Legal Notice & Privacy Policy

Legal notice

Phone: +49 221 828282 40
Email: contact@honestly.com

Managing directors: Sven Bläse, Sebastian Wenzel

Register court: Local Court (Amtsgericht) of Cologne
Register number: HRB 84298
VAT ID: DE284320814

Responsible for content pursuant to Section 18(2) of the German Interstate Media Treaty (MStV): Sven Bläse (address as above)

Disclaimer

Despite careful review, we accept no liability for the content of external links. The operators of linked pages are solely responsible for their content.

Privacy policy

Honestly provides companies with software for employee surveys. Below, we explain how we handle your personal data. The controller responsible for processing on this website is Honestly MT GmbH (see legal notice for address). This processing is governed by the General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG) and the German Federal Data Protection Act (BDSG).

Your rights

With regard to your personal data, you have the following rights:

• Right of access (Art. 15 GDPR) to the data stored about you, its origin, its recipients and the purpose of processing
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR): you can receive the data you have provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another controller
• Right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the authority listed below

To exercise any of your rights, please contact our data protection officer or write to the address given in the legal notice. Where we are legally required to retain data, we delete it once the retention period has expired and restrict its processing until then.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims. You may object to the use of your data for direct marketing, such as our newsletter, at any time and without giving reasons.

Our website

Hosting and access data

When you visit our website, our hosting provider automatically processes access data transmitted by your browser, for example your IP address, the date and time of your visit, the page or file requested, the website you came from, and your browser and operating system. This data is needed to deliver the website, keep it stable and secure, and defend against attacks. All data is transmitted in encrypted form (SSL/TLS).

The website is hosted by CloudCannon Limited, New Zealand, and delivered via the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The European Commission has issued an adequacy decision for New Zealand, and Cloudflare is certified under the EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). The data is deleted as soon as it is no longer needed for these purposes.

Inquiries, demo bookings and newsletter

When you contact us via a form, book a demo or sign up for our newsletter, we process the information you provide, for example your name, email address and company. We use it to handle your request and to stay in touch with you. You can unsubscribe from the newsletter at any time using the link included in every issue.

Our forms, demo booking and CRM system are provided by HubSpot. Forms and the booking calendar are loaded from HubSpot servers, which transmits your IP address to HubSpot. The provider is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA. Our contracting partner in the EU is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland. We have concluded a data processing agreement with HubSpot. For transfers to the USA, HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. For more information, see HubSpot's privacy policy.

The legal basis is Art. 6(1)(b) GDPR where your request relates to a potential contract, such as a demo booking, and otherwise our legitimate interest in communicating with customers and prospects (Art. 6(1)(f) GDPR). For the newsletter, the legal basis is your consent (Art. 6(1)(a) GDPR). HubSpot tracking on our website only runs if you consent to it in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Cookies and consent

Our website uses cookies and similar technologies. Strictly necessary cookies are always set; all others are set only with your consent. You can review and change your choices at any time in the cookie settings.

We obtain consent via Cookiebot, a service of Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark. In the process, your browser may transmit personal data to Cookiebot, such as your IP address and your consent choices. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the proper functioning of the website. The data is deleted once the purpose for which it was collected has been fulfilled. For more information, see Cookiebot's privacy policy.

Google Analytics 4

Our website uses the web analytics service Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It is integrated via Google Tag Manager. Google Analytics only sets cookies if you consent to the "Statistics" category in the cookie banner. Without your consent, no analytics cookies are stored on your device (Google Consent Mode v2).

With your consent, Google Analytics records how you use our website, for example which pages you visit, how long you stay and how you found us. This information is transmitted to and stored on Google servers. Google Analytics 4 does not store IP addresses. A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in the cookie settings. For more information, see Google's privacy policy.

Google Ads

We run ads via Google Ads, provided by Google Ireland Limited (address above), and use its conversion tracking. If you reach our website via a Google ad, Google sets a cookie that shows whether a specific action, such as a demo request, took place on our website after the ad was clicked.

Conversion tracking only runs if you consent to the "Marketing" category in the cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you can withdraw at any time in the cookie settings. The information on transfers to the USA given above for Google Analytics applies accordingly. For more information, see Google's privacy policy.

Sharing on LinkedIn

Below our blog articles and guides, you will find a simple link for sharing on LinkedIn. No data is transmitted until you click it. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; for details, see LinkedIn's privacy policy.

Survey platform and Engage App

This section applies to companies that use Honestly and to their employees.

Data processing on behalf of our customers

For processing in connection with surveys, the controller is the company conducting the survey. Honestly processes the data on its behalf and in accordance with its instructions. Please direct any questions about the survey and its legal basis to your employer. You also exercise your rights as a data subject against your employer; Honestly supports your employer in this.

Honestly concludes a data processing agreement (DPA) with every company that uses the platform. Employee responses are transmitted in encrypted form. The company only sees results once a minimum number of responses has been reached (anonymity threshold), which prevents conclusions about individual people. You can find details on how this works in our Help Center.

Employee data

So that employees can take part in surveys, the company provides Honestly with a list of names and email addresses, optionally supplemented by details such as department or location. We use this data only to send out surveys, prevent multiple participation and analyze results by these groups.

Honestly does not pass employee data on to third parties for its own purposes. To operate the platform, we use sub-processors, for example for hosting in ISO 27001-certified data centers in Europe. They process the data exclusively on our behalf and in accordance with our instructions, and they are listed in the data processing agreement.

Engage App

Employees can take part in surveys via the Honestly Engage App for iOS and Android. This requires that their company has registered them as described above; they sign in with their work email address.

For error analysis, the app sends pseudonymized crash reports and usage data to Firebase, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. No employee data or feedback data is transmitted in the process. Google LLC is certified under the EU-U.S. Data Privacy Framework.

AI features

Companies can also analyze feedback with AI features, for example to assign open-text responses to topics or to classify their sentiment. No automated decisions within the meaning of Art. 22 GDPR are made.

Data security

All data is transmitted in encrypted form. Both the platform and the data centers are ISO 27001 certified. Learn more on our security page.

Deletion

We delete survey data after the end of the contract in accordance with the data processing agreement. We retain contract and billing data until the statutory retention periods under German tax and commercial law have expired, and delete it afterwards.

Data protection contact and supervisory authority

Data protection officer

If you have questions about data protection or wish to exercise your rights, please contact our data protection officer, Dominik Fünkner, at datenschutzbeauftragter@datenschutzexperte.de.

Supervisory authority

The supervisory authority responsible for Honestly is:

Last updated: October 21, 2026. This English version is provided for convenience. In case of any discrepancy, the German version prevails.