Privacy Policy
Last Updated: 28/09/2025.
This Privacy Policy explains how Pixelwave-Consulting GmbH (“Indest”, “we”, “us” or “our”) collects, uses and protects personal data when you visit our website at indest-projects.com, use the Indest Projects application, contact us or subscribe to our newsletter.
We process personal data in accordance with the General Data Protection Regulation (“GDPR”) and other applicable data protection laws.
1. Data Controller
The controller responsible for the processing of personal data is:
Pixelwave-Consulting GmbH
Beekefeld 8
31559, Haste
Germany
Email: support@indest-projects.com
A separate Data Protection Officer has not been appointed.
2. Visiting Our Website
Our website is hosted using Framer.
When you access our website, technical information necessary to provide the website may be processed by the hosting infrastructure. This may include information such as your IP address, browser information, device information and the time of access.
The processing is carried out for the purpose of securely and reliably providing our website.
The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in operating a secure and functional website.
Our website is created and hosted using services provided by:
Framer B.V.
Amsterdam, Netherlands
Framer provides a Data Processing Addendum under Art. 28 GDPR.
3. Framer Analytics
We use the built-in analytics functionality provided by Framer to understand general usage of our website.
Framer Analytics may provide aggregated information such as:
number of visitors
page views
visited pages
traffic sources
device or browser categories
According to Framer, its built-in analytics does not use cookies or persistent identifiers and does not store information that can be used to identify individual visitors. IP addresses and user-agent information are processed using a daily rotating mechanism to determine daily unique visitors.
We currently do not use additional advertising or tracking technologies such as Google Analytics, Meta Pixel, TikTok Pixel or LinkedIn Insight Tag.
Therefore, our current use of Framer Analytics alone does not require a cookie consent banner according to Framer's current documentation.
4. Indest Projects Account
To use Indest Projects, users must create an account.
During registration, we process:
first name
last name
email address
authentication credentials
The email address must be verified before access to the application is granted.
The processing of this information is necessary to create, provide and manage your Indest Projects account.
The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary for the performance of our contractual relationship with you.
5. Data Processed Within Indest Projects
Users may create, upload and manage information within the Indest Projects platform.
Depending on how the platform is used, this may include:
project information
names of team members
email addresses of team members
work packages
tasks and to-dos
comments
uploaded files and documents
resource planning information
working time and effort information
project risks
project planning information
other content entered or uploaded by users
We process this information in order to provide the functionality of Indest Projects.
For personal data relating directly to our customers and users, the legal basis is generally Art. 6(1)(b) GDPR.
Customer Data
Customers may also enter personal data relating to their employees, team members, contractors, customers or other individuals into Indest Projects.
In these cases, the respective customer generally determines the purposes and means of processing and therefore acts as the data controller, while Indest Group GmbH processes such data on behalf of the customer as a data processor.
Such processing is governed separately by a Data Processing Agreement pursuant to Art. 28 GDPR.
6. Hosting of the Indest Projects Application
The Indest Projects application and its infrastructure are hosted using services provided by IONOS.
The servers used for our application are located in Germany.
Personal data stored in the application may therefore be processed on infrastructure operated by IONOS.
IONOS provides contractual arrangements for processing personal data in accordance with Art. 28 GDPR.
The legal basis for processing user data through our infrastructure is Art. 6(1)(b) GDPR.
Where processing is necessary for maintaining the security, stability and availability of our systems, we may additionally rely on Art. 6(1)(f) GDPR.
7. File Storage
Users can upload files and documents to Indest Projects.
Uploaded files are stored using IONOS S3 Object Storage.
Files may contain personal data depending on the content uploaded by the user.
We process these files solely for the purpose of providing the file management functionality of Indest Projects and making the files available to authorized users of the respective project or organization.
Users and customers are responsible for ensuring that they have an appropriate legal basis for uploading personal data relating to third parties.
8. Payments and Stripe
Payments for paid Indest Projects subscriptions are processed through Stripe.
Stripe may process information including:
name
email address
billing information
payment method information
transaction information
technical and fraud-prevention information
Indest does not directly store complete credit card or payment card details.
Payment details are processed through Stripe's systems, including Stripe Checkout and Stripe's customer management functionality.
For customers in the EEA, Stripe's European entities are involved in providing payment services. Stripe may act both as an independent controller for certain regulated payment activities and as a processor for other activities.
The processing is necessary for processing payments and managing subscriptions and is therefore based primarily on Art. 6(1)(b) GDPR.
Legal retention requirements for invoices and financial transactions may additionally apply under Art. 6(1)(c) GDPR.
9. Transactional Emails
We use Brevo to send emails related to the operation of Indest Projects.
These may include, for example:
account verification emails
password reset emails
account-related notifications
important service communications
For this purpose, your email address and information necessary to send the respective communication may be transferred to Brevo.
The legal basis is Art. 6(1)(b) GDPR where the communication is necessary to provide your account or our services.
Brevo states that it maintains GDPR-related security and data-protection measures for information processed through its platform.
10. Newsletter
Users and website visitors can voluntarily subscribe to our newsletter.
When subscribing, we process your:
email address
consent to receive marketing communications
Subscription to the newsletter is voluntary and is not required to create or use an Indest Projects account.
We only send marketing emails where you have given your consent.
The legal basis is Art. 6(1)(a) GDPR.
You may withdraw your consent at any time by using the unsubscribe link included in our marketing emails.
Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.
Our newsletters are sent using Brevo.
11. Contact Form
You may contact us through the contact form available on our website.
When submitting the form, we process:
first name
last name
email address
telephone number
message
We process this information for the purpose of responding to your request.
Where your request relates to a potential or existing contractual relationship, processing is based on Art. 6(1)(b) GDPR.
For other general inquiries, processing may be based on our legitimate interest in responding to communications pursuant to Art. 6(1)(f) GDPR.
12. Account Deletion
Users can delete their Indest Projects account through the application settings.
When an account is deleted, data associated with the account is removed from our active systems. This may include:
account information
projects
uploaded files
project information
tasks and work packages
comments
resource information
other content associated with the account
Certain information may temporarily remain in technical backups until the respective backup is automatically overwritten or deleted as part of our regular backup lifecycle.
We may also retain information where retention is required by applicable law, particularly accounting, tax or legal obligations.
13. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
Account and project data is generally stored for the duration of the user's account or contractual relationship.
After account deletion, data is deleted unless continued storage is required by law or necessary for the establishment, exercise or defence of legal claims.
Payment and accounting information may be retained for longer periods where required by statutory retention obligations.
Newsletter information is retained until consent is withdrawn.
14. International Data Transfers
Some of the service providers we use may process data through subsidiaries, affiliates or subprocessors located outside the European Economic Area.
This may particularly apply to services provided by companies such as Stripe, Brevo or Framer and their respective subprocessors.
Where personal data is transferred outside the European Economic Area, we require appropriate safeguards in accordance with Chapter V GDPR.
Depending on the recipient and destination country, these safeguards may include:
an adequacy decision by the European Commission
Standard Contractual Clauses approved by the European Commission
participation in the EU-U.S. Data Privacy Framework where applicable
additional contractual or technical safeguards
Stripe, for example, currently states that it uses mechanisms including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for applicable international transfers.
15. Disclosure of Personal Data
We do not sell personal data.
Personal data may be shared with service providers where this is necessary to operate Indest Projects or our website.
Our current key service providers include:
ProviderPurposeIONOSApplication hosting and file storageFramerWebsite hosting and website analyticsBrevoTransactional emails and newslettersStripeSubscription and payment processing
Where required under the GDPR, appropriate data processing agreements are concluded with service providers processing personal data on our behalf.
16. Legal Bases for Processing
Depending on the purpose of processing, we primarily rely on the following legal bases under the GDPR:
Art. 6(1)(a) GDPR — Consent
For example, when you voluntarily subscribe to our newsletter.
Art. 6(1)(b) GDPR — Contractual necessity
For example, when creating an account, using Indest Projects or paying for a subscription.
Art. 6(1)(c) GDPR — Legal obligation
For example, where financial or accounting information must be retained under applicable law.
Art. 6(1)(f) GDPR — Legitimate interests
For example, where processing is necessary to securely operate our website and services, prevent abuse or respond to general inquiries.
17. Your Rights
Under the GDPR, you may have the right to:
request access to your personal data
request correction of inaccurate personal data
request deletion of your personal data
request restriction of processing
object to certain processing activities
request data portability
withdraw consent at any time where processing is based on consent
lodge a complaint with a competent data protection supervisory authority
To exercise your rights, contact:
We may need to verify your identity before responding to certain requests.
18. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
You may contact the supervisory authority responsible for your place of residence, place of work or the location of the alleged infringement.
The competent supervisory authority for Indest Group GmbH will depend on the company's registered address.
19. Data Security
We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure or destruction.
Access to personal data is limited to persons and service providers who require access for legitimate operational purposes.
20. Changes to This Privacy Policy
We may update this Privacy Policy if our services, data processing activities or legal requirements change.
The latest version will always be available on our website.
The date of the latest revision is shown at the top of this Privacy Policy.
21. Contact
For questions regarding this Privacy Policy or the processing of personal data, please contact:
Pixelwave-Consulting GmbH
Beekefeld 8
31559, Haste
Germany
Email: support@indest-projects.com
