Privacy Policy

This is an English translation for information purposes only. The German version is legally binding.

1. Data controller

Pana Agency GbR
Herzogstraße 9, 63263 Neu-Isenburg, Germany
Email: hallo@pana-agency.de
Represented by: Paul Hopson, Natnael Fekade

The controller within the meaning of Art. 4 No. 7 GDPR is the company named above. You can reach us by email or via the contact form at pana-agency.de/kontakt.html. We have not appointed a data protection officer, as the requirements of § 38(1) of the German Federal Data Protection Act (BDSG) do not apply to us. For all questions regarding data protection and exercising your rights, please contact hallo@pana-agency.de.

2. General information

Protecting your personal data is important to us. We process personal data exclusively in accordance with the GDPR and the German Federal Data Protection Act (BDSG). Below, we inform you about the nature, scope and purpose of this processing.

This privacy policy applies to our website pana-agency.de, including the English-language version, to our communication with you by email, and to our forms. We process personal data only to the extent necessary to provide our website and services, to the extent permitted by law, or where you have given your consent.

3. Hosting & server logs

This website is hosted via GitHub Pages, a service of GitHub, Inc. and Microsoft Corporation. When you access the website, the hosting provider processes technically necessary data (e.g. IP address, date and time, page accessed, browser type) in server log files. This processing may also take place on servers outside the EU/EEA. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). More information: docs.github.com/pages.

We ourselves have no access to these log files and do not evaluate them. The retention period is determined by the provider's specifications. Regarding transfers to third countries, see item 14.

4. Fonts

The fonts used on this site (Bebas Neue, Creato Display) are embedded locally as files. This means no connection is made to external font providers (e.g. Google Fonts), and no data is transmitted to third parties for this purpose.

5. Contact form

For the contact form, we use the service Formspree, Inc., USA. The data you enter (including name, email address, company, message) is transmitted to Formspree to process your request and forwarded to us from there. The legal basis is Art. 6(1)(b) and/or (f) GDPR. More information on data protection at Formspree: formspree.io/legal/privacy-policy.

We additionally process the details on company size, budget range, planned timeframe, and relevant platforms, to the extent you fill these in. Required fields are marked as such; without them we cannot process your request. We have concluded a data processing agreement under Art. 28 GDPR with Formspree. Upon receipt, we store the request in our Microsoft 365 environment. We delete the data once your request has been finally processed and the matter fully resolved, at the latest 24 months after the last contact, unless statutory retention obligations (§ 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO)) apply. Regarding transfers to third countries, see item 14.

6. Applications for open positions and speculative applications

If you apply via the application form on our careers page or by email, we process the data submitted in order to carry out the application process and decide on your application. Technically, transmission runs via Formspree, Inc., USA (see item 5).

What data we process
Required fields are your name, email address, the position you are applying for, and a short description of yourself. Optionally, you can provide your phone number, links to your CV and certificates, your degree program and university, your expected graduation date, and your availability. If you apply by email, we additionally process the data contained in your message and any attached documents.

Purpose and legal basis
We process this data to decide whether to establish an employment relationship with you. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26(1) sentence 1 BDSG. Should legal disputes arise in connection with the application process, we process your data to assert, exercise, or defend legal claims on the basis of Art. 6(1)(f) GDPR.

Please do not send us special categories of personal data under Art. 9 GDPR, such as information on health, religion, ethnic origin, or trade union membership. This information is not required for our selection decision. If you nevertheless provide it, we only process it to the extent permitted under § 26(3) BDSG or Art. 9(2)(b) GDPR. An application photo is not required.

Links to external storage locations
You can send us your CV and certificates as a share link to a cloud storage provider of your choice, e.g. Google Drive, Dropbox, or OneDrive. You are responsible for the processing of your data by that provider; its privacy policy applies. We only retrieve the files and store them in your application file. You can deactivate the share link yourself at any time.

Recipients
Access to your application documents is limited to the two managing partners and any persons who must necessarily be involved in the respective application process. The documents are stored in our Microsoft 365 environment operated by Microsoft Ireland Operations Limited (email and file storage). We have concluded data processing agreements under Art. 28 GDPR with the service providers used. Your data is not passed on to any other third parties.

Retention period
If we decide against your application, we delete your data six months after the application process has concluded. This period is based on the deadlines for asserting claims under the German General Equal Treatment Act (§ 15(4) AGG, § 61b(1) ArbGG) plus a reasonable buffer. If an employment relationship is established, we transfer the necessary data to your personnel file.

Inclusion in our talent pool
If we would like to keep you in mind for a future position, we will ask for your separate consent to do so. The legal basis is then Art. 6(1)(a) GDPR. Inclusion is voluntary and has no effect on the current process. In this case, we store your data for twelve months. You can withdraw your consent at any time, informally by email to hallo@pana-agency.de; the lawfulness of processing carried out until the withdrawal remains unaffected.

Voluntariness and automated decisions
Providing your data is neither required by law nor by contract. However, without the information marked as required, we cannot process your application. We make our selection decisions without automated decision-making within the meaning of Art. 22 GDPR. Applications are not pre-sorted, evaluated, or rejected by us using an AI system.

7. Applications from creators

For creator applications, we use Microsoft Forms, a service of Microsoft Ireland Operations Limited. The data entered there, including name, email address, social media channels, and message, is processed on Microsoft's servers and made available to us to process your request. The legal basis is Art. 6(1)(b) GDPR. In addition, we compare the publicly available profile data you provide to assess the fit with our network.

If we accept you into our creator network, we store your data for the duration of the collaboration and beyond, to the extent statutory retention obligations apply. Otherwise, we delete it no later than twelve months after receiving your request. More information on data protection at Microsoft: privacy.microsoft.com.

8. Contact by email

If you contact us directly by email, we process the data transmitted to handle your request. The legal basis is Art. 6(1)(b) and/or (f) GDPR. The data is deleted as soon as it is no longer required.

We operate our email accounts via Microsoft 365. An unencrypted email can be read by third parties in transit. For confidential content, please use a different channel or ask us about encrypted transmission.

9. Business contacts and direct outreach

We process the contact details of contacts at companies with whom we work or would like to initiate a collaboration. This typically includes first and last name, business email address, role, company affiliation, and other publicly available professional information.

Where a business relationship already exists or we are in contact following your inquiry, the legal basis is Art. 6(1)(b) GDPR. Where we contact you for the first time without an existing business relationship, we base the processing on our legitimate interest in approaching potential business partners in a professional context (Art. 6(1)(f) GDPR).

Source of the data (Art. 14 GDPR)
If we do not receive your data directly from you, it originates from publicly accessible professional sources. These are in particular professional networks such as LinkedIn, your employer's website, and trade and industry publications. In some cases, we use service providers who compile such publicly accessible information in a structured way and make it available to us.

Retention period and objection
We store the data for as long as there is an interest in maintaining contact, for a maximum of 24 months after the last contact. You can object to this processing at any time, informally by email to hallo@pana-agency.de or via the unsubscribe link in our message. After an objection, we only process your contact details on a suppression list, so that we do not contact you again.

10. Cookies and consent management

Cookies are small text files stored on your device. Comparable technologies such as local storage work similarly. We distinguish two categories:

On your first visit to our website, we ask you via a notice whether you consent to reach measurement. You can choose equally between "Essential only" and "Accept all"; both options are reachable with a single click on the same level. As long as you have not consented, no analytics cookies are set and no data is transmitted to Google.

We store your decision together with the time and the version of the notice text, so that we can demonstrate it. You can change your selection at any time with future effect, or withdraw it entirely, via the "Cookie settings" link in the footer of every page. The lawfulness of processing carried out until the withdrawal remains unaffected. We will ask you again at the latest after twelve months, or if the services we use change.

11. Web analytics with Google Analytics

With your consent, we use Google Analytics on this website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies that allow an analysis of your use of the website, e.g. pages visited, time spent, and the origin of visits.

In particular, a pseudonymous user identifier, the shortened IP address, date and time of access, the pages accessed, an approximate location at city or region level, device type, browser, operating system, and the origin of the access are processed. We use these evaluations exclusively in aggregated form to improve our offering. We do not combine this data with other data or identify individual persons.

These cookies are only set if you have given your consent via the cookie banner on your first visit. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time with future effect via the "Cookie settings" link in the footer of this site.

The cookies _ga and _ga_<container ID> are used, each with a lifespan of up to 24 months. We have concluded a data processing agreement under Art. 28 GDPR with Google. The retention period in Google Analytics is 2 months for event data and 14 months for user data. We have disabled Google Signals and the collection of advertising IDs; your data is not used for advertising purposes.

We have enabled IP anonymization: your IP address is shortened by Google within the EU/EEA before being transmitted to Google servers in the US in exceptional cases. Where data is transmitted to Google LLC in the US in this context, we base this on the European Commission's adequacy decision on the EU-US Data Privacy Framework under Art. 45 GDPR, and additionally on the standard contractual clauses under Art. 46(2)(c) GDPR. More details in item 14. More information on Google Analytics and data protection at Google: policies.google.com/privacy.

Regardless of withdrawal via the cookie settings, you can also prevent data collection by Google Analytics using the browser add-on provided by Google: tools.google.com/dlpage/gaoptout.

12. Social media

On our website, we link to our Instagram profile. These are simple links. As long as you do not click the link, no content is loaded from Instagram and no data is transmitted to Meta.

If you visit our Instagram profile, Meta Platforms Ireland Limited processes your data under its own responsibility, in accordance with the terms applicable there. Where Meta provides us with aggregated statistics on the use of our profile, we are jointly responsible with Meta for this (Art. 26 GDPR). We have no influence on the nature, scope, or retention period of this processing. The legal basis for our presence is our legitimate interest in public visibility and reach (Art. 6(1)(f) GDPR). Information from Meta is available at privacycenter.instagram.com.

13. Recipients and data processing

We only share personal data to the extent necessary for the purposes named. Inquiries and applications reach us by email and are stored in our Microsoft 365 environment. Current recipients are:

We have data processing agreements under Art. 28 GDPR with these service providers, to the extent they act on our instructions. Beyond this, we share data where we are legally required to do so, for example towards tax authorities, or where necessary to assert, exercise, or defend legal claims. We do not sell your data.

14. Transfers to third countries

Some of the service providers we use are based in the US or process data on servers outside the EU and EEA. We base such transfers on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), to the extent the respective provider is certified under this framework. Otherwise, we base them on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), including supplementary safeguards.

Even with these safeguards, access by US authorities cannot be ruled out with absolute certainty. You can request a copy of the respective safeguards from us.

15. Retention period

We store personal data only for as long as necessary for the respective purpose. The specific periods can be found under the respective processing activity in items 3 to 12. Beyond this, we store data to the extent commercial and tax law retention obligations apply, in particular under § 257 HGB and § 147 AO. After the respective period expires, we delete the data or restrict its processing.

16. Data security

This website is delivered via an encrypted connection (TLS). You can recognize this by the lock symbol in your browser and the address starting with https://. In addition, we take appropriate technical and organizational measures under Art. 32 GDPR to protect your data against loss, manipulation, and unauthorized access. Access to personal data is restricted to those who need it for their respective task.

17. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. This applies explicitly to application processes and to the selection of creators as well.

18. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. In detail: access to the data stored about you (Art. 15 GDPR), rectification of inaccurate data (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection (Art. 21 GDPR). Where we base processing on your consent, you can withdraw it at any time with future effect (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority. To exercise these rights, please contact hallo@pana-agency.de.

The supervisory authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de. You may, however, also contact the supervisory authority at your place of residence or work.

19. Right to object under Art. 21 GDPR

You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data carried out on the basis of a legitimate interest under Art. 6(1)(f) GDPR. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If your data is processed for direct marketing purposes, you have the right to object at any time, without giving reasons, to this processing. Following such an objection, we will no longer use your data for direct marketing.

An informal message to hallo@pana-agency.de is sufficient for the objection.

20. Changes to this privacy policy

We update this privacy policy as soon as our website, the services we use, or the legal requirements change. The version available on this page always applies.

Last updated: August 2026