Privacy policy
What data OwnerSpec collects, why, on what legal basis, who receives it, and how to exercise your rights under the GDPR.
This policy explains what happens to personal data when you visit ownerspec.com. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who is responsible
The controller for the processing described here is:
VoyageHacks (Einzelunternehmen (Kleinunternehmer, Sec. 19 UStG))
Germany
Email: [email protected]
2. What we collect, and why
2.1 Data processed automatically when you visit
Our host, Cloudflare, processes technical data needed to deliver the page and to protect the site: your IP address, the requested URL, the referring URL, your user agent, and the country your request came from. Cloudflare acts as our processor for hosting and as an independent controller for its own network security purposes.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in delivering a working, secure website. Retention: Cloudflare’s standard log retention applies; we do not maintain our own server logs.
We also derive your country from Cloudflare’s edge in order to show the right consent interface. That happens in your browser and the result is held in your browser’s session storage only.
2.2 Analytics, only with your consent
If you consent, we load:
| Service | Provider | Purpose | Transfer |
|---|---|---|---|
| Google Analytics 4 | Google Ireland Ltd / Google LLC | Aggregate traffic and page performance measurement | United States |
| Microsoft Clarity | Microsoft Ireland Operations Ltd / Microsoft Corp | Aggregate behaviour analysis, heatmaps and session replay | United States |
Session replay in Clarity records mouse movement, scrolling and clicks. It does not record keystrokes in form fields, and we do not operate any login or payment flow on this site.
Legal basis: Art. 6(1)(a) GDPR, your consent, together with the national laws implementing Art. 5(3) of the ePrivacy Directive for the storage of and access to information on your device. Retention: GA4 retains event data for 14 months; Clarity retains data for up to 30 days by default and up to 13 months for aggregated metrics.
Nothing in this table is loaded, and no cookie from it is set, before you have consented. Advertising and remarketing signals are switched off permanently in our Google configuration.
2.3 Consent record
When you accept or reject, we store your choice, the date, and the version of this policy in your browser’s local storage. We also send an anonymous counter (accepted / rejected / auto, with no identifier of any kind) to our own edge so that we can report an aggregate acceptance rate. Legal basis: Art. 6(1)(c) GDPR, our obligation to be able to demonstrate consent, and Art. 6(1)(f) for the aggregate counter.
2.4 If you contact us
If you email us or use the contact form, we process the details you supply in order to answer. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in responding to enquiries, or Art. 6(1)(b) where your message concerns a contract. Retention: up to 24 months after the correspondence ends, unless a longer period is legally required.
3. Affiliate links
Some outbound links carry a tracking parameter identifying OwnerSpec as the referrer. If you follow one, the merchant (for example Amazon) sets its own cookies under its own privacy policy and becomes the controller for what happens next. We receive only aggregated, non-identifying commission reports: we never learn who you are or what you bought as an individual. See our affiliate disclosure.
4. Transfers outside the EEA
Google and Microsoft process data in the United States. Both are certified under the EU-US Data Privacy Framework, and we additionally rely on the European Commission’s Standard Contractual Clauses. You can find each provider’s transfer terms in its own privacy documentation. If you do not want your data transferred on this basis, reject analytics: the site works identically without them.
5. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)). Use the “Cookie settings” link in the footer of any page.
To exercise any of these, contact us using the details in section 1. We answer within one month.
You also have the right to lodge a complaint with a supervisory authority, in the EU member state of your residence, place of work, or where you believe an infringement occurred. A list of authorities is published at edpb.europa.eu. In the UK, the supervisory authority is the ICO.
6. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you.
7. Children
This site is not directed at children under 16 and we do not knowingly collect their data.
8. Changes
We update this policy when our processing changes. Material changes bump the consent version, which resets every stored choice and asks again.
Last updated: 11 September 2026.