Privacy Policy

The controller for the personal data covered by this policy is:

Central Space ISM GmbH
Zur Alten Börse 41
12681 Berlin
Germany

Email: mail@centralspaceism.com
Commercial register: Amtsgericht Charlottenburg, HRB 250472 B
VAT ID: DE359600969

Full company details are on our Impressum. For privacy questions, contact us at the email above.

This policy covers the ONDSU website hosted on Fimo, including ondsu.com and its Fimo review site, the Acoustic Score assessment at quiz.ondsu.com hosted on Vercel, and related contact-form enquiries, emails and consultation bookings.

We collect different categories of data depending on how you interact with us.

When you visit the site

IP address (collected by our hosting providers in server logs). Browser and device metadata (user agent, screen size, referrer). Page views and interaction events (only if you accept analytics cookies). A cross-domain visitor identifier (ondsu_vid, only set after analytics consent).

When you take the Acoustic Score quiz

Name, email address (required to receive the report). City and country. Company name (optional). Your answers to the quiz (space type, room dimensions, materials, symptoms, role, treatment status). Your computed score, score band, and report reference. The visitor identifier passed from ondsu.com (only if analytics consent was granted). A timestamp of your submission. We also record your request for the report, with its timestamp and the version of the request wording, in our Supabase database.

When you contact us

Your name, email address, project type and message. You may also send room photos or PDF floor plans. The form sends your details and files directly to a Supabase function, which processes them temporarily and sends them through Resend as an email with attachments to our inbox so we can answer your enquiry. The enquiry and files are not saved in Fimo, Supabase Storage or our database. For spam protection, we store an IP-derived code and request counters. Counters older than two days are removed when processing later requests. If you contact us by email, we receive your message and any attachments.

When you book a consultation

Name, email, and any optional intake answers. The time you scheduled. Provided directly to Calendly; we receive a copy via Calendly’s interface.

If you express interest in future emails

The quiz offers an optional checkbox for future ONDSU emails with acoustic advice, project examples and product news. We store your choice with your quiz submission in Supabase and, if you express interest, its timestamp and the version of the wording shown. This records interest for the future; it does not currently enrol you in a newsletter or marketing email sequence. Your report is sent whether or not you express interest.

What we do not collect

Our forms do not ask for sensitive personal data, such as health information, religion or ethnicity. Please include only the information needed for your enquiry or assessment. We load the LinkedIn Insight Tag and Meta Pixel only after your separate Marketing consent.

We use the following legal bases under Art. 6 GDPR.

Delivering the Acoustic Score report to your email

Art. 6 (1) (b) GDPR, performance of a service you requested. This includes recording the request and sending the report with your RT60 estimate, practical first steps, indicative treatment costs and options for help from ONDSU.

Computing your score and generating the report PDF

Art. 6 (1) (b) GDPR.

Answering enquiries

Art. 6 (1) (b) GDPR for steps you request before entering a contract. For other enquiries, Art. 6 (1) (f) GDPR, our legitimate interest in answering messages sent to us.

Recording optional interest in future emails

Art. 6 (1) (a) GDPR, your consent to record the interest you choose to share. You can withdraw it at any time by emailing mail@centralspaceism.com, without affecting delivery of your report. We do not treat this record as a confirmed marketing subscription. Any future marketing emails require valid permission under the applicable rules, including § 7 UWG. Agreeing to this Privacy Policy or accepting cookies does not itself give permission for marketing emails.

Running analytics to understand how the site performs

Art. 6 (1) (a) GDPR, your consent through the cookie banner. Storage on or access to your device is governed by § 25 TDDDG, including the exception for strictly necessary storage.

Booking and managing consultations

Art. 6 (1) (b) GDPR.

Securing our systems and detecting abuse

Art. 6 (1) (f) GDPR, legitimate interest.

Meeting tax, accounting, and other legal obligations

Art. 6 (1) (c) GDPR.

LinkedIn advertising measurement and audiences

Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, your separate Marketing consent through the cookie banner.

Meta advertising measurement and audiences

Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, your separate Marketing consent through the cookie banner.

The ONDSU website stores your cookie choices in your browser’s local storage. On ondsu.com and www.ondsu.com, Fimo analytics, Google Analytics and the ONDSU visitor identifier run only after analytics consent. The visitor identifier may be passed to the quiz. Google Analytics is not loaded by the quiz itself, and analytics are disabled on Fimo review and local development hosts. You can change your choice using “Cookie settings” in the website footer.

Details of cookies, browser storage and their durations are in our Cookie Notice.

LinkedIn marketing tracking is controlled separately through Marketing. Without this consent, its tag is not loaded. Withdrawal stops further tracking from this website and removes accessible first-party identifiers; LinkedIn manages cookies on its own domains.

We use the following service providers to operate the website, answer enquiries and deliver the Acoustic Score. Where providers process data on our behalf, Art. 28 GDPR applies. LinkedIn’s role as an independent controller for member data is explained below. We do not sell personal data.

Strapi, Inc. (Fimo)

Website hosting. The contact form does not use Fimo to receive or store your enquiry or files. After analytics consent, Fimo also receives page paths, page names, campaign parameters, the referring URL, browser information and pseudonymous visitor and session identifiers to count visits and page views. Fimo identifies storage in the United States and the EEA. See Fimo’s Privacy Policy and Data Processing Addendum.

Vercel Inc.

Hosting the quiz at quiz.ondsu.com. United States.

Supabase Inc.

Database and backend functions for the quiz, including report requests and optional future-email interest records. Frankfurt, Germany (EU). The company is US-based but our database is hosted in the EU. A function temporarily processes contact enquiries and attachments for email delivery. Only spam-protection codes and counters are saved in the database, not contact-enquiry or file contents. Supabase Storage is not used for contact files.

Google LLC (Google Analytics 4)

Analytics on ondsu.com and www.ondsu.com after your consent. United States.

Omnisend Ltd.

Earlier quiz contact records may remain in Omnisend. New quiz submissions and optional future-email interest are no longer sent to Omnisend. United Kingdom and EU (Lithuania).

Calendly LLC

Booking system for consultations. United States.

Resend Inc.

Delivery of transactional emails: your Acoustic Score report and contact-enquiry notifications, including the message and attachments. United States.

PDFShift SAS

Converting your report from HTML to PDF. France (EU).

ipapi.co

Approximate geolocation from IP address (for analytics country breakdowns). United Kingdom.

We may also share data when required by law, when needed to protect our rights, or as part of a corporate transaction (sale, merger, acquisition). We will let users know if a transaction would change how their data is handled.

LinkedIn Insight Tag

If you accept Marketing, we load the LinkedIn Insight Tag on ondsu.com and www.ondsu.com. LinkedIn receives information about your visit, including the page URL, referring URL, IP address, browser and device information, timestamp and cookie or similar identifiers. Its Website Actions feature can also record page visits, button clicks and form-submission events. This helps us understand our audience, measure advertising results and build audiences for later advertising on LinkedIn. Collection can occur even if you did not arrive through a LinkedIn advertisement.

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, provides this service for visitors in the EEA. LinkedIn can match visits to its members, but the reports supplied to us do not identify individual visitors. We do not enable enhanced matching of email addresses or upload form-field values through this integration. The tag is disabled on preview and local development sites, the staff visitor tool and the separate quiz service.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG for nonessential storage or access on your device. Marketing consent is separate from Analytics consent and permission to send marketing emails. You can withdraw it at any time through Cookie settings in the footer. Withdrawal stops further tag loading and tracking from this website; it does not undo earlier processing. LinkedIn controls cookies on its own domains.

LinkedIn processes Insight Tag data on servers in the United States. Its published terms describe the applicable international-transfer safeguards and its role as an independent controller for member data. LinkedIn states that direct member identifiers are removed within seven days and remaining pseudonymised Insight Tag data is deleted within 180 days. Cookie lifetimes are separate and listed in our Cookie Notice.

LinkedIn Privacy Policy

LinkedIn Independent Controller Addendum

LinkedIn advertising preferences

Meta Pixel (Facebook / Instagram)

If you accept Marketing, we load the Meta Pixel provided by Meta Platforms Ireland Limited on ondsu.com and www.ondsu.com. It records page views and receives the page URL, referring URL, IP address, browser and device information, timestamp and cookie or similar identifiers. We use this for advertising measurement and to build audiences for advertising on Facebook and Instagram. Collection does not require an advertisement to be running.

Meta may match visits to Facebook or Instagram accounts. We do not receive a list of individual visitors’ profiles. This integration does not supply form-field values, email hashes or quiz answers. Our website code disables automatic event setup. We send page views, AIR and STUDIO product-page views, clicks to open the brochure, Acoustic Score and booking service, and a Lead event after a confirmed successful enquiry. These events contain fixed product identifiers or the page path. Opening clicks do not confirm a download, completed questionnaire or booked appointment. The pixel stays off on preview and local development sites, the staff visitor tool, newsletter and order utilities, the questionnaire handoff and the separate quiz.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG for nonessential storage or access on your device. You can withdraw Marketing through Cookie settings in the footer. We stop the pixel and remove accessible first-party identifiers. This does not erase data Meta already received; manage cookies on Meta domains through Meta or your browser.

Meta may also process data in the United States. Meta’s privacy notice and Business Tools terms explain its purposes, retention, the parties’ roles and applicable international-transfer safeguards. Cookie lifetimes are listed separately in our Cookie Notice.

Meta Privacy Policy

Meta Business Tools Terms

Meta Controller Addendum

Our Supabase database is hosted in Frankfurt, Germany. Some service providers are based outside the EEA or may process data or provide support from outside the EEA.

Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses under Art. 46 GDPR.

Transfers to the United States

Fimo’s Data Processing Addendum, section 9 provides for EU-approved Standard Contractual Clauses for relevant transfers, unless otherwise agreed. Supabase’s Data Processing Addendum also provides Standard Contractual Clauses for transfers, including support access from outside the EEA. The EU-US Data Privacy Framework can cover transfers only where the recipient holds a valid certification for the relevant processing.

Transfers to the United Kingdom

Transfers to the United Kingdom may rely on the European Commission’s applicable adequacy decision. This does not itself cover onward transfers to other countries.

You can request a copy of the safeguards in place for any transfer by emailing mail@centralspaceism.com.

We keep personal data only as long as it serves the purpose we collected it for, plus any required legal retention.

Contact enquiries and uploaded photos

For as long as needed to answer the enquiry and manage the resulting project or relationship, then as required for legal claims or statutory record keeping.

Quiz submissions and report-request records

36 months from your last interaction with us.

Optional interest in future emails

Stored with your quiz submission for the period above, unless you withdraw your interest sooner.

Visitor identifier cookie (ondsu_vid)

365 days from the day it is set.

Google Analytics event data

According to the retention settings for our Google Analytics property. Cookie lifetimes are listed separately in the Cookie Notice.

Server access logs

For the period needed by the hosting provider to operate and secure the service, subject to its retention terms and any legal requirements.

Page view records in our database

24 months.

Earlier contact records in Omnisend

Until you ask to be removed, or after 24 months of inactivity.

Consultation booking records

For as long as needed to arrange and manage the consultation and any resulting relationship, subject to statutory retention duties.

Accounting records (e.g., invoices)

Generally eight years for accounting vouchers such as invoices, ten years for books and annual accounts, and six years for commercial correspondence under § 147 AO. The period normally starts at the end of the relevant calendar year and may be longer where the law requires it.

You can ask us to delete your data sooner. See section 9.

LinkedIn Insight Tag

LinkedIn states that direct member identifiers are removed within seven days and remaining pseudonymised data is deleted within 180 days. Cookie lifetimes are listed separately in the Cookie Notice.

Under GDPR you have the following rights regarding your personal data:

Access (Art. 15). A copy of the data we hold about you.

Rectification (Art. 16). Correction of inaccurate data.

Erasure (Art. 17). Deletion, unless we are required to keep the data.

Restriction (Art. 18). Limiting how we process your data.

Data portability (Art. 20). A copy of your data in a structured, commonly used format.

Objection (Art. 21). To processing based on legitimate interest, including marketing.

Withdraw consent (Art. 7 (3)). At any time, without affecting the lawfulness of processing before withdrawal.

Not be subject to automated decisions (Art. 22). We do not make decisions about you solely by automated means with legal effect.

How to exercise your rights

Email mail@centralspaceism.com. We respond without undue delay and within one month of receiving your request. Where necessary because of the complexity or number of requests, we may extend this by up to two further months and will explain the extension within the first month. We may ask you to confirm your identity using reasonable measures (e.g., reply from the email address you originally used). We do not charge a fee unless a request is manifestly unfounded or excessive.

You can lodge a complaint with your local data protection supervisory authority. For ONDSU’s Berlin location, that is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin
Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Web: datenschutz-berlin.de

If you live in another EU country, you may also complain to your local authority.

We use technical and organisational measures appropriate to the data we handle. This includes encryption in transit (TLS) for the website and quiz, access controls on our database, and processor agreements that require comparable measures. No system is perfect; we keep our practices under review.

If we become aware of a personal data breach that poses a risk to you, we notify the supervisory authority within 72 hours under Art. 33 GDPR and inform affected users without undue delay under Art. 34 where required.

ONDSU is a business-to-business service. We do not intend to collect data from children under 16. If you believe a child has provided us with personal data, contact us at mail@centralspaceism.com and we will remove it.

We may update this Privacy Policy when our practices change or when the law requires us to. We post the revised version on this page and update the “Last updated” date at the top. For material changes, we will notify users by email where reasonable.

Questions about this policy or about your data:

Central Space ISM GmbH
Zur Alten Börse 41
12681 Berlin
Germany

mail@centralspaceism.com