LEGAL

Privacy & GDPR

Last updated: 4 October 2026

The short version

  • This website sets no cookies and loads nothing from third parties until you explicitly agree.
  • The homepage currently comes in more than one version, so we can learn which one explains Cordango best. Counting that sets no cookie and stores nothing on your device.
  • Fonts are self-hosted. No requests go to font services.
  • Analytics runs only after you click “Allow analytics” in the banner, and you can change your mind at any time.
  • What you enter in the contact form is stored in our own infrastructure and used only to answer you.
  • We never sell personal data or share it for advertising.

Who is responsible

The controller for personal data processed through this website is:

Tim Cadenbach
Cordango
Email: [email protected]

Address: For legal and security reasons, our business address is currently being updated and cannot be published during this short transition period. For formal correspondence or service-related requests, please contact us at [email protected]. Our new business address will be published here shortly.

For any privacy question or request, write to [email protected].

Hosting and server logs

This website is delivered through Cloudflare, Inc. as our hosting and content delivery provider. When you open a page, Cloudflare processes the technical data that every web request carries: your IP address, the requested URL, date and time, browser and operating system information. This is required to deliver the site, keep it fast, and defend it against attacks.

The legal basis is our legitimate interest in operating a secure and reliable website (Art. 6(1)(f) GDPR). We do not combine this data with any other information about you.

Cookies and local storage

The site itself sets no cookies. Your cookie decision is stored in your browser’s local storage under the key cordango-consent, on your device only. It never leaves your browser and we cannot read it from anywhere else.

If you decline, nothing changes and no analytics ever loads. You can reopen the banner and change your choice here:

Comparing versions of the homepage

Right now the homepage comes in up to four versions, and we count which one leads more people on to sign up. Nothing is stored on your device for this and no cookie is set, so we do not ask for your consent for it.

Which version you see is decided when the page is requested. Cloudflare combines your IP address and your browser’s identification string with a secret that changes every two hours, and turns them into a number. That number picks the version and is discarded straight away, which is why you keep seeing the same version for up to two hours. Neither the number nor your IP address is stored.

Your browser then tells our own server, without any identifier, which version it showed and what followed: a click towards signing up or to the App Library, which way of joining you opened, or a sent form. We keep only daily totals per version, language and device type (phone or computer), such as “1,204 views and 31 sign-up clicks on Tuesday”. Nobody can tell from them who you are or what you did.

If your browser sends the Global Privacy Control signal, nothing is counted. Automated browsers and search engines are not counted either.

The legal basis is our legitimate interest in finding out which way of presenting our product is easiest to understand (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR), most simply by switching on Global Privacy Control in your browser.

Web analytics (Google Analytics 4)

Only after you click “Allow analytics” do we load Google Analytics 4, a service of Google Ireland Limited and Google LLC (USA). It helps us understand which pages are read and how visitors find the site. Google then sets cookies and receives your IP address and information about your visit. Google LLC is certified under the EU–US Data Privacy Framework; transfers to the USA rest on that certification.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the button above; from the next page load, no analytics is loaded. To remove cookies Google has already set, clear cookies for this site in your browser.

The contact form

When you book a call or contact us through the form, we process the details you enter: name and email address, and optionally company, company size and your message. We use them solely to answer your request and prepare the call you asked for (Art. 6(1)(b) GDPR).

Your submission is stored in a Cloudflare D1 database in our own infrastructure. A notification email is then sent to us through Microsoft 365, operated by Microsoft Ireland Operations Limited, which is where our business email runs. No CRM or marketing provider is involved, and your details are not added to any mailing list.

The form is protected against spam by Cloudflare Turnstile, which evaluates technical browser signals and your IP address to tell people from bots (Art. 6(1)(f) GDPR). Turnstile does not track you across sites.

We keep submissions as long as needed to handle your request and delete them on request at any time.

Email contact

If you email us directly, we process your address and the content of your message to answer you (Art. 6(1)(b) or 6(1)(f) GDPR). Mail is retained as long as the conversation is relevant and deleted on request.

Your rights under the GDPR

  • Access (Art. 15): ask what data we hold about you.
  • Rectification (Art. 16): have incorrect data corrected.
  • Erasure (Art. 17): have your data deleted.
  • Restriction (Art. 18): limit how your data is processed.
  • Portability (Art. 20): receive your data in a portable format.
  • Objection (Art. 21): object to processing based on legitimate interest.
  • Withdraw consent (Art. 7(3)): at any time, with effect for the future.

To exercise any of these rights, one email to [email protected] is enough. You also have the right to complain to a data protection supervisory authority, for example the one responsible for your place of residence.

If you are a customer

This page covers this website, where we are the controller. Personal data inside a Cordango workspace is different: there you are the controller and we are your processor. What we process on your behalf, which sub-processors are involved and which measures protect it is set out in the Data Processing Agreement.

Changes to this page

We update this page when the website or the services behind it change. The date at the top tells you when it was last revised.