Privacy policy

This English version is provided for convenience. Only the German version is legally binding.

1. Overview

This policy explains which personal data we process when you visit this website, write to us, book a call or object to our research, and which data we process from public sources for our campaigns. For each case, it says why, on what legal basis and for how long.

In short, this website sets no cookies for analytics or advertising and uses no analytics or advertising services. We serve our fonts from our own server. We only load the cal.com calendar if you agree.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is

André Gröschel
OpenProspect
Leiria RC/DT 2410-125
Portugal

You can reach us at support@openprospect.io, including with any questions about data protection.

3. When you visit the website

When you open the website, your browser sends certain information to the server that hosts it, as it technically must. The server keeps the following in log files.

• The IP address of your device
• The date and time of your visit
• The address you requested and the amount of data transferred
• The page you came from (referrer)
• Your browser and operating system

We need this information to deliver the website, keep it running reliably and securely, and detect attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The website is hosted by a hosting provider that processes this information on our behalf (Art. 28 GDPR). The logs are deleted as soon as they are no longer needed for these purposes. We never combine them into a profile of you.

4. Browser storage and cookie banner

We set no cookies for analytics or advertising. In your browser’s storage, we only keep what the site needs to work.

• Your choice in the cookie banner and when you made it, in localStorage, for 12 months
• For the length of your visit, how the page is displayed, for example whether the bar has already appeared, in sessionStorage

This information never leaves your browser. The legal basis for storing it is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), and for processing it, our legitimate interest in a site that respects your choice and displays calmly (Art. 6(1)(f) GDPR).

In the cookie banner, you decide whether we load external content, meaning the cal.com calendar (section 5). You can change or withdraw your choice at any time under “Cookies” at the bottom of the page. A withdrawal applies from then on.

5. Booking a call with cal.com

In the closing section of our pages and in the “Book a call” window, you can book a call with us through an embedded calendar. The calendar is provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA.

We only load the calendar once you agree, in the cookie banner or with “Load calendar.” Until then, no request goes to Cal.com. As soon as it loads, Cal.com receives your IP address and details about your browser and device, as it technically must, and Cal.com may store its own data in your browser. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time under “Cookies.”

If you book a call, we process the details you enter with Cal.com, such as your name, email address, the time you chose and your message, to prepare and hold the call. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). We delete these details once they are no longer needed for the call and its follow-up, unless statutory retention obligations apply.

Cal.com also processes data in the USA. For transfers from the European Economic Area, Cal.com states that it relies on the European Commission’s standard contractual clauses or an adequacy decision such as the EU-U.S. Data Privacy Framework. You’ll find more in Cal.com’s privacy policy.

You can also book without the embedded calendar, directly at Cal.com with the “Open in cal.com” link, or by emailing us.

6. Contacting us by email or form

If you email us or write to us with the form on the Support page, we process your address and what you write, and with the form also your name and, if you provide them, your company’s name and your phone number, to reply to you. Requests from the forms on this website reach us by email. To deliver them, we use an email service provider that processes the information on our behalf.

The legal basis is steps before entering into a contract or a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). We delete the information once your inquiry has been dealt with, unless statutory retention obligations apply.

7. Data opt-out

With the form on the Data opt-out page, you object to research and outreach by us. For this, we process your name, your email address, your company’s name and, if you add one, your note. The form sends them to us by email, as described in section 6. The OpenProspect team reviews every request and removes the address from all campaigns.

We need this information to carry out your objection and respect it permanently. The legal basis is our legal obligation to respect an objection (Art. 6(1)(c) GDPR in conjunction with Art. 21 GDPR). We only keep what we need so that we don’t research or contact you again, and only for as long as necessary.

8. Moving to the app

Buttons like “Find companies that fit” take you to our app at app.openprospect.io. Whatever you type into the field at the top of the homepage is passed along, so your ideal customer profile starts with your words. If you reach the site through a link with campaign details (utm parameters or the click IDs gclid, fbclid and li_fat_id), we add them to the link into the app so that a sign-up can be attributed to its campaign. We store neither on this website. The legal basis is our legitimate interest in knowing which campaign brought someone to us (Art. 6(1)(f) GDPR).

If you register in the app, we process the details you enter there.

• First and last name
• Business email address
• Company name and company details
• Password (encrypted)
• Payment details if you order something paid in the app (handled by a payment service provider)

Creating your ideal customer profile there is free and needs no payment details. We process your details to provide the app and perform the contract (Art. 6(1)(b) GDPR) and delete them when the contract ends and no statutory retention obligations remain.

9. Research for campaigns

For our clients, we find companies that fit what they sell and the people there who decide on the topic. This information comes only from publicly available sources, such as websites and legal notices, the commercial register, job ads, business directories, map services with reviews and public profiles on professional networks.

We process the following.

• Company name, address and website
• Names, roles and departments of decision-makers
• Business email addresses and phone numbers
• Publicly available information about the company that matters for the outreach, for example from job ads or reviews

We use this information to select companies and contacts and to reach out to them on behalf of our clients for business purposes, by email, by mail or with a dedicated landing page. The legal basis is our legitimate interest and that of our clients in initiating business (Art. 6(1)(f) GDPR). We limit ourselves to business information (business-to-business). We delete the information once it is no longer needed for the campaign, at the latest when you object.

You can object to this processing at any time, with the form on the Data opt-out page or by emailing support@openprospect.io. The OpenProspect team reviews every request and removes you from all campaigns.

10. Recipients

We only share your data if you have consented (Art. 6(1)(a) GDPR), if it is necessary to perform a contract with you (Art. 6(1)(b) GDPR), if we are legally required to (Art. 6(1)(c) GDPR) or if it is necessary to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

For hosting, sending emails, booking calls and invoicing, we use service providers that process data only on our instructions. We have data processing agreements with them under Art. 28 GDPR. If a service provider processes data outside the EU or the EEA, it does so only on the basis of an adequacy decision by the European Commission or standard contractual clauses.

11. Data security

The website is only available over an encrypted connection (TLS). We protect your data against loss, destruction, tampering and unauthorized access with technical and organizational measures and keep them up to date with the state of the art.

12. Your rights

You have the right

• to request access to the data we process about you (Art. 15 GDPR);
• to request the rectification of inaccurate data or the completion of your data (Art. 16 GDPR);
• to request the erasure of your data (Art. 17 GDPR);
• to request the restriction of processing (Art. 18 GDPR);
• to receive your data in a structured, commonly used and machine-readable format (data portability, Art. 20 GDPR);
• to withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR);
• to lodge a complaint with a supervisory authority, in particular in the member state where you live or work or where the suspected infringement took place (Art. 77 GDPR).

Right to object. Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time under Art. 21 GDPR, on grounds relating to your particular situation, and to processing for direct marketing without giving any reason. An email to support@openprospect.io or the form on the Data opt-out page is all it takes.

13. Obligation to provide data and automated decisions

You are not obliged to provide us with any data. Without the technically necessary information from section 3, however, the website cannot be delivered, and without your details we cannot reply to you or arrange a call with you. We do not make automated individual decisions under Art. 22 GDPR.

14. Changes

This privacy policy is current as of September 2026. If the website, our offering or the legal requirements change, we will update it. The version published here applies.