Privacy policy
Privacy policy
Last Updated: May 2026
Last Updated: May 2026
1. Introduction
This website is operated by Tim Cross, scaling.studio.
We sell performance marketing services and talk a lot about clean measurement. It would be hypocritical if we didn't take it seriously on our own site. So, here it is as clearly as possible: what we collect, why, on what basis — and what you can do about it.
2. Who is responsible
The controller within the meaning of the GDPR is:
Tim Cross
scaling.studio
Lausicker Straße 65
04299 Leipzig
Email: hello@scaling.studio
Phone: +49 176 21984914
We have not appointed a data protection officer because the legal requirements for doing so do not apply to us. For any questions regarding data protection, please contact the address above directly.
3. A few terms beforehand
Personal data is any information through which you can be identified. This starts with your name and email address, but also includes the IP address of the device you are currently reading this on.
Processing is practically everything that happens to this data: collecting, storing, sharing, deleting. The exact definitions can be found in Art. 4 GDPR.
For us, the GDPR, the BDSG and — for everything concerning cookies and access to your device — the TDDDG are decisive.
4. On what basis we process data
Every processing activity needs a legal basis. In our case, four are relevant:
Consent (Art. 6 para. 1 lit. a GDPR): You actively agreed. You can withdraw this at any time.
Contract and pre-contractual measures (lit. b): You booked an initial consultation or sent an inquiry.
Legal obligation (lit. c): e.g., retention periods under tax law.
Legitimate interest (lit. f): for example, the secure operation of the website.
For each item below, we specify which of these applies.
5. Sharing and deletion
We only share data if there is a legal basis and it cannot be avoided. Where service providers process data for us, we have concluded a data processing agreement in accordance with Art. 28 GDPR.
We delete your data as soon as the purpose no longer applies and no statutory retention period prevents deletion.
You have comprehensive rights — access, rectification, deletion, objection, complaint. What this means in detail is explained in Section 10.
6. Encryption
This website uses SSL or TLS encryption. You can recognize this by the https:// in the address bar and the lock icon in the browser. What you enter here cannot be read by third parties during transmission.
7. Hosting and Website Builder
This website is hosted by Framer and created with Framer.
Provider: Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands Privacy Policy: https://www.framer.com/legal/privacy-statement/
Framer processes all data generated when visiting the website on our behalf — in particular server log files and content you enter into forms. Framer is located in the Netherlands, so processing takes place within the EU. We have concluded a data processing agreement with Framer.
The legal basis is Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in providing our website securely, quickly, and reliably.
Fonts: Framer delivers the fonts used via its own infrastructure. No connection is made to Google servers.
8. What happens automatically when you visit the website
Server Log Files
When you access the site, the following information is automatically stored:
Browser type and browser version
Operating system
Referrer URL, i.e., the page you came from
Host name of the accessing computer
Time of the request
IP address
We need this data to deliver the website in the first place, to keep it stable and secure, and to troubleshoot. It is not merged with other data and is deleted once the purpose is achieved. Storage takes place with our host Framer.
The legal basis is Art. 6 para. 1 lit. f GDPR.
Cookies
This website currently only uses strictly necessary cookies so that the site works. We do not currently use cookies for statistical or advertising purposes.
Depending on the individual case, the legal basis is Art. 6 para. 1 lit. b, c, or f GDPR. You can manage and delete cookies at any time in your browser settings.
9. When you enter information yourself
Contact Form
Via our form, we process your name, email address, and website or shop URL, as well as — optionally — information on planned advertising budget, active channels, and your request.
We use this data solely to process your inquiry and prepare for a call. The form is provided via Framer, and entries are forwarded to our email address.
The legal basis is Art. 6 para. 1 lit. b GDPR, as far as initiating a partnership is concerned, otherwise Art. 6 para. 1 lit. f GDPR — we have a legitimate interest in answering inquiries.
We delete this data as soon as your inquiry is resolved and no legal retention period applies. If no partnership is established, after six months at the latest.
When you write to us, we process your email address and everything contained in the message. This data is stored on the mail server and on our devices. The legal basis is Art. 6 para. 1 lit. b or lit. f GDPR, depending on the request.
We run our mailbox via Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). A data processing agreement is in place. Transfer to the US cannot be excluded; Google LLC is certified under the EU-U.S. Data Privacy Framework and additionally uses Standard Contractual Clauses in accordance with Art. 46 para. 2 lit. c GDPR.
Booking Appointments
To book the initial consultation, we use Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
The details you provide during booking, as well as the date and time of the appointment, are processed. We use this to plan, conduct, and follow up on the call.
The legal basis is Art. 6 para. 1 lit. b GDPR.
Video Calls
We usually conduct initial consultations via Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). During this process, the contents of the conversation, connection metadata, and technical information are processed. We do not record calls unless you explicitly agree in individual cases.
The legal basis is Art. 6 para. 1 lit. b GDPR.
10. Your rights in detail
Access (Art. 15 GDPR) — You can find out whether and which data we process about you, for what purpose, for how long, and to whom we share it.
Rectification (Art. 16 GDPR) — You must be able to have incorrect data corrected and incomplete data completed.
Erasure (Art. 17 GDPR) — If the purpose no longer applies, you withdraw consent, or the processing was without a legal basis from the start, we will delete your data.
Restriction of processing (Art. 18 GDPR) — Under certain conditions, you can request that we keep data but no longer use it.
Data portability (Art. 20 GDPR) — You will receive data that we process based on consent or a contract in a common, machine-readable format — or we will transfer it directly to another controller, where technically feasible.
Objection (Art. 21 GDPR) — You can object to processing based on legitimate interests. You can object to direct marketing at any time and without giving reasons.
Withdrawal of consent (Art. 7 para. 3 GDPR) — You can withdraw any consent given at any time with future effect. What happened up to that point remains lawful.
No automated individual decision-making (Art. 22 GDPR) — We do not make decisions about you that are based solely on automated processing.
Complaint (Art. 77 GDPR) — You can complain to a supervisory authority. The authority responsible for us is:
The Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden
For all concerns, you can also contact us directly: hello@scaling.studio
11. Changes to this Privacy Policy
Status of this Privacy Policy: [Date you publish it].
If legal requirements change or we introduce new services, we will adapt this policy. The current version can always be found here.
1. Introduction
This website is operated by Tim Cross, scaling.studio.
We sell performance marketing services and talk a lot about clean measurement. It would be hypocritical if we didn't take it seriously on our own site. So, here it is as clearly as possible: what we collect, why, on what basis — and what you can do about it.
2. Who is responsible
The controller within the meaning of the GDPR is:
Tim Cross
scaling.studio
Lausicker Straße 65
04299 Leipzig
Email: hello@scaling.studio
Phone: +49 176 21984914
We have not appointed a data protection officer because the legal requirements for doing so do not apply to us. For any questions regarding data protection, please contact the address above directly.
3. A few terms beforehand
Personal data is any information through which you can be identified. This starts with your name and email address, but also includes the IP address of the device you are currently reading this on.
Processing is practically everything that happens to this data: collecting, storing, sharing, deleting. The exact definitions can be found in Art. 4 GDPR.
For us, the GDPR, the BDSG and — for everything concerning cookies and access to your device — the TDDDG are decisive.
4. On what basis we process data
Every processing activity needs a legal basis. In our case, four are relevant:
Consent (Art. 6 para. 1 lit. a GDPR): You actively agreed. You can withdraw this at any time.
Contract and pre-contractual measures (lit. b): You booked an initial consultation or sent an inquiry.
Legal obligation (lit. c): e.g., retention periods under tax law.
Legitimate interest (lit. f): for example, the secure operation of the website.
For each item below, we specify which of these applies.
5. Sharing and deletion
We only share data if there is a legal basis and it cannot be avoided. Where service providers process data for us, we have concluded a data processing agreement in accordance with Art. 28 GDPR.
We delete your data as soon as the purpose no longer applies and no statutory retention period prevents deletion.
You have comprehensive rights — access, rectification, deletion, objection, complaint. What this means in detail is explained in Section 10.
6. Encryption
This website uses SSL or TLS encryption. You can recognize this by the https:// in the address bar and the lock icon in the browser. What you enter here cannot be read by third parties during transmission.
7. Hosting and Website Builder
This website is hosted by Framer and created with Framer.
Provider: Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands Privacy Policy: https://www.framer.com/legal/privacy-statement/
Framer processes all data generated when visiting the website on our behalf — in particular server log files and content you enter into forms. Framer is located in the Netherlands, so processing takes place within the EU. We have concluded a data processing agreement with Framer.
The legal basis is Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in providing our website securely, quickly, and reliably.
Fonts: Framer delivers the fonts used via its own infrastructure. No connection is made to Google servers.
8. What happens automatically when you visit the website
Server Log Files
When you access the site, the following information is automatically stored:
Browser type and browser version
Operating system
Referrer URL, i.e., the page you came from
Host name of the accessing computer
Time of the request
IP address
We need this data to deliver the website in the first place, to keep it stable and secure, and to troubleshoot. It is not merged with other data and is deleted once the purpose is achieved. Storage takes place with our host Framer.
The legal basis is Art. 6 para. 1 lit. f GDPR.
Cookies
This website currently only uses strictly necessary cookies so that the site works. We do not currently use cookies for statistical or advertising purposes.
Depending on the individual case, the legal basis is Art. 6 para. 1 lit. b, c, or f GDPR. You can manage and delete cookies at any time in your browser settings.
9. When you enter information yourself
Contact Form
Via our form, we process your name, email address, and website or shop URL, as well as — optionally — information on planned advertising budget, active channels, and your request.
We use this data solely to process your inquiry and prepare for a call. The form is provided via Framer, and entries are forwarded to our email address.
The legal basis is Art. 6 para. 1 lit. b GDPR, as far as initiating a partnership is concerned, otherwise Art. 6 para. 1 lit. f GDPR — we have a legitimate interest in answering inquiries.
We delete this data as soon as your inquiry is resolved and no legal retention period applies. If no partnership is established, after six months at the latest.
When you write to us, we process your email address and everything contained in the message. This data is stored on the mail server and on our devices. The legal basis is Art. 6 para. 1 lit. b or lit. f GDPR, depending on the request.
We run our mailbox via Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). A data processing agreement is in place. Transfer to the US cannot be excluded; Google LLC is certified under the EU-U.S. Data Privacy Framework and additionally uses Standard Contractual Clauses in accordance with Art. 46 para. 2 lit. c GDPR.
Booking Appointments
To book the initial consultation, we use Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
The details you provide during booking, as well as the date and time of the appointment, are processed. We use this to plan, conduct, and follow up on the call.
The legal basis is Art. 6 para. 1 lit. b GDPR.
Video Calls
We usually conduct initial consultations via Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). During this process, the contents of the conversation, connection metadata, and technical information are processed. We do not record calls unless you explicitly agree in individual cases.
The legal basis is Art. 6 para. 1 lit. b GDPR.
10. Your rights in detail
Access (Art. 15 GDPR) — You can find out whether and which data we process about you, for what purpose, for how long, and to whom we share it.
Rectification (Art. 16 GDPR) — You must be able to have incorrect data corrected and incomplete data completed.
Erasure (Art. 17 GDPR) — If the purpose no longer applies, you withdraw consent, or the processing was without a legal basis from the start, we will delete your data.
Restriction of processing (Art. 18 GDPR) — Under certain conditions, you can request that we keep data but no longer use it.
Data portability (Art. 20 GDPR) — You will receive data that we process based on consent or a contract in a common, machine-readable format — or we will transfer it directly to another controller, where technically feasible.
Objection (Art. 21 GDPR) — You can object to processing based on legitimate interests. You can object to direct marketing at any time and without giving reasons.
Withdrawal of consent (Art. 7 para. 3 GDPR) — You can withdraw any consent given at any time with future effect. What happened up to that point remains lawful.
No automated individual decision-making (Art. 22 GDPR) — We do not make decisions about you that are based solely on automated processing.
Complaint (Art. 77 GDPR) — You can complain to a supervisory authority. The authority responsible for us is:
The Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden
For all concerns, you can also contact us directly: hello@scaling.studio
11. Changes to this Privacy Policy
Status of this Privacy Policy: [Date you publish it].
If legal requirements change or we introduce new services, we will adapt this policy. The current version can always be found here.
