Privacy.

This notice applies to raum.so, the website and business operations of [ʁaʊ̯m̩], a brand of steinberger Limited. steinberger Limited is the controller within the meaning of the General Data Protection Regulation (GDPR).

It explains how we process personal data relating to website visitors, prospects, clients, suppliers, service providers and other business contacts.

Privacy enquiries and requests can be sent to [email protected].

This website runs on server infrastructure supplied by Hetzner Online GmbH and is delivered through Cloudflare, Inc., including its DNS, network security and Cloudflare Tunnel services. Both providers act as processors where they handle personal data on our behalf.

When the website is opened, technical connection data may be processed. This can include the IP address, date and time of the request, requested path, referring page, browser and device information, response status and security-related connection data. This processing is necessary to establish the connection, deliver the website, maintain its stability and protect it from attacks and misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of this website. Logs are retained only for as long as required for operation, fault analysis and security, and are then deleted or anonymised according to our and the providers' configurations.

Depending on the Cloudflare security functions that are triggered, Cloudflare may use technically necessary cookies. We do not use these for advertising or cross-site marketing.

Provider information: Hetzner data protection · Cloudflare privacy policy · Cloudflare DPA.

We may use the privacy-oriented analytics service Databuddy, provided by Databuddy Analytics, Inc., to understand and improve the performance and use of this website. The processing may include page paths without query parameters, referrer domains, browser and device information, approximate country or region, anonymous session information, performance metrics and technical errors. Analytics data is not used for advertising or personal marketing profiles.

Databuddy states that it does not set tracking cookies and that it discards raw IP addresses after deriving coarse location data. Its standard web SDK can, however, store a random anonymous identifier in localStorage and a temporary session identifier in sessionStorage. Where these functions require consent, they are activated only after that consent has been given. The legal basis is Article 6(1)(a) GDPR where consent is required and Article 6(1)(f) GDPR where processing is permitted on the basis of our legitimate interest in understanding and improving the website.

Further information: Databuddy privacy policy · Databuddy DPA.

We use Google Workspace, including Gmail, Drive and Calendar, for business communication, document collaboration and scheduling. If you contact us by email or telephone, we process the contact details you provide, your organisation and role where relevant, the content of your message, attachments and related technical metadata in order to respond and manage the relationship with you.

Messages sent to [email protected] and certain functional addresses, including [email protected], are first received through Google Workspace and then forwarded to Zoho Desk for structured handling.

The legal basis is Article 6(1)(b) GDPR where the communication concerns a contract or steps before entering into one, Article 6(1)(f) GDPR for general enquiries and relationship management, and Article 6(1)(c) GDPR where retention is required by law. We retain correspondence only for as long as needed for its purpose and any applicable statutory obligations.

You are not legally required to provide contact data. Without the information necessary to answer a request, however, we may not be able to respond.

Provider information: Google Cloud Data Processing Addendum.

We use Zoho CRM to manage relationships with prospects, clients, suppliers and other business contacts, and Zoho Desk to handle enquiries and support conversations. The data processed may include names, business contact details, organisation and role, relationship history, interests relevant to a business enquiry, correspondence, support tickets, attachments and internal follow-up notes.

We process this data to respond to requests, prepare and perform contracts, provide support and maintain professional relationships. The legal basis is Article 6(1)(b) GDPR for contracts and pre-contractual steps, Article 6(1)(f) GDPR for support, relationship management and efficient internal administration, and Article 6(1)(c) GDPR where legal obligations apply.

Provider information: Zoho privacy policy · Zoho GDPR information.

We use Cal.com to offer and coordinate appointments, Google Calendar to manage them and Zoom to conduct online meetings. When you book or attend a meeting, we may process your name, business contact details, organisation, time zone, selected time, booking answers, calendar data, meeting metadata and the content you choose to share during the meeting.

The processing is necessary to arrange and conduct the requested meeting and to follow up on it. The legal basis is Article 6(1)(b) GDPR where the meeting relates to a contract or pre-contractual steps, and Article 6(1)(f) GDPR for other professional meetings and efficient scheduling.

Provider information: Cal.com privacy policy · Zoom privacy statement.

We use Kit to manage and send our newsletter. If you subscribe, we process your email address, any name or preferences you provide, consent records, delivery status and, depending on the newsletter settings, interaction data such as opens and link clicks. This helps us deliver the newsletter, document consent and understand whether the content is technically reaching its audience.

The legal basis for sending the newsletter and any consent-dependent measurement is Article 6(1)(a) GDPR. You can withdraw your consent at any time using the unsubscribe link in each email or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before it.

We do not build individual marketing profiles from newsletter data or use it for decisions that produce legal or similarly significant effects.

Provider information: Kit privacy policy · Kit DPA.

We use Zoho Books for invoicing and accounting, Stripe for payment processing and Revolut Business for business banking and payment transactions. Depending on the transaction, we may process names, business contact and billing details, tax and invoice information, payment identifiers, bank details, amounts, currencies, transaction references, payment status and related correspondence.

The legal basis is Article 6(1)(b) GDPR for invoicing, payment and performance of contracts, Article 6(1)(c) GDPR for accounting, tax, anti-money-laundering and other legal obligations, and Article 6(1)(f) GDPR for payment reconciliation, fraud prevention and the establishment, exercise or defence of legal claims.

Stripe and Revolut may also process data as independent controllers where they determine the purposes and means of processing required for their own regulatory, security and fraud-prevention obligations.

Provider information: Zoho Books privacy + security · Stripe Privacy Center · Revolut Business privacy notice.

We use internally operated workflow systems to support selected processes, for example by organising, retrieving, summarising or preparing information. Access is limited to the data and systems required for the relevant task. The purposes and legal bases described in this notice apply in the same way when these systems assist with a process.

These systems do not make solely automated decisions about you that produce legal effects or similarly significantly affect you. Human team members remain responsible for material decisions and external communication.

Personal data is accessed only where needed by steinberger Limited and by service providers acting under our instructions. Depending on the interaction, relevant recipients include providers of website hosting and security, analytics, business email and collaboration, customer relationship and support systems, scheduling and videoconferencing, newsletter delivery, accounting, payment processing, banking, technical infrastructure and internally operated workflow tools.

These currently include Hetzner, Cloudflare, Databuddy, Google Workspace, Zoho CRM, Zoho Desk, Zoho Books, Cal.com, Zoom, Kit, Stripe and Revolut Business. We have data processing agreements in place with processors where required. We may also disclose information to professional advisers, contractual partners or public authorities where this is necessary to perform a contract, establish, exercise or defend legal claims, or comply with a legal obligation.

We use EU data regions for Zoho and Google Workspace where configured and available. Some providers and their subprocessors operate globally, so personal data may be processed outside the European Economic Area. Where a country does not benefit from an adequacy decision, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures where required.

We do not sell personal data or use it for behavioural advertising.

We retain personal data only for as long as it is needed for the purpose for which it was collected. Relevant factors include the duration of a business relationship, the status of an enquiry or support case, the need to document consent, security requirements and the time needed to establish, exercise or defend legal claims.

Data required for accounting, tax, payment or other statutory purposes is retained for the applicable legal period. When data is no longer required, it is deleted or anonymised, subject to technically necessary backup cycles and legal holds.

Subject to the conditions of the GDPR, you may request access to and rectification or erasure of your personal data, restriction of processing, data portability, or object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

To exercise a right, email [email protected]. We may need to verify your identity before responding. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

Website: dataprotection.gov.cy.

We update this notice when our website, providers or processing activities change. The version published here is the current one. Material changes will be made visible before they take effect where required.

Effective 23 July 2026