Privacy Policy
Last updated: August 2026
1. Data Controller
The data controller responsible for data processing on this website is:
Patterno GmbH
Jungfrauenthal 8
20149 Hamburg
Germany
Email: info@patterno.de
2. Overview of Data Processing
Patterno is a platform for public tenders. We only process personal data to the extent necessary to provide our services.
Data we collect:
- Account data: Email address, name, password (encrypted)
- Company data: Company name, address (optional)
- Contact data from forms: Email address, phone number (voluntary)
- Usage data: Search profiles, saved tenders
- Technical data: IP address, browser type (for security)
3. Legal Basis
We process your data on the following legal bases:
- Contract fulfillment (Art. 6 para. 1 lit. b GDPR): Registration, login, tender search, search profiles
- Consent (Art. 6 para. 1 lit. a GDPR): Newsletter, sending requested tenders, contact by phone
- Legitimate interest (Art. 6 para. 1 lit. f GDPR): Security logging, fraud prevention
4. Recipients and Service Providers
We use the following service providers to deliver our services:
Google Cloud Platform (Hosting)
Our servers are located in Germany (Frankfurt am Main, europe-west3).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Supabase (Authentication)
We use Supabase for secure login.
Processed data: Email address, encrypted password.
Provider: Supabase Inc., USA (EU Standard Contractual Clauses).
Google Gemini (AI Search)
We use Google Gemini for semantic search.
Only tender texts are processed, no personal data.
Provider: Google Ireland Limited.
Google Workspace (Email)
We use Google Workspace for newsletter delivery.
Processed data: Email address.
Provider: Google Ireland Limited.
Resend (Transactional Email)
We use Resend for confirmation emails, for example to confirm a tender alert.
Processed data: Email address, content of the confirmation email.
Provider: Resend, Inc., USA (EU Standard Contractual Clauses).
Slack (Internal Notification)
Requests from our forms trigger an internal notification in Slack so our team can act on them.
Processed data: Email address, selected topic, timestamp and, when an alert is confirmed, the IP address as evidence of consent.
Provider: Slack Technologies Limited, Ireland (Salesforce group, EU Standard Contractual Clauses).
Cloudflare Turnstile (Spam Protection)
We use Cloudflare Turnstile to protect our forms against automated submissions.
Processed data: IP address, browser information. No advertising cookies are set.
Provider: Cloudflare, Inc., USA (EU Standard Contractual Clauses).
The legal basis is our legitimate interest in preventing abuse (Art. 6 para. 1 lit. f GDPR).
5. Data Transfer to Third Countries
Some of our service providers are based in the USA. Data transfer is based on EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR), which ensure an adequate level of data protection.
6. Storage Duration
- Account data: Until deletion of your account
- Search profiles & saved tenders: Until deleted by you or your account
- Security logs: 365 days
- Newsletter & alerts after unsubscription: Removed from the list immediately, fully deleted within 14 days at the latest
- Unconfirmed alert signups: The confirmation link expires after 7 days; without confirmation no subscription is created
7. Your Rights
You have the following rights regarding your personal data:
- Information (Art. 15 GDPR): You can request information about your stored data.
- Rectification (Art. 16 GDPR): You can have incorrect data corrected.
- Erasure (Art. 17 GDPR): You can request deletion of your data.
- Restriction (Art. 18 GDPR): You can request restriction of processing.
- Data portability (Art. 20 GDPR): You can receive your data in a common format.
- Objection (Art. 21 GDPR): You can object to processing.
- Withdrawal (Art. 7 GDPR): You can withdraw given consent at any time.
To exercise your rights, contact: info@patterno.de
8. Cookies and Tracking Technologies
8.1 Cookie Consent
When you first visit our website, we show you a cookie banner. You can choose between:
- Necessary cookies only, No analytics, no session recordings
- Accept all cookies, Analytics and improvement cookies
- Individual settings, Granular control over each category
You can change your choice at any time via the "Cookie Settings" link in the footer.
As long as you have not consented, no analytics or tracking service is loaded. Google Analytics, Google Tag Manager, Microsoft Clarity, Vercel Analytics, PostHog and Leadfeeder are only requested from their providers after your consent, so your IP address is not transmitted to them beforehand either.
8.2 Necessary Storage
We store the following entries without your consent. They are either required for a function you explicitly requested or they store your cookie decision itself (§ 25 (2) no. 2 TDDDG). No profiles are built and no data is transmitted to third parties.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| patterno-cookie-consent | Local storage | Stores your cookie decision (content: the categories you chose, timestamp, version) | Until you delete it, we ask again after 12 months at the latest |
| marktreport_access | Cookie | Unlocks the market report you requested (content: the digit 1) | 12 months |
| patterno-tender-docs-unlocked | Local storage | Remembers that you unlocked tender documents (content: the digit 1) | Until you clear your browser storage |
| patterno-leadmagnet-state | Local storage | Prevents a notice you closed from reappearing (content: time of closing) | 14 days |
| patterno-leadmagnet-session-dismissed | Session storage | Same as above, for the current session | Session |
| patterno-expert-banner-dismissed | Session storage | Remembers that you closed a notice banner | Session |
8.3 Analytics Cookies (only with your consent)
Our own campaign attribution
| Name | Type | Purpose | Duration |
|---|---|---|---|
| patterno-utm-params | Session storage | Remembers which campaign brought you here (content: the utm parameters from the address you opened, the entry page and the timestamp) | Session |
Without your consent this entry is not stored on your device. The campaign information then only exists in your browser's memory and is lost when you close the tab. If you submit one of our forms during that time, we transmit the campaign information together with your enquiry so that we know what your enquiry relates to.
Google Analytics 4
| Name | Purpose | Duration |
|---|---|---|
| _ga | Distinguishes visitors (content: a random identifier, e.g. GA1.1.227838430.1785855696) | 400 days |
| _ga_CE2Z4ZDKJC | Stores the status of your session (content: session counter and timestamps) | 400 days |
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Analysis of user behavior to improve our website
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR)
Data transfer to USA: Yes, based on the EU-US Data Privacy Framework
More information: https://policies.google.com/privacy
Microsoft Clarity
| Name | Purpose | Duration |
|---|---|---|
| _clck | User ID (content: a random identifier plus the project key) | 1 year |
| _clsk | Session ID (content: session key, timestamp, collection endpoint) | 1 day |
| _cltk | Key of the current recording | Session (session storage) |
| CLID | User ID, set on the clarity.ms domain | 1 year |
| MUID, MR, SRM_B, ANONCHK, SM | Microsoft identifiers, set on the clarity.ms and bing.com domains. Microsoft uses them for recognition and fraud detection across its own services. | Session up to 13 months |
Provider: Microsoft Ireland Operations Limited, One Microsoft Place, Dublin, D18 P521, Ireland
Purpose: Heatmaps and session recordings for UX improvement
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR)
Data transfer to USA: Yes, based on the EU-US Data Privacy Framework
Session recordings: Clarity records anonymized sessions. Form inputs are NOT captured.
More information: https://privacy.microsoft.com
Vercel Analytics
Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA
Purpose: Aggregated visitor statistics (page views, performance)
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR)
Data transfer to USA: Yes, based on Standard Contractual Clauses
More information: https://vercel.com/legal/privacy-policy
Leadfeeder (Dealfront)
| Name | Purpose | Duration |
|---|---|---|
| _lfa | Recognizing a visit in order to attribute it to a company | 1 year |
| _lfa_consent | Stores the consent level that was granted | 1 year |
Provider: Dealfront Group GmbH (Leadfeeder brand), Durlacher Allee 73, 76131 Karlsruhe, Germany
Purpose: Identifying the company from whose network our website is accessed. The IP address is matched against a database of corporate IP ranges. We then see the company name and the pages viewed.
No identification of individuals: No natural persons are identified. Visits from residential and mobile carrier networks are not attributed and are discarded.
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR)
Loading time: The tracker is only loaded after you consent to analytics cookies.
Withdrawal: If you withdraw your consent, the cookies _lfa and _lfa_consent are deleted and collection stops.
Data transfer to USA: No, processing within the EU
More information: https://www.dealfront.com/privacy-policy/
PostHog
| Name | Purpose | Duration |
|---|---|---|
| ph_<project-id>_posthog | Pseudonymous visitor ID, session ID and assigned test variant | 1 year |
Provider: PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA
Purpose: Product analytics and A/B testing. We measure which pages are viewed and which buttons are clicked, and test design variants against each other (for example light versus dark presentation) in order to make the website clearer.
Server location: EU Cloud, data center Frankfurt am Main, Germany (AWS eu-central-1). Data is stored in the EU.
No person profiles: PostHog is configured to create person profiles only for explicitly identified users (person_profiles: identified_only). Website visitors are not identified.
No session recording: Session recording is not enabled.
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR, Sec. 25 para. 1 TTDSG)
Loading time: PostHog is only loaded after you consent to analytics cookies. Without consent no network request is made.
Withdrawal: If you withdraw your consent, the cookie ph_<project-id>_posthog is deleted and collection stops.
Data transfer to USA: Yes. Although storage takes place in Frankfurt, the provider is a US company and may access the data in the course of support and operations. This is based on PostHog, Inc.'s certification under the EU-US Data Privacy Framework and, additionally, the EU Standard Contractual Clauses.
More information: https://posthog.com/privacy
Google Tag Manager
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Management and delivery of tracking and analytics tags on our website. Google Tag Manager itself does not set cookies and does not collect personal data, but enables loading of additional tools (Google Analytics and Google Ads). The Google Ads tags only set cookies if you also consented to the "Marketing" category (see 8.4).
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR)
Loading time: Tag Manager is only loaded after you consent to analytics cookies.
Data transfer to USA: Yes, based on the EU-US Data Privacy Framework
More information: https://policies.google.com/privacy
8.4 Marketing Cookies (only with your consent)
Google Ads conversion tracking
Through Google Tag Manager we embed tags from Google Ads. They measure whether a visit came from one of our ads and make it possible to show ads to previous visitors.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Cookie | Attributes a visit to an ad (content: a random identifier and timestamps) | 90 days |
| _gcl_ls | Local storage | Same purpose as _gcl_au, additionally in browser storage | 90 days |
| test_cookie | Cookie (doubleclick.net) | Checks whether your browser allows cookies | 15 minutes |
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), category "Marketing"
Without your consent: these cookies are not set. Google then only receives a signal without an identifier and without access to your device.
Data transfer to USA: Yes, based on the EU-US Data Privacy Framework
More information: https://policies.google.com/privacy
8.5 Your Rights Regarding Cookies
You can withdraw your consent at any time with effect for the future:
- Click on "Cookie Settings" in the footer
- Disable the desired cookie categories
- Click on "Save Settings"
What happens when you withdraw: we delete the cookies that were set (_ga, _ga_*, _gid, _gcl_au, _clck, _clsk, _lfa, _lfa_consent), signal the withdrawal to the providers and reload the page so that scripts already running are actually terminated. From that point on, no analytics service is requested any more. Data already collected will no longer be used for analysis of your session.
One exception we cannot cover technically: the CLID cookie from Microsoft Clarity sits on the clarity.ms domain and can only be deleted through your browser settings.
9. Newsletter and Tender Requests
When you subscribe to our newsletter or request matching tenders through one of our forms, we use your email address to send them to you. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR).
For tender requests we use the double opt-in procedure: after submitting you first receive only one email containing a confirmation link. We put your tenders together and get in touch only once you click that link. If you do not confirm, we do not contact you and the confirmation link expires after 7 days. As evidence of your consent we store the time of the request, the time of confirmation and the IP address used for it.
Contact by phone: Providing a phone number is voluntary. If you leave a number, we call you once to discuss your search profile so we can send you more relevant tenders. This call also happens only after you confirm via the double opt-in link. The legal basis is your express consent (Art. 6 para. 1 lit. a GDPR, § 7 para. 2 no. 2 UWG). You can withdraw this consent at any time without formality, for example by email or during the call itself.
You can unsubscribe from the newsletter and your alerts at any time via the link in each email, by replying to any of our emails, or in your account settings. We then remove you from the list immediately and delete your data within 14 days at the latest.
10. Right to Complain
You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 7th floor
20459 Hamburg
https://datenschutz-hamburg.de
11. Changes to This Privacy Policy
We reserve the right to adapt this privacy policy as needed to comply with changed legal requirements or changes to our service. The current version can always be found on this page.