Last updated: 8 October 2026 · Version: 2.5
The following gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Details follow in the sections below.
The data processing on this website is carried out by the website operator, Pomelos Group GmbH. The contact details are listed under "Controller" in section 3.
Some data is collected because you provide it to us, for example when you request or book a demo or write to us by email. Other data is collected automatically by our IT systems when you visit the website (technical data such as browser, operating system or time of access), and further data only after you have given your consent (analytics and advertising measurement).
Part of the data is needed to provide the website without errors. With your consent, other data is used to analyse how visitors use the site and to measure whether our advertising on Google, TikTok and Microsoft leads to demo bookings.
You have the right to information about your stored personal data, its origin, recipients and purpose, and to have it corrected, deleted or its processing restricted. You can withdraw any consent at any time with effect for the future, and you can lodge a complaint with a supervisory authority. Details are in section 3.
We host this website with Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"). The website is a static site: its files are stored in Amazon S3 in the Frankfurt region (eu-central-1) and delivered through the Amazon CloudFront content delivery network, which answers requests from edge locations in Europe and North America.
When you visit the website, AWS automatically processes server log data, in particular your IP address, the date and time of the request, the page requested, the referrer URL and the browser and operating system used. This is technically necessary to deliver the website and to keep it secure.
The legal basis is Art. 6 (1) lit. f GDPR; our legitimate interest is the reliable and secure provision of the website. Access to your device that is strictly necessary to deliver the website is permitted under § 25 (2) no. 2 TDDDG.
We have concluded a data processing agreement with AWS (AWS GDPR Data Processing Addendum). Where content is delivered from edge locations outside the EU/EEA, the transfer is based on the EU-US Data Privacy Framework, under which Amazon is certified, and on the standard contractual clauses of the European Commission incorporated into the AWS Service Terms. Details: https://aws.amazon.com/privacy/ and https://aws.amazon.com/compliance/gdpr-center/.
The controller responsible for data processing on this website is:
Pomelos Group GmbH
Vitalisstraße 67
50827 Cologne
Germany
Registered at the District Court of Cologne, HRB 119422
Managing directors: Malte Hendricks, Jonathan Kurth
Email: malte@pomelos.co
Unless a more specific period is stated in this policy, your personal data remains with us until the purpose of processing no longer applies. If you make a justified deletion request or withdraw your consent, your data will be deleted unless we have other legally permissible reasons to keep it (for example retention periods under tax or commercial law); in that case it is deleted once those reasons no longer apply.
Where you have consented, we process your data on the basis of Art. 6 (1) lit. a GDPR. Where you have consented to the storage of information on, or access to information in, your device (for example cookies), this is additionally based on § 25 (1) TDDDG. Where processing is necessary to perform a contract or to take steps at your request before entering into a contract, the basis is Art. 6 (1) lit. b GDPR; for legal obligations, Art. 6 (1) lit. c GDPR; and for our legitimate interests, Art. 6 (1) lit. f GDPR. The applicable basis for each processing operation is given in the sections below.
We work with external service providers (processors) for hosting, consent management, tag management, analytics, advertising measurement, email and CRM. We only pass on personal data where this is necessary to perform a contract, where we are legally obliged to, where we have a legitimate interest, or where you have consented. With every processor we have concluded a data processing agreement under Art. 28 GDPR.
You can withdraw any consent at any time, with effect for the future, via the link in the footer of every page or by email. The lawfulness of processing carried out before the withdrawal remains unaffected.
IF PROCESSING IS BASED ON ART. 6 (1) LIT. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (ART. 21 (1) GDPR).
IF YOUR DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, INCLUDING TO PROFILING RELATED TO SUCH MARKETING. YOUR DATA WILL THEN NO LONGER BE USED FOR THAT PURPOSE (ART. 21 (2) GDPR).
Within the scope of the applicable law you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise these rights, contact us at the address above.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
This site uses TLS encryption to protect the transmission of content. You can recognise an encrypted connection by "https://" and the lock symbol in your browser's address bar.
We object to the use of the contact data published in our imprint for sending unsolicited advertising and information material, and reserve the right to take legal action against spam.
This website uses cookies and comparable technologies (such as localStorage). Our consent banner groups them into categories that you can accept or reject individually. Three of them decide which tools run on this website:
The banner also lists the categories Functional, Performance and Uncategorised. No tool on this website is started through them; whether a tool runs depends only on the three categories above. You can accept all categories, reject all, or choose individually. A full list of cookies with provider, purpose and duration is in our Cookie Policy.
We use the consent management platform CookieYes, provided by CookieYes Limited, 3 Warple Mews, Ealing, London, W3 0RF, United Kingdom, to obtain, store and document your consent.
CookieYes stores your decision in the cookie cookieyes-consent on your device. To be able to demonstrate consent, CookieYes keeps a consent record containing a random consent ID, the date and time, your choice per category, your country and your IP address in masked form. The record contains neither your name nor your email address.
The legal basis is Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR (obligation to demonstrate consent). Data is processed in the United Kingdom, for which an adequacy decision of the European Commission applies. Further information: https://www.cookieyes.com/privacy-policy/.
We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Tag Manager lets us control which analytics and advertising tools are loaded. It does not set cookies or create user profiles itself, but loading it transmits your IP address to Google.
Tag Manager works with Google Consent Mode v2. Before you decide, all four consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to "denied". Every tool that depends on them is only started once you consent to the relevant category; until then these tools neither set cookies nor transmit data.
The use of Tag Manager is based on Art. 6 (1) lit. f GDPR; our legitimate interest is managing the tools on this website in a controlled, consent-bound way.
With your consent to Analytics, we use Google Analytics 4 (Google Ireland Limited) to understand how visitors use this website: which pages are viewed, how visitors arrive, how long they stay, how far they scroll, which links and buttons are clicked, whether forms are started and sent, and which content leads to a demo booking, including the booking event itself. Google Analytics sets cookies that recognise your browser across pages and return visits. Google Analytics 4 does not log or store full IP addresses. Google signals are deactivated.
User-provided data. Google Analytics is also set to recognise email addresses, telephone numbers and postal addresses automatically when they are entered in a form on this website, in particular in the demo request form on our contact page. Before they are sent to Google, the Google tag encodes them in your browser with a one-way hash function, so Google receives them only in pseudonymised form. Google uses them to make the measurement more accurate and, if you have also consented to Advertisement, to attribute a demo request to a click on one of our Google ads (see "Google Ads and conversion tracking" below).
We have linked Google Analytics with our Google Ads account so that we can see which ad clicks led to visits and bookings; this exchange only takes place for visitors who have also consented to Advertisement.
The legal basis is your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Analytics data is retained for 14 months.
We advertise InsightBee through Google Ads, a service of Google Ireland Limited. With your consent to Advertisement, we use Google Ads conversion tracking to measure whether a click on one of our ads led to a demo booking or a demo request. This lets us see which ads and search terms work and optimise our budget accordingly.
How it works. If you reach our website via a Google ad, the click identifier ("GCLID") in the URL is stored in a first-party cookie by the Google Conversion Linker. If you then book a demo, our website reports a "demo booked" event to Google Ads, which matches it to the ad click. The booking event itself contains no name, email address or other booking details. If you send our demo request form, the Google tag also passes the email address and telephone number you entered to Google Ads, encoded with the same one-way hash function, so that the request can be attributed to your ad click (enhanced conversions for leads). We only receive aggregated statistics (for example the number of conversions per campaign), not information that identifies you.
We do not use remarketing, personalised audiences or similar audiences based on visits to this website.
The legal basis is your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG, which you can withdraw at any time via . Without that consent, the Conversion Linker and the conversion tag are not started, no Google Ads cookies are set and no conversion data is transmitted.
We have concluded a data processing agreement with Google (Google Ads Data Processing Terms). Data may be transferred to Google LLC in the USA; see section 5. Further information: https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/.
We advertise InsightBee on TikTok. With your consent to Advertisement, the TikTok Pixel is loaded on this website so that we can measure whether an ad on TikTok led to a visit and to a demo booking, and see which campaigns are worth running.
Provider. For visitors in the EEA, the United Kingdom and Switzerland the service is provided jointly by TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, D02 HD23, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom.
What is transmitted. TikTok calls this "Event Data" and defines it as information about you or your device, including HTTP header information such as user agent, IP address, country and language and information about the browser used, together with the actions you take on this website, such as the pages you visit. The pixel also sets the cookies listed in our Cookie Policy. We do not pass your name, email address or telephone number to TikTok.
Joint controllership. Under TikTok's Jurisdiction Specific Terms we and TikTok are joint controllers within the meaning of Art. 26 GDPR for two steps: the collection of this data on our website and its transmission to TikTok, and TikTok's measurement and reporting back to us. We have agreed with TikTok that we inform you about this processing and that TikTok answers requests to exercise your rights under Art. 15 to 20 GDPR in respect of it. Everything TikTok does with the data afterwards, in particular building audiences, targeting and improving its advertising, and security and fraud prevention, TikTok does as an independent controller; we have no influence over it and no access to the data.
Legal basis. Your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG, which you can withdraw at any time via . Without that consent the pixel is not loaded, no TikTok cookies are set and no data is sent to TikTok.
Third countries. A transfer to TikTok Ireland and TikTok UK is not itself a transfer to a third country: Ireland is in the EEA, and for the United Kingdom the European Commission has adopted an adequacy decision. Where TikTok passes the data on within its own group beyond those countries, TikTok is responsible for that transfer and undertakes to use the standard contractual clauses of the European Commission where they are required. TikTok's terms do not name the countries concerned; details are in TikTok's privacy policy.
Further information: https://www.tiktok.com/legal/page/eea/privacy-policy/en. The terms referred to above are TikTok's Business Products (Data) Terms and Jurisdiction Specific Terms, in the versions in force from 22 January 2026 and 5 February 2026 respectively.
We also advertise InsightBee through Microsoft Advertising. With your consent to Advertisement, the Universal Event Tracking tag ("UET tag") is loaded on this website so that we can measure whether a click on one of our Microsoft ads led to a visit and to a demo booking.
Provider. Our contract is with Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, which the Microsoft Privacy Statement also names as the controller responsible for visitors in the European Economic Area.
What is transmitted. Microsoft receives the pages you open on this website together with the technical information that every web request carries, such as your IP address and details of your browser and device. If you reach us by clicking a Microsoft ad, the click identifier ("MSCLKID") in the address is stored in a first-party cookie and reported back, so that a booking can be matched to the ad click. The tag also loads a further Microsoft script that records how you interact with our pages, for example clicks, scrolling, mouse movements and interactions with forms, and sends this to Microsoft for its conversion measurement; it sets no cookies of its own. Microsoft refers to what it collects through its tags as "Microsoft Advertising User Data". The tag also sets the cookies listed in our Cookie Policy. We do not pass your name, email address or telephone number to Microsoft.
Microsoft's role. Our agreement with Microsoft does not establish joint controllership. Microsoft states instead that, as between us and Microsoft, it owns and controls the information it collects through its tags and uses it for its own purposes, including delivering its advertising, retargeting and conversion measurement, reporting and improving its services. Microsoft therefore decides on that processing as its own, independent controller; we have no access to the data.
Legal basis. Your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG, which you can withdraw at any time via . Microsoft's advertising agreement also requires us to obtain your consent before the UET tag is activated. Without that consent the tag is not loaded, no Microsoft cookies are set and no data is sent to Microsoft.
Third countries. Microsoft Ireland Operations Limited is established in the EEA. Microsoft states that the personal data it collects may be stored and processed in the United States and in other countries in which Microsoft, its affiliates or its service providers operate. Microsoft Corporation is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and Microsoft additionally relies on the standard contractual clauses of the European Commission.
Microsoft collects or receives personal data from you or from us in order to provide Microsoft Advertising. Further information is in the Microsoft Privacy Statement: https://www.microsoft.com/en-us/privacy/privacystatement. The terms referred to above are sections 8, 9 and 19 of the Microsoft Advertising Agreement and the Microsoft Privacy Statement in its version of September 2026.
We use HubSpot as our customer relationship management system. The provider in the EEA is HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland; its parent company is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.
Visitor analytics (only with consent). If you consent to Analytics, the HubSpot tracking code sets cookies that record how you reached and moved through this website. The cookie hubspotutk recognises returning visitors and links a later demo request to your contact record, so that we can see which content led to an enquiry. With this consent, the tracking code also captures the details you enter in a form on this website when you send it and records them in our CRM; on this website that is the demo request form described below. Because this goes beyond pure reach measurement, it only happens with your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG). If you decline, the HubSpot tracking code is not loaded.
Demo booking (independent of cookie consent). Our demo scheduler (HubSpot Meetings) is embedded on this website. On our demo page it is loaded once you have sent your details there and go on to choose a time; on our home page, only when you click to open it. In both cases this happens whether or not you have accepted cookies, because arranging a meeting is the service you requested. On our demo page the scheduler opens with the first and last name, email address and company name you have just entered, so that you do not have to enter them again; they are passed to HubSpot in the address from which the scheduler is loaded. HubSpot processes the details in the scheduler (first and last name, email address, company name and chosen time) to schedule the appointment, stores them in our CRM, and may set cookies on its own domain that are required to operate the scheduler, such as the Cloudflare cookie __cf_bm, which protects it against automated requests. The legal basis is Art. 6 (1) lit. b GDPR (steps taken at your request before entering into a contract) and, for access to your device, § 25 (2) no. 2 TDDDG. If you neither send your details on our demo page nor open the scheduler on our home page, it is not loaded.
Visitor analytics in the scheduler (only with consent). Inside the scheduler, HubSpot can also run the visitor analytics described above. Our website tells the scheduler whether you have consented to Analytics: only then does it load HubSpot's tracking code, which may set HubSpot's analytics cookies on HubSpot's domain and link your booking to your visit. Without that consent, or after you withdraw it, it does not.
Demo request form (independent of cookie consent). On our contact page and on our demo page you can ask for a demo with a form. When you send it, the details you enter (first and last name, company name, email address and phone number) are transmitted directly from your browser to HubSpot, together with the address and title of the page, and stored as a contact in our CRM so that we can get in touch to arrange the demo - on our demo page also if you do not go on to book a time in the scheduler. If you have consented to Analytics, the value of the hubspotutk cookie is sent along, so that the request is linked to your visit as described above. The legal basis is Art. 6 (1) lit. b GDPR (steps taken at your request before entering into a contract). Nothing is transmitted until you send the form.
When a booking is completed, a demo request has been sent on our contact page or your details have been sent on our demo page, our website records a "demo booked", "demo requested" or "demo details sent" event without personal data; the "demo requested" event also notes which of the contact page's alternating headlines was shown. These events are only passed on to Google Analytics, Google Ads, TikTok and Microsoft Advertising if you have consented to the respective category.
We keep contact, request and booking data in our CRM for as long as necessary to handle your enquiry and any resulting business relationship, and then delete it unless statutory retention periods apply.
We have concluded a data processing agreement with HubSpot. HubSpot, Inc. is certified under the EU-US Data Privacy Framework; see section 5. Further information: https://legal.hubspot.com/privacy-policy.
If you contact us by email, we process your email address, the content of your message and any further details you provide in order to answer your enquiry. The legal basis is Art. 6 (1) lit. b GDPR if your enquiry relates to a contract or pre-contractual steps, and otherwise Art. 6 (1) lit. f GDPR (our legitimate interest in answering enquiries). We delete the data once the enquiry has been fully dealt with, unless statutory retention periods apply. Our email service provider processes these messages on our behalf under a data processing agreement.
Our website links to our profiles on LinkedIn, HubSpot Marketplace, G2 and OMR Reviews. These are plain links, not embedded plugins: no data is transmitted to these providers when you load our website. Only when you click a link does your browser connect to the respective provider, whose own privacy policy then applies.
All fonts and other resources used by this website are hosted on our own servers. No connection to third-party font providers is established.
Some of the providers named above belong to groups based in the USA (Amazon, Google, HubSpot, Microsoft). Personal data may therefore be transferred to the USA. Amazon.com, Inc., Google LLC, HubSpot, Inc. and Microsoft Corporation are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the standard contractual clauses of the European Commission (Art. 46 (2) lit. c GDPR) form part of our agreements with Amazon, Google and HubSpot; Microsoft relies on them as well. You can check a provider's certification at https://www.dataprivacyframework.gov/list.
CookieYes processes consent records in the United Kingdom, for which an adequacy decision of the European Commission applies. Transfers by TikTok are described in the section on the TikTok Pixel.
We update this privacy policy when we introduce new services or when the legal situation changes. If a change introduces a new purpose that requires consent, we will ask for your consent again. The current version always applies; its date and version number are shown at the top.