Privacy policy

Last updated: 3 November 2026

This privacy policy explains which personal data we process when you visit awaited.eu, send us a pitch or write to us. For each case it says why we process the data, on which legal basis, who else receives it and how long we keep it. At the end you find your rights. Personal data is any information that relates to you as an identifiable person, for example your name, your email address or your IP address.

Who is responsible

The controller responsible for the processing of your personal data is:

Awaited GmbH i. G., Tannet 12, 94539 Grafling, Germany

Managing directors: Jan Karres and Matthias Günter

Email: ask@awaited.eu

Phone: +49 991 20098959

Awaited GmbH is in formation (“i. G.”) until its entry in the commercial register. Further details are in our legal notice.

Write to ask@awaited.eu with any question about your data or to exercise any of your rights.

At a glance

• Visiting the website: our server and our content delivery network process your IP address and technical request data to deliver the pages and protect them against attacks.
• Statistics: we count visits with Matomo, without cookies. You can object at any time through “Privacy settings” in the footer.
• Privacy settings: a cookie stores your privacy settings, and we keep a record of them.
• Pitch form: we process your entries and your pitch deck to assess your pitch and to reply to you.
• Email: we process your messages to answer them.

We use no advertising, no social media plugins, no embedded videos or maps, no fonts from external servers and no newsletter. We do not sell personal data.

Legal bases

We process personal data only where the General Data Protection Regulation (GDPR) permits it. Each section below names the legal basis. We rely on these:

• Contract and steps prior to a contract, Art. 6(1)(b) GDPR: the processing is necessary to perform a contract with you or to take steps at your request before entering into one, for example when we assess your pitch for an investment.
• Legal obligation, Art. 6(1)(c) GDPR: the law requires us to process or keep the data, for example under commercial and tax law.
• Legitimate interests, Art. 6(1)(f) GDPR: the processing is necessary for our legitimate interests or those of a third party, and your interests, fundamental rights and freedoms do not override them. We name the interest in each section.

None of the processing described here is based on consent. Besides the GDPR, the German Federal Data Protection Act (BDSG) applies, and the German Telecommunications Digital Services Data Protection Act (TDDDG) governs storing information on your device and reading it from there.

Hosting and delivery of the website

Hosting

devowl.io GmbH, Tannet 12, 94539 Grafling, Germany, operates the website for us as our processor under a data processing agreement (Art. 28 GDPR). devowl.io GmbH is managed by the same two managing directors as Awaited. The server runs in a data centre in Nuremberg, Germany, provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Backups of the server are kept for eight days in object storage within the EU, at Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, or OVH SAS, 2 rue Kellermann, 59100 Roubaix.

Server log files

Each time you open a page, your browser sends technical data that our server records in log files:

• your IP address
• date and time of the request
• the page or file requested and the amount of data transferred
• the response status, for example whether the page was found
• the address of the page you came from (referrer)
• your browser and operating system as your browser reports them (user agent)

We use these log files to deliver the website, to keep it secure and stable, to detect and fend off attacks and to analyse errors. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the website securely and reliably. We delete the log files at the latest after 30 days. Entries needed as evidence of an attack are kept until the incident has been resolved.

Content delivery network and protection against attacks (Cloudflare)

Every request to awaited.eu first passes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare encrypts the connection, delivers stored copies of the pages, filters out attacks such as overload attacks (DDoS) and forwards the remaining requests to our server. In doing so, Cloudflare processes your IP address, the request data listed under “Server log files” and the content transmitted, including what you enter in the pitch form.

Our website also asks your browser to report network errors to Cloudflare (Network Error Logging). If a page fails to load, your browser may send Cloudflare a technical report containing, for example, the page address, the type of error, the time and your IP address.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in delivering the website quickly and reliably and in protecting it against attacks and misuse. Cloudflare acts as a processor. Cloudflare may process data in its data centres outside the EU, including in the USA (see “Transfers to countries outside the EU”). More in Cloudflare’s privacy policy.

Redirect and error logs

When you open an address on our website that does not exist or that we redirect, we log the requested address, the redirect target, the time, the referrer and your browser’s user agent. We do not log IP addresses here. We use the log to find and fix broken links, based on our legitimate interest in a working website (Art. 6(1)(f) GDPR). The entries are deleted after 60 days.

Privacy settings

We manage our privacy settings with Real Cookie Banner, a WordPress plugin by devowl.io GmbH that runs on the server of this website. We show no cookie banner, because none of the services on this website needs your consent. The link “Privacy settings” in the footer opens the settings at any time. There you see every service we use, and there you can object to statistics.

The cookie: a cookie named real_cookie_banner followed by a site-specific suffix stores your privacy settings in your browser. It contains a random identifier for your settings, which does not identify you as a visitor, the services and service groups that are active, and the version of the settings. It is kept for up to 365 days. Real Cookie Banner also keeps short-lived working entries in your browser’s local storage for up to one day. Storing and reading this information is strictly necessary to provide the privacy settings you use (§ 25(2) no. 2 TDDDG).

The record of your settings: on your first visit, and each time you save your settings, we store a record on our server. It contains the random identifier, the settings that apply, the time on our server and on your device, the address of the page, the size of your browser window, which button you used, whether your browser sends a “Do Not Track” signal and a hashed value of your shortened IP address. We do not store your full IP address. With this record we apply your settings and can prove which settings applied and that we honoured an objection. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in respecting your choices and being able to demonstrate that we do (Art. 5(2) GDPR). Records are deleted automatically 120 months (ten years) after they were created.

Statistics (Matomo, without cookies)

We count visits to this website with the open-source software Matomo. It shows us which pages are read, how visitors found the website, how long a visit lasts and which devices are used, so that we can improve the website. Matomo sets no cookies and stores nothing on your device.

Your browser sends each page view to our own domain. Our server forwards it, together with your IP address, to the Matomo installation that devowl.io GmbH operates for us as our processor. Matomo shortens your IP address before storing it, by removing the last part of the address. It also processes:

• date and time of the request and your local time
• title and address of the page and the page you came from
• files you download and links to other websites you click
• the loading time of the page
• browser, operating system and browser language
• country, region and city, derived from your IP address

Matomo groups the page views of one visit by a pseudonymous identifier formed from these data. We cannot tell from it who you are, and we make no attempt to.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in learning which pages founders find useful and in improving the website. The request to the Matomo server also passes through Cloudflare (see above). We delete the individual visit data after 365 days at the latest. The aggregated reports that remain contain no personal data.

You can object to statistics at any time: open “Privacy settings” in the footer, switch off “Statistics” and save. From then on your browser no longer sends page views to Matomo. Your objection is stored in the privacy settings cookie, so you need to set it again if you delete your cookies or use a different browser.

Pitch form

You can send us your pitch through the form behind every “Pitch to Awaited” button. The form asks for:

• your name
• your email address
• the name of your startup
• the website of your startup, if there is one yet (optional)
• your vision in one sentence
• the stage of your startup (MVP, pre-seed or seed)
• your pitch deck, as a link or as a PDF file of up to 20 MB
• anything else you want to tell us (optional)

Purpose and legal basis: we use your details and your deck to assess your pitch, to decide whether we want to invest and to reply to you, and to arrange a video call if your pitch fits. Where you pitch for yourself as a founder and future party to an investment, the legal basis is Art. 6(1)(b) GDPR, because assessing your pitch is a step towards a possible contract that you have asked for. Where you pitch on behalf of a company, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in assessing investment opportunities and in communicating with the people behind them.

Storage: your entries are stored in the database of our website. An uploaded PDF is stored outside the publicly accessible part of the server, and only our logged-in administrators can open it. We do not store your IP address, browser or device together with your pitch. To keep out automated spam, the form contains a field hidden from people (honeypot). It needs no external service and processes no additional personal data.

Notification by email: when you send the form, our website sends your entries and a link to an uploaded deck by email to our mailbox pitch@awaited.eu. The link opens the file only after login. The email is sent through Amazon Web Services (see “Email sending”) and received by Google Workspace (see “Email”). The pitch mailbox forwards the notification to the mailbox of our managing director Jan Karres. Jan Karres and Matthias Günter may reply to you from their devowl.io email addresses, which are hosted on Google Workspace as well.

Who reads your pitch: Jan Karres and Matthias Günter, and, where legal questions arise, the legal department of devowl.io GmbH, which works for us as our processor (see “Hosting”) and is bound to confidentiality. We do not publish your pitch and do not pass it on to third parties.

Deck as a link: if you send a link to your deck, we open it with the service you chose to host it. That service processes our access under its own terms.

How long we keep it: if we do not invest, we delete your deck and your message (“anything else”) at the latest three months after the process has ended. Within the same period we delete your remaining entries, the notification emails and our correspondence with you. If we invest, the documents of the investment become part of our business records and are kept for the periods required by commercial and tax law.

Is providing your data required? No law and no contract requires you to send us a pitch. Without the required fields we cannot assess your pitch, so the form cannot be sent without them.

Email

When you write to ask@awaited.eu or pitch@awaited.eu, we process your email address, your name if you give it, the content of your message and the technical data of the email to answer you. Our mailboxes are hosted on Google Workspace by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, acting as a processor. Google may process data outside the EU, including in the USA (see “Transfers to countries outside the EU”).

Where your message concerns a possible investment or another contract with us, the legal basis is Art. 6(1)(b) GDPR. In all other cases it is Art. 6(1)(f) GDPR, and our legitimate interest lies in answering your enquiry. We delete your messages once the matter is closed, unless we have to keep them. Messages that concern a business transaction are commercial letters, which we keep for six years under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO) (Art. 6(1)(c) GDPR).

Emails are usually encrypted on their way between mail servers (TLS), but not end to end. Please keep this in mind when you send confidential information.

Email sending

Our website sends emails through Amazon Simple Email Service (SES), in the AWS region Frankfurt, Germany. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, acting as a processor. This concerns the pitch notifications described above and login codes for our administrators. Amazon processes the addresses of sender and recipient, the content of the email and delivery data. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in delivering emails reliably and securely. Data may also be processed by Amazon Web Services, Inc. in the USA (see “Transfers to countries outside the EU”).

Logins to the administration area

Only our managing directors have accounts on this website. To protect the administration area, we record every login attempt, whoever makes it:

• Login activity: the account concerned, date and time, the event (for example a successful or failed login or a logout), the login method, the IP address and the browser’s user agent. We delete these entries after 90 days.
• Login protection: after repeated failed logins, the IP address concerned is locked for a time. We store the IP address, the number of failed attempts and the lock times. The entry is deleted once 24 hours have passed since the last failed attempt and any lock has ended.
• Two-factor login: our administrators receive a one-time login code by email (see “Email sending”).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the website and the pitches stored on it against unauthorized access.

Recipients

We disclose personal data only as described in this privacy policy. These recipients process data for us as processors, either engaged by us directly or as sub-processors of devowl.io GmbH, each bound by a data processing agreement under Art. 28 GDPR:

• devowl.io GmbH, Tannet 12, 94539 Grafling, Germany: operation and hosting of the website, statistics with Matomo.
• netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany: data centre and server.
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: content delivery network and protection against attacks.
• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg: email sending.
• Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland: mailboxes.
• Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France, or OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: storage of the server backups.

Beyond that, we pass on data only where the law requires it, for example to authorities or courts, or where it is necessary to establish, exercise or defend legal claims, for example to our legal or tax advisers, who are bound to professional secrecy.

Transfers to countries outside the EU

Cloudflare, Google and Amazon may process data in the USA. For the USA, the European Commission has adopted an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Cloudflare, Inc., Google LLC and Amazon Web Services, Inc. state that they are certified. You can check a company’s certification in the official list of the U.S. Department of Commerce. In addition, the data processing agreements of these providers contain the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can request a copy of these safeguards from us at ask@awaited.eu.

How long we keep data

We delete personal data as soon as we no longer need it for the purpose for which we collected it, unless a law requires us to keep it longer. In that case we restrict the processing to the purpose of retention. The periods for each processing are stated in the sections above. Under German commercial and tax law, commercial letters are kept for six years, and books, annual financial statements and the related records for ten years (§ 257 HGB, § 147 AO).

Security

We protect your data with technical and organisational measures appropriate to the risk (Art. 32 GDPR). Among them: every connection to our website is encrypted (TLS, recognizable by “https” in the address bar), the administration area is limited to our managing directors and protected against repeated login attempts, and uploaded pitch decks are stored outside the publicly accessible part of the server.

Your rights

Your right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that we base on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). We then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You can object to statistics with Matomo yourself at any time, without giving reasons, through “Privacy settings” in the footer. For any other objection, write to ask@awaited.eu.

Your further rights

• Access: you can ask whether we process personal data about you, and if so, receive a copy and further information (Art. 15 GDPR).
• Rectification: you can have inaccurate data corrected and incomplete data completed (Art. 16 GDPR).
• Erasure: you can have your data deleted where the legal requirements are met, for example when we no longer need it (Art. 17 GDPR).
• Restriction of processing: you can have the processing restricted, for example while we check whether your data is accurate (Art. 18 GDPR).
• Data portability: you can receive the data you have provided to us for a contract or pre-contractual steps in a structured, commonly used and machine-readable format, or have it transmitted to another controller (Art. 20 GDPR).
• Complaint to a supervisory authority: you can complain to a data protection supervisory authority, in particular in the EU member state where you live, where you work or where the alleged infringement took place (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

To exercise your rights, write to ask@awaited.eu.

No automated decisions

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Jan Karres and Matthias Günter read every pitch themselves and decide on it together.

Changes to this privacy policy

We update this privacy policy when our website or the way we process data changes. The current version is always available on this page. The date at the top shows when we last changed it.