Privacy policy

good vibes GmbH, Gartenstrasse 7, c/o excent AG, Zweigniederlassung Zug, 6300 Zug, Switzerland, represented by its Managing Director Denis Lulic

Email: deno@x3growth.io · Phone: +41 76 380 63 22

We are subject to the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP). We have not appointed a data protection officer because we are not required to. If you have any questions about data protection, you can reach us at deno@x3growth.io.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit it, Vercel processes technically necessary data: IP address, time, requested address, referrer and browser identifier (server logs).

The legal basis is our legitimate interest in a secure, fast website (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework; transfers to the USA are based on this certification and additionally on the European Commission’s Standard Contractual Clauses.

Fonts are served from our own server. Loading the page does not connect to Google Fonts.

We measure how this website is used with our own analytics platform X3 Growth Intelligence, without third-party providers such as Google Analytics. Unless you choose “Accept all”, measurement works without cookies and without storing anything in your browser. Your browser loads the measurement script from this domain (path “/n3”) and sends the measurement data there as well.

We process: pages viewed, referrer, campaign parameters (UTM) and click IDs from advertising platforms (e.g. gclid, fbclid), clicks on buttons and links (e.g. the booking button, the WhatsApp link), which sections of the page you saw and for how long, scroll depth, time on page, browser window size, device type, browser, language and country. From the form we only record that it was started or submitted, never what you enter. After you book a call, we only record that a call was booked.

Our server at Vercel forwards the measurement data without cookies, together with your IP address, browser identifier (user agent) and the country derived from it, to the X3 server (api.x3growth.io). There, the page views of a visit are linked using a pseudonymous hash with a random value that changes daily; the IP address and browser identifier themselves are not stored.

The X3 server runs at Vercel Inc. (address see section 2) in a data centre in Frankfurt am Main; the measurement data is stored in a database operated by Neon Inc., also in Frankfurt am Main (Amazon Web Services, region eu-central-1). Vercel and Neon process the data on our behalf (data processing); for transfers to the USA, what is said in section 2 applies. Measurement data is deleted automatically after 180 days; aggregated daily figures with no link to individual visits are kept for up to three years.

Only if you choose “Accept all” in the cookie notice does X3 additionally store the following in your browser: the identifier of your visit in sessionStorage (until you close the tab), so a visit stays together even after reloading a page; the cookie “x3_vid” (a random identifier for your browser, 180 days), so we can attribute a later visit, an enquiry or a booked call to the ad you originally came from; and the cookie “x3_clk” (click IDs from advertising platforms taken from the requested address, 90 days). X3 then also reads the cookies “_fbp” and “_fbc” (section 3b), creates “_fbp” if it is missing, and sends them with the measurement data to the X3 server so we can report an enquiry or a booked call to Meta (section 3b). The legal basis for this is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). If you withdraw it via “Cookie settings” by choosing “Necessary only”, X3 deletes these entries immediately and then measures without cookies again.

The legal basis is our legitimate interest in understanding which channels and content work (Art. 6(1)(f) GDPR). You can object at any time: open the page once with “?x3_notrack=1” added (e.g. partner.x3growth.io/?x3_notrack=1). X3 will then stop measuring in this browser; only for this purpose, the entry “x3_notrack” is saved in your browser’s local storage (“?x3_notrack=0” lifts the objection). Or email us at deno@x3growth.io.

With X3 we also analyse how this website is used: clicks (target and position), scroll depth, visible sections, mouse movements, the use of form fields (only focus and abandonment per field, never content) and an approximate location (country, region and city derived from the network node, without storing the IP address). This produces aggregated heatmaps. A visit may also be saved as a session recording: page layout, scrolling, clicks, mouse movements and page changes, so the sequence can be followed later; we can also view ongoing visits with the same information in real time.

All input in form fields, your selections in forms, passwords and text that looks like personal data (for example email addresses or phone numbers) are made unrecognisable (masked) in your browser before anything is transmitted; the general text of the page remains readable. Login pages are never recorded. No cookies are set and nothing is stored in your browser for heatmaps and recordings; like the measurement script, the script is served via this domain (path “/n3”).

Only some recordings are kept (for example visits with an enquiry, visits with noticeable usability problems, or a random sample); the rest are deleted after 48 hours at the latest. Recordings that are kept are deleted automatically after 30 days, click and scroll paths of individual visits after 90 days. Data is stored in Frankfurt am Main as described in section 3.

The legal basis is our legitimate interest in identifying errors and obstacles on this website and making it easier to understand (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR): with “?x3_notrack=1” as described in section 3, after which nothing more is recorded in this browser. If your browser sends the “Global Privacy Control” signal, heatmaps and recordings do not take place either.

Only if you choose “Accept all” in the cookie notice do we load the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). Before that, and if you choose “Necessary only”, this website does not connect to Meta.

We use the pixel to measure how our advertising on Facebook and Instagram performs and to build audiences for our advertising (for example people who have visited this website). For this, your browser loads a script from connect.facebook.net and reports these events to Meta: page view, submitted intro call form and booked call. In doing so, Meta processes your IP address, information about your browser and device, the requested address and the identifiers from the cookies. We do not pass what you enter in forms or any other personal details to the pixel; we do not use automatic matching of contact data (Advanced Matching).

The pixel sets the cookies “_fbp” (a random identifier for your browser) and, if you arrive via an ad, “_fbc” (the ad’s click identifier), each for up to 90 days.

We and Meta are joint controllers for collecting the data on this website and transmitting it to Meta (Art. 26 GDPR). The details are set out in Meta’s joint controller addendum (facebook.com/legal/controller_addendum); under it, Meta is responsible, among other things, for fulfilling your rights under Art. 15 to 20 GDPR for the data stored by Meta. Meta alone is responsible for any further processing at Meta; more on this at facebook.com/privacy/policy.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (dataprivacyframework.gov); the transfer is based on this certification and additionally on the European Commission’s Standard Contractual Clauses.

Every event gets a random identifier. We store the identifier of the submitted form with your enquiry (section 5). Through our own platform X3 we can report to Meta from the server that an enquiry or a booked call has taken place (Conversions API), so Meta can measure the effect of an ad and count each event only once. We only do this if you chose “Accept all” here, and only with the ad’s click identifier (fbclid or _fbc), never with your email address, name or phone number.

You can change or withdraw your consent at any time with effect for the future: via the “Cookie settings” link at the bottom of every page. If you choose “Necessary only” there, the pixel stops sending anything immediately, we delete the _fbp and _fbc cookies for this domain, and from the next page view the pixel is no longer loaded. We store your decision in your browser’s local storage (entry “x3-consent” with your choice and the time) for 12 months; after that we ask again. Our measurement (section 3) records which choice you made; with “Accept all” it also uses the browser entries listed in section 3. If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we treat this as “Necessary only” and do not show the notice; you can still give your consent via “Cookie settings”.

Without your consent, we only store what is necessary in your browser: your choice between Day and Night (sessionStorage, only once you switch, and only until you close the tab; otherwise the page follows your device setting), your decision in the cookie notice (localStorage “x3-consent”, 12 months, see section 3b) and, if you object to measurement, the entry “x3_notrack” (section 3). Without your consent, we do not set any cookies ourselves. Only if you choose “Accept all” does the Meta Pixel set the cookies “_fbp” and “_fbc” (section 3b) and our measurement X3 set the cookies “x3_vid” and “x3_clk” as well as the identifier of your visit in sessionStorage (section 3).

If you submit a form on this website (for example the intro call questionnaire), we process your answers as well as your name, company and your phone number or email address. In addition, we process campaign parameters (UTM), click IDs from advertising platforms (gclid, fbclid, li_fat_id, wbraid, gbraid), referrer, entry page, current page, language and, if measurement is active, a session identifier from our measurement. This shows us which channel you came through.

We store this information in our own platform X3 Growth Intelligence (stored in Frankfurt am Main, see section 3) and carry it over into our booking page so it is already filled in (see section 6). We only use it to prepare your call and to contact you (Art. 6(1)(b) GDPR). If we do not end up working together, we delete it after 12 months at the latest.

If you chose “Accept all”, the Meta Pixel also reports that the form was submitted (event “Lead” with a random identifier that we store with your enquiry), never your details (section 3b).

You book intro calls through our own booking page at sales.x3growth.io. It runs on our platform X3 (stored in Frankfurt am Main, see section 3); no third-party provider is involved.

There we process the details you provide for the call (for example name, email address, phone number and preferred time) in order to arrange the call, remind you of it and prepare it (Art. 6(1)(b) GDPR). If we do not end up working together, we delete them after 12 months at the latest.

Our measurement only records that a call was booked (section 3).

On this website we link to WhatsApp (wa.me). This is a simple link, not an embedded plugin: no data is transferred until you click it. WhatsApp then opens, a service of WhatsApp Ireland Limited (Ireland); messages sent there are covered by WhatsApp’s privacy policy (whatsapp.com/legal/privacy-policy-eea).

When you click, our measurement X3 adds a short reference to the prepared message (for example “Ref 4K7Q”). If you send the message, this lets us match your enquiry to your visit to this website and to the channel you came through. The reference is a random value containing no personal details; you can delete it before sending.

The legal basis is your enquiry (Art. 6(1)(b) GDPR) and our legitimate interest in understanding which channels work (Art. 6(1)(f) GDPR).

The LinkedIn links are simple links, not embedded plugins. No data is transferred until you click them.

The link to x3growth.io leads to the website of our product X3 Growth Intelligence; its own privacy policy applies there.

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

To do so, email us at deno@x3growth.io. You can also lodge a complaint with a data protection supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), in the EU with the supervisory authority of the country where you live or work.