Privacy Policy

1. Who is responsible

This website and the Hidden Champions newsletter are operated by Benjamin Doering, based in Taiwan. For anything related to your personal data, contact[email protected]. Under the EU General Data Protection Regulation (GDPR), the operator is the data controller for the processing described here.

2. Visiting this website

This site is a static website hosted by Cloudflare, Inc. When you visit, Cloudflare processes your IP address and standard request data in short-lived connection logs to deliver the pages and protect against abuse. The legal basis is our legitimate interest in operating a secure, functioning website (Art. 6(1)(f) GDPR). The site itself sets no cookies and loads its fonts from its own server — not from Google or other third parties.

Web analytics. We use Cloudflare Web Analytics, a privacy-focused measurement service from our hosting provider, to see how many people visit and which pages they read. Cloudflare inserts a small script into each page that reports the visit together with basic technical data (page address, referrer, browser type, country) to Cloudflare. It sets no cookies, stores nothing on your device, does not fingerprint you, and does not follow you across other websites; we only ever see aggregated counts, never individual visitors. The legal basis is our legitimate interest in understanding overall site usage (Art. 6(1)(f) GDPR).

Local storage. To let you read your first company profile in full before we ask you to subscribe, the site keeps up to three small entries in your browser’s local storage: a list of which profiles this browser has opened; a marker written when you confirm your subscription from the link in the confirmation email, or when the already-subscribed check described in section 3 confirms your address, which is what removes the prompt again; and, if a profile was cut short, its address and title, so that after confirming we can offer to take you back to it. These entries never leave your device, are not transmitted to us or to anyone else, contain no identifiers beyond the page names themselves, and are not used for tracking or advertising. You can delete them at any time by clearing this site’s data in your browser; the site keeps working without them. The legal basis is our legitimate interest in offering a free sample while asking regular readers to subscribe (Art. 6(1)(f) GDPR; § 25(2) TDDDG for the storage itself, which we consider necessary for this expressly requested reading function).

3. The newsletter signup form

The subscribe form on this site is provided by beehiiv Inc., our newsletter service. It loads as an embedded frame from beehiiv’s servers, which means that when you open a page containing the form, your IP address and the page you came from are transmitted to beehiiv. If you subscribe, the email address you enter is stored by beehiiv on our behalf.

We send the newsletter only with your consent (Art. 6(1)(a) GDPR), which you give by submitting the form and confirming the opt-in email. You can withdraw consent at any time via the unsubscribe link in every issue or by emailing us — withdrawal stops all further emails.

Checking an existing subscription. When a company profile is cut short, the page offers an optional check for readers who already subscribe, so that browser can be unlocked again. Using it is voluntary and nothing is sent unless you type an address and submit it. The address you enter is posted to a small function running on this site’s own domain at Cloudflare, which makes exactly one lookup request to beehiiv asking whether that address is a live subscription and returns only that answer (active, pending, or none). Nothing is stored on our side: the address is not saved, not logged, and not added to any list. If the answer is active, your browser writes the same local marker described in section 2, so the prompt stops appearing on that device. The legal basis is our legitimate interest in letting existing subscribers read without obstruction (Art. 6(1)(f) GDPR).

4. Newsletter analytics

Like most newsletter services, beehiiv records whether an email was opened and which links were clicked. We use this only in aggregate to understand what readers find useful. If you prefer not to be included, most email clients can block tracking images, or you can read issues in the web archive instead.

5. Processors and international transfers

We use two service providers, both acting as processors under data processing agreements: beehiiv Inc. (newsletter; USA) and Cloudflare, Inc. (hosting and web analytics; USA). Transfers of EU personal data to these providers are safeguarded by the EU Standard Contractual Clauses included in their data processing agreements. Because the operator is based in Taiwan, subscriber data may also be accessed from there for managing the newsletter. The newsletter archive at our news subdomain is hosted by beehiiv; beehiiv’s ownprivacy policy applies to pages it serves.

6. Retention

Your email address is stored for as long as you are subscribed. When you unsubscribe, it is retained only on a suppression list so we don’t email you again; on request we delete it entirely. Hosting logs are transient and not used to identify visitors.

7. Your rights

Under the GDPR you can request access to the data we hold about you, correction, deletion, restriction of processing, and a portable copy; you can object to processing based on legitimate interest; and you can withdraw consent at any time without affecting past processing. Email us and we will act within one month. You also have the right to lodge a complaint with a data protection supervisory authority, for example the one in your EU member state.

8. Changes

We will update this policy when the site’s tools or data practices change; the date above reflects the latest revision.