Privacy Policy

Last updated: October 2026

This privacy policy explains which personal data we process when you visit our website www.valuerebels.com or contact us, for which purposes and on which legal basis, and which rights you have. A German version with the same content is available.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Value Rebels GmbH & Co. KG
Lerchenweg 3
40789 Monheim am Rhein
Germany

Phone: +49 2173 993 68 79
Email: hello@valuerebels.com

Represented by its general partner Value Rebels Administration GmbH, represented by its managing directors Sandra Hinz and Rainer Collet.

We have not appointed a data protection officer because we are not legally required to. For any questions about data protection, contact us at hello@valuerebels.com.

2. Overview

• Our website is a static website. It has no user accounts, no shop and no comment function.
• When you visit it, our hosting provider processes technically necessary data (section 3).
• We serve our fonts ourselves; no content is loaded from Google Fonts or similar services.
• We only use analytics (Contentsquare/Hotjar) with your consent (section 5).
• YouTube videos are only loaded when you start a video (section 6).
• If you complete the Product Org Fitness Test or write to us, we process the data you give us (sections 7 and 8).

3. Hosting and server log files

Our website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Whenever a page is requested, Netlify automatically processes the following data transmitted by your browser:

• IP address,
• date and time of the request,
• requested page or file,
• referrer (the previously visited page),
• browser type and version, operating system,
• amount of data transferred and status code.

This data is technically required to deliver the website, keep it stable and secure, and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free provision of the website. We do not combine this data with other data and draw no conclusions about you as a person.

We have concluded a data processing agreement with Netlify under Art. 28 GDPR. Netlify may process data in the USA. Netlify is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Log files are deleted automatically after a short period.

The connection to our website is encrypted with TLS (recognisable by “https://”).

4. Cookies and storage on your device, consent management

We store information on your device or access such information where this is strictly necessary for a service you requested (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act) or where you have consented (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Consent management (Klaro). We use the open-source software Klaro to manage your consent. Your choice is stored in a cookie named vr-klaro for 365 days so that we do not have to ask you again on every visit. The cookie only contains your settings. The legal basis is Section 25(2) No. 2 TDDDG and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent).

We load Klaro’s program code from the content delivery network jsDelivr (operated by Prospect One sp. z o.o., Królewska 65A/1, 30-081 Kraków, Poland). Your IP address is transmitted to jsDelivr or its CDN partners, which is technically required to deliver the file. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the reliable provision of the consent tool. The file is pinned to a specific version by a checksum (Subresource Integrity).

Withdrawal. You can withdraw or change your consent at any time with effect for the future by deleting the vr-klaro cookie in your browser; we will ask you again on your next visit.

Starting a video after clicking a teaser. If you click a video teaser (e.g. on the homepage or the publications page), we note this for the duration of the browser session in your browser’s session storage (sessionStorage) so that the video starts right away on the next page. The entry is deleted as soon as that page is opened and only contains the path of the target page. The legal basis is Section 25(2) No. 2 TDDDG.

5. Analytics with Contentsquare (Hotjar)

If you agree in the consent management, we use Contentsquare, a service for analysing how our website is used. The provider is Contentsquare SAS, 7 rue de Madrid, 75008 Paris, France (which Hotjar is part of).

Contentsquare records, in pseudonymised form, how visitors use our website, such as pages viewed, clicks, mouse movements, scroll depth, time spent, device type, screen size and browser. Entries in form fields are not recorded. For this purpose, cookies (including _cs_*, _uxa, _hj*) are stored on your device, which may be valid for up to 13 months. We use the analyses to make our website clearer and easier to use.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without consent, the Contentsquare script is not loaded. You can withdraw your consent at any time (section 4).

We have concluded a data processing agreement with Contentsquare. The data is processed in the EU. Where sub-processors process data in third countries, this is based on an adequacy decision or the EU Standard Contractual Clauses. More information: contentsquare.com/privacy-center.

6. YouTube videos

On some pages we embed videos from our YouTube channel. The provider of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Two-click solution: loaded only after your click. When you open a page with a video, we only show a preview image that we serve ourselves. No data is transferred to YouTube or Google, and no cookies are set. Only when you click the preview image to play the video, or when you reach the video page through a video teaser on our website, is the YouTube player loaded and the video started.

Privacy-enhanced mode. We use YouTube’s privacy-enhanced mode for this (domain youtube-nocookie.com). According to YouTube, in this mode information about your use is only stored once you play the video and is not used to personalise advertising.

Which data is processed. As soon as the player has loaded, your browser connects to YouTube and Google servers. This transmits in particular your IP address, the address of our page, technical information about your browser and device, and information about playback. YouTube may store cookies and similar technologies (e.g. local storage) on your device, for example to compile playback statistics and prevent abuse. If you are logged in to YouTube or Google, YouTube may associate the playback with your account; you can prevent this by logging out beforehand. While a video is playing, your browser may also load the video’s preview image from i.ytimg.com (YouTube) for your device’s media controls.

Legal basis. The legal basis is your consent, which you give by clicking the video or the video teaser (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it by not starting any further videos and deleting cookies set by YouTube in your browser.

Transfers to third countries. Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR).

More information is available in Google’s privacy policy: policies.google.com/privacy.

7. Product Org Fitness Test

You can complete the Product Org Fitness Test without providing personal data; your answers are evaluated in your browser. To see your full results, you give us your email address and, voluntarily, your name and company, and confirm your consent to be contacted.

Data processed: email address, optionally name and company, your overall score, maturity level and scores per area, and the time of submission.

Purpose: We use this data to contact you about your results and, if you wish, to offer support. It is not passed on to third parties for advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give via the checkbox. You can withdraw it at any time with effect for the future, e.g. by email to hello@valuerebels.com.

Recipients: The submission is sent via the form service of our hosting provider Netlify (Netlify Forms, see section 3). Netlify stores the entries in our Netlify account.

Results email: Right after your submission, we send your results with a PDF report to the email address you entered, with a copy to hello@valuerebels.com. The email is created on Netlify’s servers (see section 3) and sent via our email provider Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), with whom we have concluded a data processing agreement under Art. 28 GDPR. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework, and transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR).

Storage period: We delete the data as soon as it is no longer required for the purpose, at the latest twelve months after our last contact, or without delay after you withdraw your consent, unless statutory retention obligations apply.

8. Contact by email or phone

If you contact us by email or phone, we process your details (e.g. name, email address, phone number, content of the request) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your request. We delete the data once the request has been fully dealt with and no statutory retention obligations apply (e.g. six years for business letters under Section 257 of the German Commercial Code).

9. Applications

We accept applications by email. We process your application documents to decide on establishing an employment relationship. The legal basis is Art. 6(1)(b) GDPR. If no employment relationship is established, we delete your documents six months after notifying you of the rejection, unless longer storage is required, for example to defend against claims under the German General Equal Treatment Act (AGG), or you have agreed to longer storage.

10. Links to external platforms

Our website links to our profiles on LinkedIn and YouTube and to content of other providers. These are plain links; visiting our website does not transmit any data to these providers. Only when you follow a link does the respective provider’s privacy policy apply.

11. Storage period

Unless a specific storage period is stated in this policy, we only store personal data for as long as is necessary for the respective purpose or required by statutory retention periods. It is then deleted.

12. Your rights

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, a message to hello@valuerebels.com is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

13. Obligation to provide data, automated decisions

You are not obliged to provide us with personal data. Without an email address, however, we cannot unlock the full results of the Fitness Test or reply to requests.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The score in the Fitness Test is purely an evaluation of your own answers and has no legal or similarly significant effect.

14. Changes to this privacy policy

We update this privacy policy when our website or the legal requirements change. The version published here applies.