Data protection
Privacy Policy
1. Introduction
This website is operated by: muun GmbH.
It is very important to us to treat the data of our website visitors with trust and to protect it in the best possible way. For this reason, we make every effort to meet the requirements of the GDPR.
Below, we explain how we process your data on our website. We use clear and transparent language to ensure you truly understand what happens to your data.
2. General Information
2.1 Processing of personal data and other terms
Data protection applies to the processing of personal data. Personal means all data with which you can be personally identified. This is, for example, the IP address of the device (PC, laptop, smartphone, etc.) you are currently sitting in front of.
Such data is processed when "something happens to it". For example, the IP address is transmitted from the browser to our provider and automatically stored there. This is then processing (according to Art. 4 No. 2 GDPR) of personal data (according to Art. 4 No. 1 GDPR).
These and other legal definitions can be found in Art. 4 GDPR.
2.2 Applicable regulations/laws – GDPR, BDSG, and TDDDG
The scope of data protection is regulated by law. In this case, these are the GDPR (General Data Protection Regulation) as a European regulation and the BDSG (Federal Data Protection Act) as a national law.
In addition, the TDDDG supplements the regulations from the GDPR regarding the use of cookies.
2.3 Controller
The controller for data processing on this website is the controller within the meaning of the GDPR. This is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
You can contact the controller at:
muun GmbH
Eifflerstraße 43
22769 Hamburg
hello@muun.studio
2.4 How data is generally processed on this website
As we have already established, there is data (e.g., IP address) that is collected automatically. This data is primarily required for the technical provision of the homepage. To the extent that we use personal data beyond this or collect other data, we will inform you about it or ask for your consent.
Other personal data you consciously share with us. Detailed information on this can be found below.
2.5 Your Rights
The GDPR provides you with comprehensive rights. These include, for example:
• Free information about the origin, recipient, and purpose of your stored personal data
• Rectification, blocking, or erasure of this data
• Right to lodge a complaint with the data protection supervisory authority
• Withdrawal of given consent
How these rights look in detail and how to exercise them can be found in the final section of this privacy policy.
2.6 Data Protection – Our Perspective
For us, data protection is more than just an administrative burden! Personal data has great value, and mindful handling of this data should go without saying in our digitized world.
In addition, as a website visitor, you should be able to decide for yourself what, when, and by whom "happens" to your data. Therefore, we commit to complying with all legal provisions, only collect the data necessary for us, and naturally treat it confidentially.
2.7 Disclosure and Erasure
Data is only disclosed on a legal basis. This can particularly be the case if it involves a processor and a data processing agreement according to Art. 28 GDPR has been concluded.
We erase your data when the purpose and legal basis for processing no longer apply and no other legal obligations stand in the way of erasure. An overview is also provided by Art. 17 GDPR.
2.8 Hosting
This website is hosted externally by Vercel. Pages are delivered via Vercel’s global content delivery network (CDN). Server-side functions, such as sending the contact form, run in the data centre in Frankfurt am Main, Germany.
Provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA
Processing is based on Vercel’s Data Processing Addendum. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR). The legal basis for hosting is our legitimate interest in providing the website securely and quickly (Art. 6(1)(f) GDPR).
https://vercel.com/legal/privacy-policy
3. What happens on our website
3.1 Data collection when visiting the website
When you visit our website, our host automatically stores server log files. These contain:
• Browser type and version
• Operating system used
• Referrer URL
• Page requested
• Time of the server request
• IP address
This data is used for system security, troubleshooting and displaying the website and is processed in accordance with Art. 6(1)(f) GDPR. It is not combined with other data, is stored only as long as necessary for these purposes and is then deleted automatically.
3.2 Cookies and consent
We do not set any cookies without your consent. On your first visit, a banner asks whether you allow Google Analytics as well as the embedding of Google Maps and our booking calendar (Cal.com). You can also load the map and the calendar individually where they appear. Audience measurement with Vercel Web Analytics (3.7) works without cookies and is therefore not part of the banner.
We store your choice in your browser’s local storage (localStorage, entry “muun-consent-v1”) so that you are not asked again on every page. This is technically necessary (Section 25(2) No. 2 TDDDG) and serves as proof of your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
You can change or withdraw your consent at any time with effect for the future using the “Cookie settings” button at the end of this privacy policy. If you withdraw your consent for Google Analytics, we delete the related cookies.
3.3 Contact form and email
If you contact us via the contact form or by email, we process your details (first name, last name, email address, company and your message) to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Messages sent via the contact form are delivered to our inbox through the email service Resend. The provider is Plus Five Five, Inc. (“Resend”), USA. We have a data processing agreement with Resend based on the EU Standard Contractual Clauses; Resend is also certified under the EU-U.S. Data Privacy Framework.
https://resend.com/legal/privacy-policy
We manage our emails with Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
We delete your details once your request has been fully processed, at the latest after 3 months, unless statutory retention obligations apply.
3.4 Booking appointments with Cal.com
On our contact page you can book an initial consultation directly via an embedded calendar from Cal.com. The calendar is only loaded once you have given your consent (banner or “Load calendar” button). Your IP address and technical data of your browser are then transmitted to Cal.com; when you book, also the data you enter there (e.g. name, email address and preferred time).
Provider: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. The calendar is provided via the cal.eu instance. Cal.com is certified under the EU-U.S. Data Privacy Framework and additionally uses EU Standard Contractual Clauses.
The legal basis for loading the calendar is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); for the booking itself, Art. 6(1)(b) GDPR. Without consent, you can also open the calendar directly on cal.eu.
3.5 Google Maps
On our contact page we show a map from Google Maps. It is only loaded once you have given your consent (banner or “Load map” button). Your IP address and technical data of your browser are then transmitted to Google, possibly also to the USA.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
https://policies.google.com/privacy
3.6 Google Analytics
With your consent, we use Google Analytics 4 to understand how our website is used, for example which pages are viewed, how long visits last and which channels visitors come from. For this, Google sets cookies (_ga and _ga_<ID>, lifetime up to 2 years) and processes usage data such as pages viewed, device and browser information and approximate location. Google Analytics 4 does not store IP addresses.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Analytics data is deleted according to the retention period set in Google Analytics, at the latest after 14 months.
https://policies.google.com/privacy
3.7 Audience measurement with Vercel Web Analytics
To see how many people visit our website, which pages they view and which websites they come from, we use Vercel Web Analytics from our host Vercel (see 2.8). Vercel Web Analytics does not set any cookies.
With each page view, the following is transmitted: the page viewed, the referring website (referrer), certain URL parameters (for example campaign tags such as “utm_source”), the approximate country or region, device type, operating system and browser including version, and the time. We also count when a request has been sent via the contact form or an appointment has been booked, without any content or contact details. To count visits, Vercel creates a hash from data in the request, which is discarded after 24 hours. Your IP address is not stored for this purpose. We only see aggregated statistics and cannot attribute them to any person.
The legal basis is our legitimate interest in a statistical analysis of our website’s reach (Art. 6(1)(f) GDPR). Processing takes place under the data processing agreement with Vercel (see 2.8).
https://vercel.com/docs/analytics/privacy-policy
3.8 Fonts, images and videos
We serve all fonts, images and videos ourselves via our host. Visiting the website does not establish any connection to Google Fonts or other third parties.
3.9 Links to LinkedIn
We link to our profile on LinkedIn. These are simple links, not embedded plugins. Data is only transmitted to LinkedIn when you click such a link.
4. Other important aspects
4.1 Your rights in detail
4.1.1 Right of access under Art. 15 GDPR
You can request confirmation as to whether personal data concerning you is being processed.
4.1.2 Right to rectification under Art. 16 GDPR
You have the right to obtain the rectification of inaccurate or incomplete data.
4.1.3 Right to erasure under Art. 17 GDPR
Under certain conditions, you can request the erasure of your personal data.
4.1.4 Right to object under Art. 21 GDPR
You can object to the processing of your personal data at any time.
4.1.5 Right to lodge a complaint under Art. 77 GDPR
You can lodge a complaint with a data protection supervisory authority if you believe that the processing violates the GDPR.
5. Changes to the Privacy Policy
The status of this privacy policy is October 25, 2026.
We reserve the right to change this privacy policy at any time. Please check it regularly.