Data Privacy Statement

Last updated: July 21, 2026

1. Overview

Protecting your personal data matters to us. This statement explains what data we process when you visit this website or use our newsletter, why we process it, and what rights you have in connection with that processing.

2. Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Barbara Hoisl
Exponential Strategy Labs
Usedomstr. 15
70439 Stuttgart
Germany

Email: info@exponentialstrategy.eu
Phone: +49 711 30584537
VAT ID / Umsatzsteuer-ID: DE265505648

3. Your Rights as a Data Subject

You have the following rights regarding the processing of your personal data:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw any consent given, at any time, with future effect (Art. 7(3) GDPR)

To exercise any of these rights, please contact us using the details in Section 2.

You also have the right to lodge a complaint with a data protection supervisory authority. This is generally the authority in your habitual place of residence, or the authority responsible for us, the Data Protection and Freedom of Information Commissioner of Baden-Württemberg (LfDI Baden-Württemberg). Current contact details are available at www.baden-wuerttemberg.datenschutz.de.

4. Hosting with Ghost (Ghost Pro)

This website is hosted by:

Ghost Foundation
160 Robinson Road
# 14-04 SBF Center
Singapore, 068914

Ghost states that data arising from the operation of this website is stored within the EU. In limited circumstances, such as support and maintenance work, access may occur from outside the EU as well, given that Ghost operates with an internationally distributed team. Ghost states that such access is subject to safeguards intended to ensure a level of protection equivalent to the GDPR (including the European Commission's Standard Contractual Clauses). See Ghost's GDPR compliance page for their own account of this.

A data processing agreement is in place with Ghost (available at ghost.org/dpa), incorporated automatically upon acceptance of their terms of service.

Beyond storage itself, Ghost engages further technical service providers to operate the platform. Ghost support has confirmed that Fastly, Inc. (USA), Ghost's content delivery network, processes visitor IP addresses to serve this site, and that Google Cloud (global infrastructure) underlies Ghost's hosting, meaning visitor data passes through Google's servers as well.

For Ghost's own complete subprocessor documentation, covering all of Ghost's vendor relationships across its business, not only those relevant to this site, see Annex A and Annex B.

5. Server Log Files

When you visit this website, Ghost, our hosting provider, automatically collects information in server log files that your browser transmits. This includes:

IP address
Date and time of the request
Browser type and version, operating system used
The page requested, and where applicable the referring URL

This data is used to technically operate and secure the website (for example, to detect misuse) and is not combined with other data sources. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).

6. Contacting Us

If you contact us by email, the information you provide (such as name, email address, and message content) is stored and processed in order to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR where the inquiry concerns pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries, and in being able to demonstrate afterward that a matter was resolved).

7. Ghost Portal and Site Search

The sign-up functionality (newsletter subscription, membership area) and the search function on this site are technically implemented using Ghost's own "Portal" and search modules. The associated scripts are automatically loaded from a content delivery network (cdn.jsdelivr.net, operated by Volentio JSD Limited, a company registered in the United Kingdom; see their privacy policy), which transmits your IP address to that provider's servers. This is a technical component that Ghost loads automatically as part of its core functionality.

When you actively log in or subscribe, a technically necessary cookie is set (see Section 12).

When you sign up on this website, whether to subscribe to our newsletter or otherwise, Ghost creates a member account for you. Membership on this site is currently free; no paid tiers are offered.

We use a double opt-in process: after signing up, you receive a confirmation email, and you're only added as a member once you click the link it contains. This confirms that the sign-up genuinely came from the owner of the email address provided.

As part of sign-up, we process your email address and your name, along with the time of sign-up and confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can withdraw your consent at any time with future effect, for example via the unsubscribe link included in every newsletter email. Unsubscribing stops future newsletter emails immediately. You may request erasure of your data at any time (see Section 3 above).

9. Delivery via Mailgun

The technical delivery of our newsletter runs through our hosting provider Ghost's infrastructure, which uses the email service Mailgun (Sinch Inc., USA) as a subprocessor for this purpose. This means your email address is transmitted to Mailgun. As Mailgun is a US company, this transfer relies on the European Commission's Standard Contractual Clauses, which Mailgun states it uses as its safeguard.

We track whether and which links in our newsletter emails are opened or clicked. This works by loading a small, invisible image (tracking pixel) when the email is opened, and by tracking link clicks via a redirect through Mailgun. The legal basis is your consent given at newsletter sign-up (Art. 6(1)(a) GDPR). You can object to this tracking at any time by unsubscribing from the newsletter.

11. File Downloads

Some downloadable files (such as our program brochure) are provided not through Ghost directly, but via our provider Tralios.de. When you download such a file, your IP address is processed on Tralios's servers. Tralios anonymizes IP addresses in its log files, and processing takes place entirely within the EU (Tralios and its own subprocessors are based in Germany and the Netherlands). A data processing agreement under Art. 28 GDPR is in place with Tralios.

12. Cookies

This website uses one technically necessary cookie, which is only set when you actively subscribe to the newsletter or log in to the membership area. This cookie is required to provide the functionality you've actively requested and is used without consent under §25(2) No. 2 TDDDG (the German law implementing the ePrivacy Directive's cookie rules). No other cookies are used, in particular no analytics or marketing cookies.

13. Overview of Data Processors

Provider	Purpose	Location	Data Processing Agreement
Ghost Foundation Ltd	Hosting, technical operation	EU (storage), registered in Singapore	Yes, incorporated automatically via terms of service
Fastly, Inc.	Content delivery network, as a subprocessor of Ghost	USA	Covered through the agreement between Ghost and Fastly
Google Cloud	Hosting infrastructure, as a subprocessor of Ghost	Global (region not fixed, per Ghost)	Covered through the agreement between Ghost and Google
Mailgun (Sinch Inc.)	Newsletter delivery, as a subprocessor of Ghost	USA	Covered through the agreement between Ghost and Mailgun
Tralios.de	File downloads	Germany	Yes

14. Retention

Unless stated otherwise in this policy, personal data is retained only as long as necessary for the relevant processing purpose, or until you exercise an applicable right to erasure or withdrawal. Statutory retention obligations remain unaffected.

15. Changes to This Statement

We reserve the right to amend this statement to reflect changes in the law or in the website and services we use. The version current at the time of your visit applies.