with data hosted in the EU, to understand how our website is used. Without your consent, we count page views, clicks on trial links and successful form submissions without setting cookies or storing anything on your device. To recognise visits, PostHog forms a temporary pseudonymous value from your IP address and browser information on its servers. This value changes daily. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

If you click Accept, PostHog also sets cookies and records clicks, time on page, heatmaps and session recordings, with all form inputs masked. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via “Cookie settings” in the footer.

Privacy: https://posthog.com/privacy

10. External profiles

Our website links to our own profiles on GitHub, LinkedIn, and X. These are plain links; visiting them takes you to the respective platform, where that platform's privacy policy applies. We do not embed data-transmitting social plugins.

11. Data transfers to third countries

Some providers named above (e.g. Netlify, Google, Microsoft, LinkedIn, Reddit, X, HubSpot, Zapier, PostHog) process personal data in the United States. Transfers are based on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

12. Retention

We store personal data only as long as necessary for the stated purposes or as required by statutory retention obligations (commercial and tax law: 6–10 years for accounting and business records). Consent-based data is deleted upon withdrawal of consent unless another legal basis applies.

13. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to legitimate-interest processing (Art. 21), and withdrawal of consent with effect for the future (Art. 7(3) GDPR). To exercise these rights, contact our Data Protection Officer at dataprivacy@blocksize-capital.com.

You may also lodge a complaint with a supervisory authority, in particular the one competent for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

14. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

15. Changes

We update this policy when our processing activities change. The current version is always available on this page.