Privacy Policy

1. Data Controller

Digital Performance Holding
Boris Dittberner
Carl-Herz-Ufer 11, 10961 Berlin
[email protected]

2. Hosting

This website is hosted by Vercel Inc. Vercel operates edge infrastructure in the EU region (Frankfurt). A data processing agreement (DPA) per Art. 28 GDPR is in place with Vercel; EU Commission Standard Contractual Clauses (SCC) apply to non-EU data transfers.

3. Data Collection

When you fill out a form or use the course finder, your data is stored in our database (Supabase, EU servers in Frankfurt). Processing is based on Art. 6(1)(b) GDPR.

4. Payment Processing

Payments are processed via Stripe (Stripe Payments Europe Ltd., Dublin, Ireland). Installment payments are handled by Klarna Bank AB (Sveavägen 46, 111 34 Stockholm, Sweden). Your payment data is processed directly by Stripe/Klarna and not stored on our servers. Data processing agreements (DPA) are in place with both providers.

5. AI Assistants Cubix (Chat) & Ella (Voice)

Our chatbot Cubix uses the Claude API by Anthropic, PBC (548 Market St PMB 90375, San Francisco, CA 94104, USA). Chat messages are sent to Anthropic for responses; per Anthropic's Commercial Terms, API content is retained for a maximum of 30 days for abuse prevention and is not used for model training.

Our voice AI assistant Ella (+49 30 75937935) is provided via Vapi, Inc. (USA). Calls are forwarded to Vapi for speech recognition and response generation, then downstream to Anthropic (language understanding) and ElevenLabs Inc. (USA, voice synthesis). Recordings are stored for quality assurance and deleted after max. 90 days. Data transfer to the USA is based on EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework.

6. Live Sessions, Community and Booking

Live online sessions are delivered via Zoom Video Communications, Inc. (Zoom EU data center in Frankfurt, DPA in place). The cohort community runs on Slack Technologies, LLC (EU data center, DPA in place). 15-minute admission interviews and initial consultations are booked via Cal.com, Inc. (EU hosting in our own setup, DPA in place). Transactional emails are sent via Resend, Inc. (EU region Frankfurt, DPA in place).

7. Cookies & Tracking

We use technically necessary cookies (cookie consent, language preference, Stripe fraud prevention) without consent. Analytics and marketing cookies (Google Analytics 4, Google Tag Manager, Microsoft Clarity, Google Ads, Meta Pixel) are only loaded after express consent via our cookie banner — TTDSG § 25 and GDPR Art. 6(1)(a) compliant. Default state is 'denied' (Google Consent Mode V2). In addition to the browser pixel we transmit conversion events (Lead, Subscribe, CompleteRegistration, Purchase) server-side via the Meta Conversions API. Transmitted are hashed (SHA-256) identifiers (email, phone, name, ZIP, city, country), cookie IDs (_fbp, _fbc), IP address and user agent — only after marketing consent is granted. Details and full cookie list at sixsidesacademy.com/cookies.

8. Data Processors (DPA list)

Data processing agreements (DPA) per Art. 28 GDPR are in place with the following processors:

• Vercel Inc. — Hosting/CDN, EU region Frankfurt
• Supabase Inc. — Database, EU region Frankfurt
• Stripe Payments Europe Ltd. — Payment processing, Dublin/Ireland
• Klarna Bank AB — Installments/credit check, Stockholm/Sweden
• Zoom Video Communications, Inc. — Live sessions, EU data center
• Slack Technologies, LLC — Cohort community, EU data center
• Cal.com, Inc. — Appointment booking, EU hosting
• Resend, Inc. — Transactional emails, EU region Frankfurt
• Anthropic, PBC — Claude API for Cubix chatbot and Ella voice agent, USA with SCC + EU-US DPF
• Vapi, Inc. — Phone AI assistant Ella (voice routing, speech recognition), USA with SCC + EU-US DPF
• ElevenLabs Inc. — Voice synthesis for Ella, USA with SCC + EU-US DPF
• Google Ireland Ltd. — Google Analytics 4, Google Tag Manager, Google Ads (conversion tracking), Ireland
• Microsoft Ireland Operations Ltd. — Microsoft Clarity (heatmaps, session recordings, anonymized), Ireland with SCC for US transfers
• Meta Platforms Ireland Ltd. — Meta Pixel + Meta Conversions API (Facebook/Instagram ads, conversion tracking, server-side event delivery), Ireland with SCC for US transfers

Copies of the respective DPAs are provided on request to [email protected].

9. International Data Transfers

Data transfers to third countries (particularly the USA) take place exclusively on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where certified, the EU-US Data Privacy Framework. Providers headquartered outside the EU process data technically in EU data centers where available.

10. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Complaints may be addressed to the competent supervisory authority (Berlin Commissioner for Data Protection and Freedom of Information). Contact for exercising your rights: [email protected].