{"id":21,"date":"2026-08-06T16:07:09","date_gmt":"2026-08-06T14:07:09","guid":{"rendered":"https:\/\/www.heavycampaigns.com\/privacy\/"},"modified":"2026-08-11T02:17:25","modified_gmt":"2026-08-11T00:17:25","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/www.heavycampaigns.com\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<p><strong>Last updated August 10, 2026. This notice describes the operation of the HEAVY CAMPAIGNS website, including forms, security, regional handling, and consent-controlled audience measurement.<\/strong><\/p>\n<h2>Scope and primary controller<\/h2>\n<p><strong>EA European Atlantic GmbH<\/strong>, Neuer Wall 10, 20354 Hamburg, Germany, is initially responsible for the technical operation of this website and the central intake of form submissions. Privacy requests may be sent to <a href=\"mailto:mail@heavycampaigns.com\">mail@heavycampaigns.com<\/a>.<\/p>\n<h2>HEAVY CAMPAIGNS INC and regional routing<\/h2>\n<p>HEAVY CAMPAIGNS INC, 4500 3rd Ave SW, Naples, FL 34119, United States, may become an independent controller for inquiries and contractual relationships from the United States, North America, and other international markets. Page language alone does not trigger a transfer. The current website operation does not enable automatic external CRM or regional routing. If an inquiry is forwarded to HEAVY CAMPAIGNS INC, we identify the responsible entity and implement the required basis for a transfer to the United States.<\/p>\n<h2>Purposes and legal bases<\/h2>\n<p>Personal information is processed only as necessary for technical website delivery, security, inquiry handling, pre-contract communication, contract performance, or legal obligations. For European processing, relevant legal bases generally include Article 6(1)(b), (c), and (f) GDPR. Optional non-essential services would be enabled only with valid consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG where applicable.<\/p>\n<h2>Hosting, server logs, and security<\/h2>\n<p>The website is hosted in a European Host Europe environment. When pages are requested, server logs may process IP address, timestamp, requested resource, status code, referrer, browser, and device information. The Plesk configuration rotates domain logs daily, retains no more than ten rotated sets, and anonymizes IP addresses in rotated logs. Processing supports delivery, troubleshooting, and abuse prevention and is based on legitimate operational and security interests.<\/p>\n<h2>AegisPress<\/h2>\n<p>AegisPress checks security-relevant access, forms, and technical attack patterns. In the deployed configuration, AegisPress runs in monitor mode and does not store raw IP addresses. Salted hashes are used for grouping; excerpts are sanitized, sensitive fields are redacted, and stored content is truncated. Security and quarantine data is cleaned up after 30 days. This processing is not used for advertising or audience measurement.<\/p>\n<h2>Cloudflare Turnstile<\/h2>\n<p>We use Cloudflare Turnstile to protect our forms against automated abuse. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States. For the security check, Turnstile processes client-side signals such as IP address, TLS fingerprint, User-Agent header, sitekey, and associated origin. The verification result is sent to our website.<\/p>\n<p>Cloudflare processes these signals on our behalf to secure our website and also as an independent controller to improve Turnstile&#8217;s bot-detection capabilities. According to Cloudflare, the signals are not used to identify, profile, or target individuals. For European processing, our use is based on Article 6(1)(f) GDPR and our legitimate interest in secure, functional forms; access to device information that is strictly necessary for the security check is based, where applicable, on Section 25(2)(2) TDDDG. Processing in the United States cannot be ruled out. Further information is available in the <a href=\"https:\/\/www.cloudflare.com\/turnstile-privacy-policy\/\">Turnstile Privacy Addendum<\/a> and the <a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\">Cloudflare Privacy Policy<\/a>.<\/p>\n<h2>Project brief and contact forms<\/h2>\n<p>When forms are used, we process the submitted contact, company, project, budget, timing, and message information together with the recorded acknowledgment of this notice. Processing supports inquiry handling and preparation of potential services. In the intended configuration, Contact Form 7 does not permanently store the complete submission in WordPress, and no autoresponder is enabled. Do not submit credentials, special-category personal data, or confidential documents.<\/p>\n<h2>Data-minimised performance measurement<\/h2>\n<p>To improve the project journey, we store only daily aggregate counters for project brief views, technical form outcomes and \u2013 after successful delivery \u2013 the selected service and self-declared decision stage in broad categories. Measurement uses no analytics cookies, visitor profiles, IP addresses, device identifiers, email addresses or message content. Views with Global Privacy Control or Do Not Track enabled are not counted. Aggregate counters are deleted after no more than two years. The data supports service reliability and improvement of inquiry handling based on legitimate operational interests.<\/p>\n<h2>Languages and cookies<\/h2>\n<p>WPML provides the German and English versions. When a visitor actively changes language, a strictly necessary first-party cookie may store the selected language. Details are provided in the Cookie Policy. Non-essential analytics functionality is enabled only after explicit consent; marketing and profiling tags are not used.<\/p>\n<h2>Optional audience measurement with Google Analytics 4<\/h2>\n<p>Google Analytics 4 is used on the public HEAVY CAMPAIGNS domains for statistical analysis of website usage. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The integration uses Basic Consent Mode v2: before explicit approval, neither the Google tag nor analytics requests to Google are loaded. The legal basis is consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time with future effect through \u201cCookie settings\u201d.<\/p>\n<ul>\n<li>The consent decision is stored in the first-party cookie <code>hc_consent_analytics<\/code> for 180 days.<\/li>\n<li>The website sets no proprietary User ID; Google Signals, advertising storage, advertising user data, and ad personalisation remain disabled in the website integration.<\/li>\n<li>On withdrawal, analytics is disabled and the website attempts to delete existing <code>_ga<\/code> and <code>_ga_*<\/code> cookies for the HEAVY CAMPAIGNS domain.<\/li>\n<li>Processing by Google LLC in the United States cannot be ruled out and is based on the applicable transfer mechanism, particularly the EU-US Data Privacy Framework or Standard Contractual Clauses.<\/li>\n<li>Event-data retention follows the retention period configured in the Analytics account; aggregated reports may remain available longer without direct personal reference.<\/li>\n<\/ul>\n<h2>Recipients, international transfers, and no sale<\/h2>\n<p>Access is limited to responsible personnel of the relevant regional entity and technically necessary processors. Information is transferred to HEAVY CAMPAIGNS INC in the United States only where required for the requested regional handling or contract initiation and where an appropriate legal basis and transfer mechanism apply. Personal information is not sold and is not used for cross-context behavioral advertising, targeted advertising, or decisions producing legal or similarly significant effects.<\/p>\n<h2>Retention<\/h2>\n<p>Form and communication data is retained only for as long as necessary for inquiry handling, proposals, contract performance, evidence, or statutory retention duties. Declined or inactive inquiries are reviewed and deleted when no legitimate purpose remains. Specific technical periods for server and security data are described above.<\/p>\n<h2>Required and voluntary information<\/h2>\n<p>Required fields are identified in the forms. Providing them is neither a statutory obligation nor an existing contractual duty, but it is necessary to handle the inquiry and prepare a potential agreement. Without this information, the inquiry cannot be processed or can be processed only to a limited extent. Fields identified as optional are voluntary.<\/p>\n<h2>No automated individual decisions<\/h2>\n<p>The website makes no solely automated decision producing legal or similarly significant effects. Technical categories derived from the project brief support manual inquiry review only; they do not automatically decide acceptance, pricing, the contracting entity, or regional forwarding.<\/p>\n<h2>Your rights<\/h2>\n<p>Depending on applicable law, individuals may request access, correction, deletion, restriction, portability, or objection and may withdraw consent with future effect. US consumers may also have state-specific rights to access, correct, delete, or appeal a denied request. Reasonable information may be requested to verify identity.<\/p>\n<h2>Complaints<\/h2>\n<p>For European processing, individuals may lodge a complaint with a competent supervisory authority. The authority at the seat of EA European Atlantic GmbH is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, <a href=\"mailto:mailbox@datenschutz.hamburg.de\">mailbox@datenschutz.hamburg.de<\/a>.<\/p>\n<h2>Children<\/h2>\n<p>This is a business-to-business website and is not directed to children. We do not knowingly invite minors to submit personal information.<\/p>\n<h2>Contact and changes<\/h2>\n<p>Privacy requests: <a href=\"mailto:mail@heavycampaigns.com\">mail@heavycampaigns.com<\/a>. We update this notice when services, routing, law, or processing materially change.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Privacy information for HEAVY CAMPAIGNS website operations and regional inquiry routing.<\/p>\n","protected":false},"author":0,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-21","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.heavycampaigns.com\/en\/wp-json\/wp\/v2\/pages\/21","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.heavycampaigns.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.heavycampaigns.com\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/www.heavycampaigns.com\/en\/wp-json\/wp\/v2\/comments?post=21"}],"version-history":[{"count":7,"href":"https:\/\/www.heavycampaigns.com\/en\/wp-json\/wp\/v2\/pages\/21\/revisions"}],"predecessor-version":[{"id":816,"href":"https:\/\/www.heavycampaigns.com\/en\/wp-json\/wp\/v2\/pages\/21\/revisions\/816"}],"wp:attachment":[{"href":"https:\/\/www.heavycampaigns.com\/en\/wp-json\/wp\/v2\/media?parent=21"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}