Privacy Policy

1. Controller

The controller for data processing on this website within the meaning of Art. 4(7) GDPR is Niclas Schlopsna, trading as spectup, Kirchbachweg 22, 81479 Munich, Germany.

Email: hi@spectup.com. Telephone: +49 172 7754188.

We have not appointed a data protection officer because we are not required to under Art. 37 GDPR or § 38 BDSG. Please send any privacy enquiry to the address above.

2. What we process, and on what legal basis

Without your consent, this site processes only what it needs to deliver its pages and to answer your enquiry. Measurement, video and the newsletter run only if you agree to them.

2.1 Hosting, delivery and server logs

This website is hosted and delivered by Cloudflare (Cloudflare, Inc., United States) through its content delivery network and Cloudflare Pages.

When you open a page, your browser transmits the following data to Cloudflare:

• your IP address
• the date and time of the request
• the page requested and the referring URL
• your browser type and version, and your operating system

Cloudflare processes this data to deliver the page, to keep the site stable and to protect it against attacks and abuse. If a page fails to load, your browser may also send Cloudflare a short error report stating the address and the type of error. Cloudflare sets no cookies on this site.

The contact form and the newsletter signup send your entries to programs that Cloudflare runs for us on this domain (Cloudflare Pages Functions). These programs pass the data on to the services named in 2.2 and 2.4 and store nothing themselves.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Cloudflare acts as our processor under its data processing terms, which form part of our agreement with Cloudflare.

Retention: We keep no access logs of our own. Cloudflare keeps request data only as long as it needs it to deliver and secure the site, and then deletes it. Cloudflare does not publish a fixed retention period for this data.

2.2 Contact form and email

When you use the contact form, we process the data you enter so that we can reply to you:

• the reason for your enquiry
• your name and work email address
• your company or fund and your role
• your LinkedIn profile and where you found us
• the content of your message

If your enquiry concerns a mandate, the form also asks for the type of mandate, its size, its stage, the revenue or fund position behind it, and your acknowledgement of how we are paid.

Your name and email address are required. Your company or fund is also required if your enquiry concerns a mandate. All other fields are optional or offer a choice of given answers. The form contains one hidden field that only automated submissions fill in; it identifies spam and collects no data about you.

We process anything you send us by email or tell us by telephone in the same way. If you write to us on WhatsApp, WhatsApp Ireland Ltd. transmits the message under WhatsApp’s own terms.

This site has no booking tool. Every “Request Call” button leads to the contact form, and we arrange calls by email.

When you send the form, your data goes to a function on our own domain that Cloudflare runs for us (2.1). The function writes it to our CRM in two places:

• a contact record in Notion (Notion Labs, Inc., United States)
• a lead in Close (Elastic Inc., United States), with your enquiry as a note and a task for us to reply

If your email address is already in our CRM, we add the enquiry to your existing records in Close and Notion and create no new ones. Both tools then notify us, in the tool and by email to our mailbox, which runs on Google Workspace.

We handle the further correspondence in Close. Changes made there to your name, role, company, status and the dates of our last contact are copied to the Notion record. Neither record is shared outside spectup, and we use both only to answer you and to work with you.

The form asks for your email address first. When you continue, we store it in Close together with the page you came from. If you leave before sending the form, we also store the step you reached and the options you selected, so that an unfinished enquiry is not lost. We use this data only to reply to that enquiry, never for marketing.

If the form cannot confirm that your enquiry arrived, it shows our email address and offers a pre-filled email that you can send from your own email program. Nothing is transmitted on this route until you send that email, which then reaches our mailbox like any other email.

The last step of the form has an optional, unticked box for our newsletter. If you tick it, your email address is also sent along the route described in 2.4. If you leave it unticked, your address goes only to us.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a possible mandate or an existing engagement. Otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries and keeping track of the business relationships that follow. Cloudflare, Google, Notion and Close process the data on our behalf; section 5 sets out on what terms.

Retention: We keep your enquiry, our correspondence with you and the CRM records described above while we are in contact with you.

After that, we keep them for as long as they are needed for a possible engagement, or to establish, exercise or defend legal claims.

Documents we must keep by law, such as business letters and accounting records, we keep for the periods the law sets. For example, business letters are kept for 6 years under § 257 HGB, and books and annual accounts for 10 years under § 147 AO.

You can ask us to delete your data at any time. We do so within one month, unless a legal duty requires us to keep it. In that case we keep only what that duty covers, and use it for nothing else.

2.3 Measurement

We use Google Analytics 4, loaded through Google Tag Manager, to measure how this site is used. Neither tool loads, and no request reaches Google, unless you allow measurement in the cookie notice.

If you allow measurement, Google Analytics records:

• which pages are viewed, where visitors come from and how long they stay
• which sections of a page were on screen for at least one second, and the furthest section a visit reached
• which of our contact links and buttons are clicked
• that a form was sent, never its content

If you have also allowed embedded media, Google Analytics records that a video was started and the title of the video. Google Analytics 4 does not store IP addresses.

The same container holds our Google Ads tags. A conversion linker stores the identifier of an ad click. Conversion tags use it to report to Google Ads that a visit which started with one of our ads reached a given page or sent an enquiry. This tells us which advertising is effective.

For Google Analytics and Google Tag Manager, Google acts as our processor. For the Google Ads tags, Google acts as a separate controller under the Google Ads Controller-Controller Data Protection Terms, and Google’s own privacy policy governs what it does with the data.

Before the container loads, this site tells Google that advertising personalisation is refused, and it repeats this signal on every hit, whatever your answer. None of these tags loads before you allow measurement. If you refuse measurement, none of them loads. If you withdraw consent, they stop immediately, not at the next page view.

Legal basis: § 25(1) TDDDG for storing and reading information on your device, and Art. 6(1)(a) GDPR for the processing that follows. In both cases the basis is your consent, which you can withdraw at any time with effect for the future at the end of section 3.

Retention: The cookies on your device last 400 days (_ga and _ga_X2E185QDT2, for analytics) and 90 days (_gcl_au, for advertising). Google keeps the underlying event data for 14 months, the longest period Google Analytics 4 offers, and then deletes it automatically. Aggregated reports are not subject to this limit.

Recipient: Google Ireland Ltd., with processing also in the United States (see section 4).

2.4 Newsletter

You can subscribe to our newsletter in the footer and the menu of every page, beside our articles, on the resource hub, or on the last step of the contact form. All of these forms are our own. No frame from Substack or any other provider loads on this site, so no data reaches another service until you submit.

When you subscribe, your email address is sent to a function on this site’s own domain, which records it in our subscriber list. Teable (Teable AI, Inc., Dover, Delaware, United States) hosts this list for us on Amazon Web Services. Only your email address is stored there, as you entered it. This site does not send a confirmation email.

Your address is then added to the publications spectup writes:

• the Raise or Die Letter
• the Deal Makers (& Fakers) podcast list
• Niclas Schlopsna’s own Substack

These are published through Substack. Substack sends the emails, keeps the record of your subscription to each publication and handles unsubscribing. Substack also records whether emails are opened and whether links are clicked.

If the function on our domain is unavailable, the footer form opens Substack’s own signup page in a new tab. On the contact form, your answer then reaches us only as a line in your enquiry.

Legal basis: Art. 6(1)(a) GDPR, your consent. You can withdraw it at any time using the unsubscribe link in any issue or by writing to us.

Processors: Teable, and Substack Inc. (United States).

Retention: We keep your address until you unsubscribe or ask us to delete it.

2.5 Embedded media

Videos on this site play from YouTube (Google Ireland Ltd.). Every YouTube frame is replaced by a placeholder with a play button, and no request leaves your browser until you press that button or allow embedded media in the cookie notice. Pressing play loads that one video and does not change your stored answer.

When a frame loads, Google receives your IP address and sets five cookies under its own privacy policy:

• four that last 180 days: VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, __Secure-ROLLOUT_TOKEN, __Secure-YNID
• one that lasts until you close the browser: YSC

If you have also allowed measurement, starting a video sends an event with the title of the video to Google Analytics.

Podcast links to Spotify (Spotify AB) are plain links. Nothing from Spotify is embedded or loaded unless you follow one.

Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR, your consent, given either by pressing play on a single video or by allowing embedded media in the cookie notice.

Recipient: Google Ireland Ltd., with processing also in the United States (see section 4).

2.6 Fonts, badges and links off this site

Fonts are served from our own domain, so loading a page sends no data to Google or any other font provider.

The review badge is a plain link to Clutch and loads nothing until you click it. The “Summarise this page with” links in the footer open ChatGPT, Claude or Perplexity with the address of this page and a prepared question. They carry no data about you.

The same applies to our links to LinkedIn, X, our YouTube channel, WhatsApp, Spotify and Substack. Each is a plain link, and the provider receives data about you only if you follow it.

2.7 Mandate data

During an engagement we process the information you provide about your company or fund, including its financials, its shareholders and its transaction history, together with the contact details of the people involved. We hold this information in our email (Google Workspace) and our CRM (Close, with a copy of the contact details in Notion).

We disclose it to counterparties only in the form and to the extent you have approved, and normally only under a signed non-disclosure agreement.

Legal basis: Art. 6(1)(b) GDPR for the performance of our engagement, and Art. 6(1)(c) GDPR where we are subject to legal obligations, including customer due diligence under the German Money Laundering Act (Geldwäschegesetz, GwG).

Retention: For the duration of the engagement. After that, as set out in 2.2: for as long as needed to establish, exercise or defend legal claims, and for the periods the law sets.

2.8 The calculators

The four calculators run entirely in your browser. The figures you enter are not sent or stored anywhere and do not reach us. Closing or reloading the page clears them.

We learn that you opened a calculator only if you have allowed measurement, and then only that the page was viewed, never what you entered.

3. Cookies and similar technologies

Nothing optional loads until you allow it. You can see and change your answer at the end of this section.

Storing information on your device, or reading information from it, requires your consent under § 25(1) TDDDG, unless it is strictly necessary to provide a service you have requested (§ 25(2) no. 2 TDDDG).

The cookie notice therefore offers the three categories described below. Nothing in the second or third category loads until you allow it.

Until you answer the cookie notice, this website sets no cookies at all and uses no tracking pixels. Closing the notice without making a choice is not consent and leaves everything switched off. Clearing your browser data has the same effect, and the notice then asks again.

3.1 Strictly necessary

This site stores two items on your device without asking, and nothing else:

• Your answer to the cookie notice, with the date and time you gave it, in your browser’s local storage under spectup.consent.v1.
• If you close the notice without answering, a note under spectup.consent.dismissed, so that the notice does not reappear on every page of that visit. It records no choice, allows nothing and is deleted when you close the browser.

Neither item is a cookie, and neither is ever sent to us.

Legal basis: § 25(2) no. 2 TDDDG, and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, which requires us to be able to demonstrate your consent.

3.2 Measurement

If you allow measurement, this site loads Google Tag Manager, Google Analytics 4 and the Google Ads tags described in 2.3. Their scripts set three cookies on this site’s own domain:

• _ga and _ga_X2E185QDT2, which last 400 days
• _gcl_au, which lasts 90 days

If you withdraw consent, this site deletes these three cookies and instructs the running tags to stop. If you refuse, none of these tools loads and no request reaches Google.

Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR, your consent.

3.3 Embedded media

If you allow embedded media, the YouTube frames on this site load. Until then, no request reaches YouTube or any other embed provider: each frame is replaced by a placeholder, and pressing play loads that one video only.

A loaded frame sets YouTube’s own cookies on youtube.com, listed in 2.5. These cookies sit on Google’s domain, so this site cannot delete them. If you withdraw consent, no further frames load; you can remove cookies set by earlier frames in your browser settings.

Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR, your consent.

You can change or withdraw your answer below at any time, with effect for the future.

4. Transfers outside the EEA

Some of the providers named in this policy are established in the United States or process data there. The legal basis for each transfer is set out below.

Cloudflare, Google, Notion and Substack are certified under the EU–US Data Privacy Framework. Transfers to them are based on the European Commission’s adequacy decision for the Framework (Art. 45 GDPR). Their data processing terms, which form part of our agreement with each of them, also include the Standard Contractual Clauses.

Close (Elastic Inc., United States) is not certified under the Data Privacy Framework, and no Standard Contractual Clauses are in place with it. For your enquiry and the correspondence that follows, the transfer is based on Art. 49(1)(b) GDPR: it is necessary for the pre-contractual steps you request by writing to us, and for performing the engagement if one follows.

Teable (Teable AI, Inc.) hosts our newsletter subscriber list in the United States. Teable is not certified under the Data Privacy Framework, and its terms include neither a data processing agreement nor the Standard Contractual Clauses. The transfer of your email address to Teable is therefore covered by neither an adequacy decision nor Standard Contractual Clauses.

You can request a copy of the safeguards in place from the address in section 1.

5. Recipients and processors

We pass personal data to third parties only where this is necessary, where you have consented, or where we are legally obliged to. Where a provider acts as our processor, it processes the data on our instructions under its data processing terms, which form part of our agreement with it (Art. 28 GDPR). The table shows the exceptions.

Provider	What for	Legal basis	Location and safeguard
Cloudflare, Inc.	Hosting and delivery of the site, security, and the functions behind the forms, which pass your enquiry to Notion and Close (2.1, 2.2)	Art. 6(1)(f)	United States; Data Privacy Framework
Google Workspace	Our mailbox, and the email we exchange with you (2.2, 2.7)	Art. 6(1)(b) or (f)	EU and United States; Data Privacy Framework
Notion Labs, Inc.	CRM: a contact record of each enquiry (2.2)	Art. 6(1)(b) or (f)	United States; Data Privacy Framework
Elastic Inc. (Close)	CRM: the lead, the enquiry as a note, a task for us to reply, and the conversation that follows (2.2, 2.7)	Art. 6(1)(b) or (f)	United States; no data processing agreement, no Data Privacy Framework certification, no Standard Contractual Clauses; Art. 49(1)(b), see section 4
Teable AI, Inc.	Our newsletter subscriber list (2.4)	Art. 6(1)(a)	United States; no data processing terms; no adequacy decision or Standard Contractual Clauses, see section 4
Substack Inc.	Sending our newsletter and podcast lists, and handling unsubscribes (2.4)	Art. 6(1)(a)	United States; Data Privacy Framework
Google Ireland Ltd.: Tag Manager, Analytics 4	Measurement, only if you allow it (2.3, 3.2)	§ 25(1) TDDDG, Art. 6(1)(a)	EU, and Google LLC in the United States; Data Privacy Framework
Google Ireland Ltd.: Google Ads	Counting ad conversions, only if you allow measurement; Google acts as a separate controller (2.3, 3.2)	§ 25(1) TDDDG, Art. 6(1)(a)	EU, and Google LLC in the United States; Data Privacy Framework
Google Ireland Ltd.: YouTube	Embedded video, only if you allow it or press play; Google acts as a separate controller (2.5, 3.3)	§ 25(1) TDDDG, Art. 6(1)(a)	EU, and Google LLC in the United States; Data Privacy Framework

Other recipients are our tax adviser, and public authorities and courts where we are legally required to disclose data.

The content management system behind this site is used only to publish it and receives no visitor data. The notifications we send to search engines when a page changes contain page addresses only.

6. Your rights

Under the GDPR you have the right to:

• obtain confirmation of whether we process your personal data, and a copy of it (Art. 15)
• have inaccurate data rectified (Art. 16)
• have your data erased (Art. 17)
• obtain restriction of processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)

Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before it.

Right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise any of these rights, write to hi@spectup.com. We respond within one month.

7. Right to complain

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence or place of work.

The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.

8. Obligation to provide data

You are not obliged to provide personal data. However, we need the fields marked as required in the contact form in order to reply, and we cannot carry out an engagement without the information described in 2.7.

9. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Children

Our services are aimed at businesses and institutional investors. They are not intended for children, and we do not knowingly collect personal data from anyone under 16.

11. Security

This site is served over TLS. We take appropriate technical and organisational measures under Art. 32 GDPR, including encryption in transit, access control on a need-to-know basis, and confidentiality undertakings from everyone who works on a mandate.

12. Changes

We update this policy when our processing or the law changes. The version in force is the one published on this page, with the date shown at the top.