Written in plain language. The legally binding German version sits behind a link at the bottom. If you only have two minutes, read the summary below — it covers 95% of what you came for.
The controller for personal data processed via this website (per Art. 4 (7) GDPR) is:
Remote Native GmbH · Joergstr. 29, 80689 München, Germany · privacy@remote-native.com. Full company details on the Imprint page.
Where required under Art. 37 GDPR, our Data Protection Officer can be reached at:
Frank Beinhold, Datenschutz Beinhold · Maximiliankorso 9, 13465 Berlin · ds@datenschutz-beinhold.de. You can also write to dpo@remote-native.com; please put "DPO" in the subject line.
We try hard to collect as little as possible. Concretely:
Server logs at our EU host (Hetzner, Frankfurt) capture IP address (truncated to /24 within 24 hours), timestamp, requested URL, response code, referrer, and user-agent. These logs exist for security and abuse prevention. Retention: 14 days, then irreversible deletion.
The 12-question diagnostic runs entirely in your browser. Answers are kept in localStorage while you're on the page. Nothing leaves your device until you press "Send me my result", at which point we collect: email, first name, your 12 answers, and a derived score across 6 dimensions.
A two-field form: email + first name. The PDF is sent by email. No tracking pixel in the PDF. We do not silently re-send.
Ren answers questions on this site and can take a request (for example a fit call or the ebook). What you type is sent to our backend and stored with a session ID so the conversation survives a page reload. Replies are generated by Anthropic (Claude); your messages and the conversation context are sent to Anthropic for that. If you record a voice note, the audio is transcribed by OpenAI (Whisper). If you ask Ren to call you, your phone number is passed to Vapi to place the call. Anything you choose to tell Ren in the conversation, such as how you heard of us, your role or the size of your company, is stored with your request. Please do not share sensitive data in the chat.
When you make a request through Ren, we also store how you reached our website: the referring site (domain name only), the first page you opened, campaign labels from the link (UTM parameters) and the time of your first visit. We use this to understand which content leads to enquiries and keep it with your request in our customer system. It can be linked to your request and is deleted with it. Legal basis: Art. 6(1)(f) GDPR (measuring the success of our website). We record this only if you have agreed to analytics.
Sessions in which nobody wrote anything are deleted after 30 days. Conversations are kept while needed to handle your request and deleted on request. Legal basis: Art. 6 (1) b GDPR where you ask for something we offer, otherwise Art. 6 (1) f (answering enquiries on our website).
To find and fix technical errors we use Sentry (Functional Software, Inc.). When an error occurs, technical data about it (error message, affected code, browser and system type, time) is sent to Sentry. Sentry is configured not to send personal data (no IP address, cookies or form content). Legal basis: Art. 6 (1) f GDPR (a working, secure website).
Whatever you put in the email. We answer from a human inbox (Fastmail, EU). Retained per § 257 HGB / § 147 AO when commercially relevant; otherwise deleted after 12 months.
Each type of processing has a named purpose, a legal basis under GDPR Art. 6 (1), and a retention period. The register below is the operative version — if you want it as a PDF, email dpo@remote-native.com.
| Activity | Purpose | Legal basis | Retention |
|---|---|---|---|
| Server logs | Security, abuse prevention, debugging | Art. 6 (1) f Legitimate interest | 14 days |
| Diagnostic submission | Send personal result & benchmark | Art. 6 (1) b Pre-contractual measure | 24 months, then anonymized |
| Ebook delivery | Deliver PDF & (opt-in) follow-up | Art. 6 (1) a Consent | Until withdrawn |
| Sales correspondence | Reply, scope, contract | Art. 6 (1) b Contract / pre-contractual | 6 yrs (§ 257 HGB) |
| Ren concierge chat | Answer questions, take requests | Art. 6 (1) b / f Pre-contractual / legitimate interest | Idle sessions 30 days; conversations until no longer needed or on request |
| Error monitoring (Sentry) | Find and fix technical errors | Art. 6 (1) f Legitimate interest | Limited retention at Sentry |
| Invoicing | Tax & commercial obligation | Art. 6 (1) c Legal obligation | 10 yrs (§ 147 AO) |
| Analytics (opt-in) | Anonymous reach & usage measurement (GA4, Microsoft Clarity, Leadfeeder, Snitcher) | Art. 6 (1) a Consent · § 25 (1) TDDDG | Until withdrawn / cookie lifetime |
| Marketing (opt-in) | Ad measurement & remarketing (Google Ads) | Art. 6 (1) a Consent · § 25 (1) TDDDG | Until withdrawn / cookie lifetime |
We do not sell, rent, or trade personal data. Analytics and advertising/remarketing run only with your explicit consent (see § 05) — reject, and none of those tags fire. We do not perform any automated decision-making with legal effect under Art. 22 GDPR.
Where we use third parties to process data on our behalf, we operate them under a Data Processing Agreement per Art. 28 GDPR. Current list:
| Processor | What for | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Web hosting, logs, ebook delivery | Falkenstein / Nürnberg, DE | EU only |
| Fastmail Pty Ltd | Email inbox (hello@, privacy@, dpo@) | EU servers (NL) | EU only |
| Stripe Payments Europe Ltd | Founders' Copy purchase only | Dublin, IE | EU only |
| HubSpot CRM | Engagement pipeline notes | Frankfurt, DE (EU data residency) | EU residency |
| Anthropic PBC | Ren concierge replies (chat content); engagement work | US | SCC + DPA |
| OpenAI, L.L.C. | Transcription of Ren voice notes (Whisper); engagement work | US | SCC + DPA |
| Vapi | Phone call when you ask Ren to call you | US | SCC + DPA |
| Functional Software, Inc. (Sentry) | Error monitoring, no personal data | US | SCC + DPA |
| Google (Analytics & Ads) | Reach measurement (GA4), ad measurement / remarketing — consent only | US | SCC + DPF |
| Microsoft (Clarity) | Aggregated usage analysis — consent only | US | SCC + DPF |
| Dealfront Group GmbH (Leadfeeder) | Company identification of website visits (B2B), consent only | Germany | EU |
| Snitcher B.V. (Radar) | Company identification of website visits (B2B), consent only | Netherlands | EU |
| LinkedIn (Insight Tag) | Ad measurement / conversion measurement / remarketing — consent only | Ireland, EU · US | SCC |
If we add a sub-processor, we update this page before data flows to them. The diff is dated below at § 09.
Necessary storage runs without consent: it is strictly required for the site to function (Art. 6 (1) f GDPR · § 25 (2) TDDDG) and sets no third-party or tracking cookies:
rn-theme · rn-lang · localStorage / cookie · your light/dark and EN/DE preference. First-party, no PII.rn-diag-draft · localStorage · stores diagnostic answers in progress so a refresh doesn't lose them. Cleared on submit. First-party.rn-consent · localStorage + cookie (12 months) · records your cookie choices and the timestamp (consent proof). Without it we'd have to ask every visit.ren-session-id · sessionStorage (until the tab is closed) · a random ID so a conversation with Ren survives a page reload. First-party.rn-chefsache-edition · localStorage · remembers which industry edition of Chefsache KI you picked. Set only when you pick one. First-party, no PII.Optional, consent-only. The following load only after you accept (Art. 6 (1) a GDPR · § 25 (1) TDDDG), are managed via Google Tag Manager, and are gated by Google Consent Mode v2, so on rejection they never set a cookie or send data. You can withdraw any time via "Cookie settings" (footer or the panel below); withdrawal is as easy as consent.
_ga, _ga_* up to 24 months._clck (12 mo.), _clsk (1 day), MUID._lfa up to 24 months._gcl_* up to 90 days.li_gc, lidc, UserMatchHistory, bcookie, li_fat_id up to 6 months.rn-attr · sessionStorage (until the tab is closed) · remembers how you reached the site (referring domain, first page, UTM parameters, time) so a request through Ren can be attributed to it. First-party, not via Google Tag Manager.With the LinkedIn Insight Tag we measure whether visitors who reached this site through a LinkedIn ad take an action (a contact request, a booked Fit Call, a download), and we build audiences for remarketing. Your browser sends data to LinkedIn for this. If you came through a LinkedIn ad, our server also reports the action to LinkedIn (LinkedIn Conversions API): the type of action, a timestamp, a random event ID and LinkedIn’s own click ID (li_fat_id). This server-side report contains no email address, no name and no IP address. Like the Insight Tag, it is sent only with your consent to the “Marketing” category (Art. 6(1)(a) GDPR · § 25(1) TDDDG); without consent nothing is sent.
For the processing of the data collected through the Insight Tag, we and LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) are joint controllers under Art. 26 GDPR. The basis is the joint controller addendum that LinkedIn provides to advertisers. We are responsible for informing you about the collection on this site and for obtaining your consent. LinkedIn is responsible for the further processing of the data on LinkedIn, including data subject rights in relation to it. You can exercise your rights against us as well as against LinkedIn. More information: LinkedIn’s privacy policy. You can object to the use of your data for ads on LinkedIn here.
You can clear all of the above by clearing site data in your browser, or withdraw consent below. Nothing on this site requires the optional services to function.
Each category has a defined retention period (see § 03 for the register). Outside the statutory minimums (commercial 6 years, tax 10 years), we delete on the shortest reasonable horizon. After retention, we either delete or irreversibly anonymize. Anonymized statistics may be retained for trend analysis (median diagnostic scores per industry, etc.) but cannot be re-identified.
You have the following rights regarding any personal data we hold about you. To exercise any of them, email privacy@remote-native.com — we respond within one month (Art. 12 (3) GDPR), usually inside a week.
Get a copy of what we hold about you, the purposes of processing, recipients, and retention.
Correct anything inaccurate or incomplete.
"The right to be forgotten" — subject to statutory retention (tax, commercial).
Tell us to pause processing while a dispute is resolved.
Receive your data in a machine-readable format (JSON, on request).
Object to processing based on legitimate interest. We'll stop unless we can demonstrate compelling grounds.
Where processing is based on consent (e.g. ebook follow-up), withdraw it any time. No reason needed.
Lodge a complaint with a supervisory authority — see § 08 below for ours.
For any privacy matter, write to privacy@remote-native.com. For matters directed to the DPO specifically: dpo@remote-native.com.
You also have the right to complain to a supervisory authority. The competent supervisor for our registered office is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) · Promenade 18, 91522 Ansbach · lda.bayern.de · You may also complain to the supervisor of your habitual residence or place of work.
This page is updated when our processing changes. The German version is the legally binding version; the English version is provided for convenience. Material changes are flagged on the homepage for 30 days.
ren-session-id and rn-chefsache-edition (necessary) and rn-attr (analytics); the German telecoms data protection law is cited by its current name, TDDDG.Last updated · 11 Oct 2026 · v3.3 · DE binding · See imprint