Pearlixa
Talk to us

Privacy policy

Last updated: 06.10.2026

This policy explains which personal data pearlixa.com processes, why, and what rights you have. It covers the website. Data that enterprise customers process through the Pearlixa service is governed by their contract and data processing agreement with us (see section 7).

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Tarik Turhan
Meisenweg 3
73249 Wernau (Neckar)
Germany
Email: privacy@pearlixa.com

A data protection officer is not required for our processing activities. Questions about this policy and requests to exercise your rights go to the address above.

2. Visiting the website

When you open pearlixa.com, your browser sends technical data to our servers: IP address, date and time of the request, the page requested, the referring page, browser type and version, and operating system. We process this data to deliver the website, to keep it secure and to find errors.

  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable delivery of the website.
  • Retention: server and security logs are kept for up to 12 months and then deleted.

The website is hosted by Amazon Web Services (AWS) in the European Union (eu-central-1, Frankfurt) and delivered through the AWS CloudFront network, which may serve pages from locations close to you.

3. Contact form and email

When you use the contact form or write to us, we process the data you provide: name, work email, company, and optionally website, role, firm type, company size, your message, and a preferred date and time for a call. We use it only to answer your request and, if you ask for one, to arrange a call.

  • Legal basis: Art. 6(1)(b) GDPR where your request concerns a possible contract with us; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.
  • Retention: enquiries are kept for up to 3 years after the conversation ends, unless a contract follows, in which case the statutory retention periods for business correspondence apply (up to 6 years under § 257 HGB, up to 10 years under § 147 AO).
  • Email delivery: messages are sent and received through Amazon Simple Email Service (AWS SES) in the European Union (eu-west-1, Ireland).

We do not add contact form data to a newsletter or mailing list.

4. Cookies and analytics

Necessary storage. To remember your cookie choice, pearlixa.com stores it in your browser. This is technically necessary and needs no consent (§ 25(2) No. 2 TDDDG). The choice is kept for 12 months.

Google Analytics. With your consent, we use Google Analytics 4 to understand how the website is used: which pages are visited, how visitors arrive and how long they stay. Google Analytics sets the cookies _ga and _ga_*, which expire after two years at most. In Google Analytics, event data and user-level data are kept for 14 months and then deleted automatically. Analytics runs only after you select "Accept" in the cookie banner; until then, no analytics cookies are set and no data is sent to Google.

  • Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.
  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States; this transfer is based on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
  • No advertising: analytics data is not used for advertising, and we do not use advertising or retargeting cookies.
  • Withdrawal: you can withdraw your consent at any time through "Cookie settings" in the footer of every page. Withdrawal does not affect the lawfulness of processing before it.

5. Recipients

Personal data is passed only to the service providers named above (AWS for hosting, delivery and email; Google for analytics, with your consent), which act as processors under a data processing agreement (Art. 28 GDPR), and to authorities where we are legally required to. We do not sell personal data.

6. Transfers outside the EU/EEA

Our hosting and email run in the European Union. Where a provider processes data outside the EU/EEA, for example through the global CloudFront network or AWS group companies, the transfer is based on an adequacy decision (such as the EU–US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

7. Enterprise customers

When an enterprise customer sends us data to analyse, for example the positions of a portfolio, we process it on the customer's behalf and under its instructions. In that case the customer is the controller and Pearlixa acts as processor. The details are set out in the data processing agreement that is part of the customer contract.

8. Your rights

You have the right to:

  • access the personal data we hold about you (Art. 15 GDPR);
  • have inaccurate data corrected (Art. 16 GDPR);
  • have data erased (Art. 17 GDPR), unless we must keep it by law;
  • restrict processing (Art. 18 GDPR);
  • receive your data in a structured, machine-readable format (Art. 20 GDPR);
  • object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR);
  • withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise these rights, write to privacy@pearlixa.com. We answer within one month.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

9. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

10. Changes

We update this policy when the website or the law changes. The current version is always available at pearlixa.com/privacy.