Privacy Policy

1. Controller

The controller for data processing on this website within the meaning of Art. 4(7) GDPR is Niclas Schlopsna, trading as spectup, Kirchbachweg 22, 81479 Munich, Germany.

Email: hi@spectup.com. Telephone: +49 172 7754188.

We have not appointed a data protection officer because we are not required to under Art. 37 GDPR or § 38 BDSG. Please send any privacy enquiry to the address above.

2. What we process, and on what legal basis

Without your consent, this site processes only what it needs to deliver its pages and to answer your enquiry. Measurement, video and the newsletter run only if you agree to them.

2.1 Hosting, delivery and server logs

This website is hosted and delivered by Cloudflare (Cloudflare, Inc., United States) through its content delivery network and Cloudflare Pages.

When you open a page, your browser transmits the following data to Cloudflare:

• your IP address
• the date and time of the request
• the page requested and the referring URL
• your browser type and version, and your operating system

Cloudflare processes this data to deliver the page, to keep the site stable and to protect it against attacks and abuse. If a page fails to load, your browser may also send Cloudflare a short error report stating the address and the type of error. Cloudflare sets no cookies on this site.

The contact form and the newsletter signup send your entries to programs that Cloudflare runs for us on this domain (Cloudflare Pages Functions). These programs pass the data on to the services named in 2.2 and 2.4 and store nothing themselves.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Cloudflare acts as our processor under its data processing terms, which form part of our agreement with Cloudflare.

Retention: We keep no access logs of our own. Cloudflare keeps request data only as long as it needs it to deliver and secure the site, and then deletes it. Cloudflare does not publish a fixed retention period for this data.

2.2 Contact form and email

When you use the contact form, we process the data you enter so that we can reply to you:

• the reason for your enquiry
• your name and work email address
• your company or fund and your role
• your LinkedIn profile and where you found us
• the content of your message

If your enquiry concerns a mandate, the form also asks for the type of mandate, its size, its stage, the revenue or fund position behind it, and your acknowledgement of how we are paid.

Your name and email address are required. Your company or fund is also required if your enquiry concerns a mandate. All other fields are optional or offer a choice of given answers. The form contains one hidden field that only automated submissions fill in; it identifies spam and collects no data about you.

We process anything you send us by email or tell us by telephone in the same way. If you write to us on WhatsApp, WhatsApp Ireland Ltd. transmits the message under WhatsApp’s own terms.

The public pages of this site have no booking tool. Every “Request Call” button leads to the contact form, and we arrange calls by email. The one exception is the booking calendar on a client proposal page, described in 2.9.

When you send the form, your data goes to a function on our own domain that Cloudflare runs for us (2.1). The function writes it to our CRM in two places:

• a contact record in Notion (Notion Labs, Inc., United States)
• a lead in Close (Elastic Inc., United States), with your enquiry as a note and a task for us to reply

If your email address is already in our CRM, we add the enquiry to your existing records in Close and Notion and create no new ones. Both tools then notify us, in the tool and by email to our mailbox, which runs on Google Workspace.

We handle the further correspondence in Close. Changes made there to your name, role, company, status and the dates of our last contact are copied to the Notion record. Neither record is shared outside spectup, and we use both only to answer you and to work with you.

The form asks for your email address first. When you continue, we store it in Close together with the page you came from. If you leave before sending the form, we also store the step you reached and the options you selected, so that an unfinished enquiry is not lost. We use this data only to reply to that enquiry, never for marketing.

If the form cannot confirm that your enquiry arrived, it shows our email address and offers a pre-filled email that you can send from your own email program. Nothing is transmitted on this route until you send that email, which then reaches our mailbox like any other email.

The last step of the form has an optional, unticked box for our newsletter. If you tick it, your email address is also sent along the route described in 2.4. If you leave it unticked, your address goes only to us.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a possible mandate or an existing engagement. Otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries and keeping track of the business relationships that follow. Cloudflare, Google, Notion and Close process the data on our behalf; section 5 sets out on what terms.

Retention: We keep your enquiry, our correspondence with you and the CRM records described above while we are in contact with you.

After that, we keep them for as long as they are needed for a possible engagement, or to establish, exercise or defend legal claims.

Documents we must keep by law, such as business letters and accounting records, we keep for the periods the law sets. For example, business letters are kept for 6 years under § 257 HGB, and books and annual accounts for 10 years under § 147 AO.

You can ask us to delete your data at any time. We do so within one month, unless a legal duty requires us to keep it. In that case we keep only what that duty covers, and use it for nothing else.

2.3 Measurement

We use Google Analytics 4, loaded through Google Tag Manager, to measure how this site is used. Neither tool loads, and no request reaches Google, unless you allow measurement in the cookie notice.

If you allow measurement, Google Analytics records:

• which pages are viewed, where visitors come from and how long they stay
• which sections of a page were on screen for at least one second, and the furthest section a visit reached
• which of our contact links and buttons are clicked
• that a form was sent, never its content

If you have also allowed embedded media, Google Analytics records that a video was started and the title of the video. Google Analytics 4 does not store IP addresses.

The same container holds our Google Ads tags. A conversion linker stores the identifier of an ad click. Conversion tags use it to report to Google Ads that a visit which started with one of our ads reached a given page or sent an enquiry. This tells us which advertising is effective.

For Google Analytics and Google Tag Manager, Google acts as our processor. For the Google Ads tags, Google acts as a separate controller under the Google Ads Controller-Controller Data Protection Terms, and Google’s own privacy policy governs what it does with the data.

Before the container loads, this site tells Google that advertising personalisation is refused, and it repeats this signal on every hit, whatever your answer. None of these tags loads before you allow measurement. If you refuse measurement, none of them loads. If you withdraw consent, they stop immediately, not at the next page view.

Legal basis: § 25(1) TDDDG for storing and reading information on your device, and Art. 6(1)(a) GDPR for the processing that follows. In both cases the basis is your consent, which you can withdraw at any time with effect for the future at the end of section 3.

Retention: The cookies on your device last 400 days (_ga and _ga_X2E185QDT2, for analytics) and 90 days (_gcl_au, for advertising). Google keeps the underlying event data for 14 months, the longest period Google Analytics 4 offers, and then deletes it automatically. Aggregated reports are not subject to this limit.

Recipient: Google Ireland Ltd., with processing also in the United States (see section 4).

LinkedIn. The same container holds the LinkedIn Insight Tag. If you have allowed measurement, it tells LinkedIn which pages of this site you open and whether you sent an enquiry. If you reached this site from one of our LinkedIn ads, the click identifier carried in the address is used to match the visit to the ad. We use this to see which of our LinkedIn ads lead to enquiries. We do not use it to build audiences or to show you ads. LinkedIn Ireland Unlimited Company receives the data and handles it under its own privacy policy.

The LinkedIn tag loads only after you allow measurement. If you refuse, it does not load and no request reaches LinkedIn. If you withdraw consent, it stops immediately.

Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time with effect for the future at the end of section 3.

Recipient: LinkedIn Ireland Unlimited Company, with processing also in the United States (see section 4).

ChatGPT ads. If you reach this site through one of our ads in ChatGPT, OpenAI adds a click reference to the page address. If you then send an enquiry, our server tells OpenAI that this ad click led to an enquiry. It sends the click reference, the page and the time, and nothing else: no name, no email address, no IP address. No OpenAI script runs on this site and no cookie is set for it. OpenAI acts as a separate controller under its Ad Tools Terms.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing which advertising leads to enquiries. You can object at any time (section 6).

Recipient: OpenAI, United States.

2.4 Newsletter

You can subscribe to our newsletter in the footer and the menu of every page, beside our articles, on the resource hub, or on the last step of the contact form. All of these forms are our own. No frame from Substack or any other provider loads on this site, so no data reaches another service until you submit.

When you subscribe, your email address is sent to a function on this site’s own domain, which records it in our subscriber list. Teable (Teable AI, Inc., Dover, Delaware, United States) hosts this list for us on Amazon Web Services. Only your email address is stored there, as you entered it. This site does not send a confirmation email.

Your address is then added to the publications spectup writes:

• the Raise or Die Letter
• the Deal Makers (& Fakers) podcast list
• Niclas Schlopsna’s own Substack

These are published through Substack. Substack sends the emails, keeps the record of your subscription to each publication and handles unsubscribing. Substack also records whether emails are opened and whether links are clicked.

If the function on our domain is unavailable, the footer form opens Substack’s own signup page in a new tab. On the contact form, your answer then reaches us only as a line in your enquiry.

Legal basis: Art. 6(1)(a) GDPR, your consent. You can withdraw it at any time using the unsubscribe link in any issue or by writing to us.

Processors: Teable, and Substack Inc. (United States).

Retention: We keep your address until you unsubscribe or ask us to delete it.

2.5 Embedded media

Videos on this site play from YouTube (Google Ireland Ltd.). Every YouTube frame is replaced by a placeholder with a play button, and no request leaves your browser until you press that button or allow embedded media in the cookie notice. Pressing play loads that one video and does not change your stored answer.

When a frame loads, Google receives your IP address and sets five cookies under its own privacy policy:

• four that last 180 days: VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, __Secure-ROLLOUT_TOKEN, __Secure-YNID
• one that lasts until you close the browser: YSC

If you have also allowed measurement, starting a video sends an event with the title of the video to Google Analytics.

Podcast links to Spotify (Spotify AB) are plain links. Nothing from Spotify is embedded or loaded unless you follow one.

Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR, your consent, given either by pressing play on a single video or by allowing embedded media in the cookie notice.

Recipient: Google Ireland Ltd., with processing also in the United States (see section 4).

2.6 Fonts, badges and links off this site

Fonts are served from our own domain, so loading a page sends no data to Google or any other font provider.

The review badge is a plain link to Clutch and loads nothing until you click it. The “Summarise this page with” links in the footer open ChatGPT, Claude or Perplexity with the address of this page and a prepared question. They carry no data about you.

The same applies to our links to LinkedIn, X, our YouTube channel, WhatsApp, Spotify and Substack. Each is a plain link, and the provider receives data about you only if you follow it.

2.7 Mandate data

During an engagement we process the information you provide about your company or fund, including its financials, its shareholders and its transaction history, together with the contact details of the people involved. We hold this information in our email (Google Workspace) and our CRM (Close, with a copy of the contact details in Notion).

We disclose it to counterparties only in the form and to the extent you have approved, and normally only under a signed non-disclosure agreement.

Legal basis: Art. 6(1)(b) GDPR for the performance of our engagement, and Art. 6(1)(c) GDPR where we are subject to legal obligations, including customer due diligence under the German Money Laundering Act (Geldwäschegesetz, GwG).

Retention: For the duration of the engagement. After that, as set out in 2.2: for as long as needed to establish, exercise or defend legal claims, and for the periods the law sets.

2.8 The calculators

The four calculators run entirely in your browser. The figures you enter are not sent or stored anywhere and do not reach us. Closing or reloading the page clears them.

We learn that you opened a calculator only if you have allowed measurement, and then only that the page was viewed, never what you entered.

2.9 Job applications

If you apply for a role by email, we process what you send us: your name and contact details, your CV, your covering note and anything else you attach, and our own notes from the conversations that follow. We use it to assess your application and to speak with you about the role.

Your email goes to the mailbox of Niclas Schlopsna (Google Workspace, see section 5) and is read by the people at spectup who decide on the role. We do not pass it on to anyone else without your agreement. Please send only what is relevant to the role. We do not ask for a photo, or for information on your health, religion, origin or other special categories of data (Art. 9 GDPR).

Legal basis: Art. 6(1)(b) GDPR, taking steps at your request before an engagement or employment, together with § 26(1) BDSG.

Retention: If we do not take your application further, we delete it within six months of telling you our decision. That is the period in which a claim under the General Equal Treatment Act (AGG) can be brought. If you would like us to keep your details for a future role, tell us and we keep them for twelve months on the basis of your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time. If we engage you, the data becomes part of the engagement records described in 2.7.

2.10 Client proposal pages

This section applies only to the personal proposals we send to business contacts. A proposal sits at an address of the form www.spectup.com/p/<name> and opens with a personal password that we give to each person it is addressed to. These pages are not linked from anywhere on this site and are not indexed by search engines. If we have not sent you a proposal, this section does not concern you.

Opening and reading. When you enter your password, we record that you, as the reader the proposal was addressed to, opened it. We record:

• the time
• your approximate city and country, which Cloudflare derives from your IP address; we do not store the IP address for this
• the type of device (phone, tablet or desktop), taken from your browser’s user agent

When you leave the page, it sends us the time you spent on it, the sections you reached and the width of your browser window. We save all of this as notes on the lead for your company in Close (see 2.2), so that we can follow up on the proposal. The page sets one cookie for this, described in 3.4.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in following up a business proposal we sent on request, and Art. 6(1)(b) GDPR for the steps before a contract. You can object at any time (section 6).

Retention: As set out in 2.2.

Accepting a proposal. A proposal can be accepted on its page. The form asks for:

• the option you choose
• the name, title and email address of the person who signs
• the registered legal name and the registered address of the company (optional on older proposals)
• a tick confirming that the signer is authorised to accept for the company
• on proposals with the agreement attached: the signer’s signature, drawn on the page, and their typed name

So that we can prove the acceptance later, we store a record of it that cannot be changed afterwards. It holds the date and time (UTC), your IP address, your browser’s user agent, which reader’s password opened the page, the details you typed into the form, the acceptance wording exactly as it was shown to you, and a fingerprint (a SHA-256 hash) of the exact version of the proposal you saw. The record is stored with Cloudflare, and a copy of the details goes to Close. Where you sign the agreement, the signed copy carries a Signature Record listing, for your signature and for spectup’s countersignature, the time, IP address, approximate location and browser of the signing, so that both parties hold the same proof; you can download the agreement, the proposal and the record from the page.

After you sign, the signed copies are available on the proposal page. Once spectup has countersigned, we send you the agreement signed by both parties by email from our mailbox (Google Workspace, see section 5).

Legal basis: Art. 6(1)(b) GDPR, for concluding the contract, and Art. 6(1)(f) GDPR, our legitimate interest in proving the agreement and defending legal claims.

Retention: We keep the record for as long as we need it to prove the agreement. That is the term of the business relationship, followed by the limitation and retention periods the law sets (2.2).

Booking a follow-up call. A proposal page can show a booking calendar from Cal.com (Cal.com, Inc., United States). It loads only when you open the “Book a follow-up call” tab, and not before. Once it loads, your browser connects to Cal.com and sends your IP address and browser data, and your name and email address are filled in for you. When you book, Cal.com processes your name, email address, chosen time and time zone. We learn of the booking through a note in Close.

Legal basis: Art. 6(1)(b) GDPR, for steps before a contract that you ask for.

Recipients: Cloudflare, Close, Google and Cal.com, on the terms in sections 4 and 5.

3. Cookies and similar technologies

Nothing optional loads until you allow it. You can see and change your answer at the end of this section.

Storing information on your device, or reading information from it, requires your consent under § 25(1) TDDDG, unless it is strictly necessary to provide a service you have requested (§ 25(2) no. 2 TDDDG).

The cookie notice therefore offers the three categories described below. Nothing in the second or third category loads until you allow it.

Until you answer the cookie notice, this website sets no cookies at all and uses no tracking pixels. The one exception is the access cookie of a client proposal page, which exists only after you have entered the password we gave you (3.4). Closing the notice without making a choice is not consent and leaves everything switched off. Clearing your browser data has the same effect, and the notice then asks again.

3.1 Strictly necessary

The public pages of this site store two items on your device without asking, and nothing else:

• Your answer to the cookie notice, with the date and time you gave it, in your browser’s local storage under spectup.consent.v1.
• If you close the notice without answering, a note under spectup.consent.dismissed, so that the notice does not reappear on every page of that visit. It records no choice, allows nothing and is deleted when you close the browser.

Neither item is a cookie, and neither is ever sent to us. A client proposal page sets one further cookie, described in 3.4.

Legal basis: § 25(2) no. 2 TDDDG, and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, which requires us to be able to demonstrate your consent.

3.2 Measurement

If you allow measurement, this site loads Google Tag Manager, Google Analytics 4, the Google Ads tags and the LinkedIn Insight Tag described in 2.3. Their scripts set these cookies on this site’s own domain:

• _ga and _ga_X2E185QDT2, which last 400 days
• _gcl_au, which lasts 90 days, and _gcl_aw, which is set only when a visit starts from a Google ad and lasts 90 days
• li_fat_id, set by the LinkedIn Insight Tag only when a visit starts from a LinkedIn ad, which lasts 30 days

LinkedIn can also read and set cookies on its own domain (linkedin.com) when its tag loads. Those are governed by LinkedIn’s own cookie policy.

If you withdraw consent, this site deletes these cookies and instructs the running tags to stop. If you refuse, none of these tools loads and no request reaches Google or LinkedIn.

Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR, your consent.

3.3 Embedded media

If you allow embedded media, the YouTube frames on this site load. Until then, no request reaches YouTube or any other embed provider: each frame is replaced by a placeholder, and pressing play loads that one video only.

A loaded frame sets YouTube’s own cookies on youtube.com, listed in 2.5. These cookies sit on Google’s domain, so this site cannot delete them. If you withdraw consent, no further frames load; you can remove cookies set by earlier frames in your browser settings.

Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR, your consent.

3.4 Client proposal pages

When you enter the correct password on a client proposal page (2.10), that page sets one cookie, named prx_ followed by the name of the proposal. It is HttpOnly and Secure, it is sent only for that proposal’s path, and it lasts 45 days. It exists to show the proposal to the person it was sent to, and we use it for nothing else.

Legal basis: § 25(2) no. 2 TDDDG. The cookie is strictly necessary to provide the page you asked to open, so it needs no consent.

You can change or withdraw your answer below at any time, with effect for the future.

4. Transfers outside the EEA

Some of the providers named in this policy are established in the United States or process data there. The legal basis for each transfer is set out below.

Cloudflare, Google, LinkedIn, Notion and Substack are certified under the EU–US Data Privacy Framework. Transfers to them are based on the European Commission’s adequacy decision for the Framework (Art. 45 GDPR). Their data processing terms, which form part of our agreement with each of them, also include the Standard Contractual Clauses.

Close (Elastic Inc., United States) is not certified under the Data Privacy Framework, and no Standard Contractual Clauses are in place with it. For your enquiry and the correspondence that follows, and for a client proposal we have sent you (2.10), the transfer is based on Art. 49(1)(b) GDPR: it is necessary for the pre-contractual steps you request, and for performing the engagement if one follows.

Cal.com (Cal.com, Inc., United States) receives data only if you open the booking tab on a client proposal page (2.10). The transfer is made on the basis of Standard Contractual Clauses.

Teable (Teable AI, Inc.) hosts our newsletter subscriber list in the United States. Teable is not certified under the Data Privacy Framework. The transfer is based on the Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of Teable’s data processing agreement and so of our agreement with it.

You can request a copy of the safeguards in place from the address in section 1.

5. Recipients and processors

We pass personal data to third parties only where this is necessary, where you have consented, or where we are legally obliged to. Where a provider acts as our processor, it processes the data on our instructions under its data processing terms, which form part of our agreement with it (Art. 28 GDPR). The table shows the exceptions.

Provider	What for	Legal basis	Location and safeguard
Cloudflare, Inc.	Hosting and delivery of the site, security, and the functions behind the forms, which pass your enquiry to Notion and Close, and the stored record of an accepted proposal (2.1, 2.2, 2.10)	Art. 6(1)(f)	United States; Data Privacy Framework
Google Workspace	Our mailbox, and the email we exchange with you (2.2, 2.7, 2.9, 2.10)	Art. 6(1)(b) or (f)	EU and United States; Data Privacy Framework
Notion Labs, Inc.	CRM: a contact record of each enquiry (2.2)	Art. 6(1)(b) or (f)	United States; Data Privacy Framework
Elastic Inc. (Close)	CRM: the lead, the enquiry as a note, a task for us to reply, the conversation that follows, and notes on a client proposal you opened or accepted (2.2, 2.7, 2.10)	Art. 6(1)(b) or (f)	United States; no data processing agreement, no Data Privacy Framework certification, no Standard Contractual Clauses; Art. 49(1)(b), see section 4
Teable AI, Inc.	Our newsletter subscriber list (2.4)	Art. 6(1)(a)	United States; Standard Contractual Clauses, see section 4
Substack Inc.	Sending our newsletter and podcast lists, and handling unsubscribes (2.4)	Art. 6(1)(a)	United States; Data Privacy Framework
Google Ireland Ltd.: Tag Manager, Analytics 4	Measurement, only if you allow it (2.3, 3.2)	§ 25(1) TDDDG, Art. 6(1)(a)	EU, and Google LLC in the United States; Data Privacy Framework
Google Ireland Ltd.: Google Ads	Counting ad conversions, only if you allow measurement; Google acts as a separate controller (2.3, 3.2)	§ 25(1) TDDDG, Art. 6(1)(a)	EU, and Google LLC in the United States; Data Privacy Framework
LinkedIn Ireland Unlimited Company	Counting enquiries from our LinkedIn ads, only if you allow measurement (2.3, 3.2)	§ 25(1) TDDDG, Art. 6(1)(a)	EU, and LinkedIn Corporation in the United States; Data Privacy Framework
OpenAI: ChatGPT ads	Counting enquiries from our ChatGPT ads; click reference only, no personal details; OpenAI acts as a separate controller (2.3)	Art. 6(1)(f)	United States
Cal.com, Inc.	Booking calendar on a client proposal page, only if you open the booking tab (2.10)	Art. 6(1)(b)	United States; Standard Contractual Clauses
Google Ireland Ltd.: YouTube	Embedded video, only if you allow it or press play; Google acts as a separate controller (2.5, 3.3)	§ 25(1) TDDDG, Art. 6(1)(a)	EU, and Google LLC in the United States; Data Privacy Framework

Other recipients are our tax adviser, and public authorities and courts where we are legally required to disclose data.

The content management system behind this site is used only to publish it and receives no visitor data. The notifications we send to search engines when a page changes contain page addresses only.

6. Your rights

Under the GDPR you have the right to:

• obtain confirmation of whether we process your personal data, and a copy of it (Art. 15)
• have inaccurate data rectified (Art. 16)
• have your data erased (Art. 17)
• obtain restriction of processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)

Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before it.

Right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise any of these rights, write to hi@spectup.com. We respond within one month.

7. Right to complain

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence or place of work.

The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.

8. Obligation to provide data

You are not obliged to provide personal data. However, we need the fields marked as required in the contact form in order to reply. We cannot carry out an engagement without the information described in 2.7, and we cannot consider an application without the details described in 2.9.

9. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Children

Our services are aimed at businesses and institutional investors. They are not intended for children, and we do not knowingly collect personal data from anyone under 16.

11. Security

This site is served over TLS. We take appropriate technical and organisational measures under Art. 32 GDPR, including encryption in transit, access control on a need-to-know basis, and confidentiality undertakings from everyone who works on a mandate.

12. Changes

We update this policy when our processing or the law changes. The version in force is the one published on this page, with the date shown at the top.