Privacy Policy

1. Introduction

Below we explain how personal data is processed when you use

our website strategyframe.ai
our social media profiles.

Personal data is any data that can be related to a specific natural person, such as their name or IP address.

1.1 Contact details

The controller pursuant to Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is StrategyFrame® GmbH, Düsseldorfer Straße 181, Düsseldorf, Germany, email: info@strategy-frame.com. We are legally represented by Christian Underwood, Daniel Theobald.

Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.

1.2 Scope of data processing, purposes of processing and legal bases

We set out the scope of the data processing, the purposes of processing and the legal bases in detail below. In principle, the following legal bases may apply to data processing:

Art. 6 (1) sentence 1 lit. a GDPR serves as our legal basis for processing operations for which we obtain consent.
Art. 6 (1) sentence 1 lit. b GDPR is the legal basis where the processing of personal data is necessary to perform a contract, for example when a site visitor purchases a product from us or we perform a service for them. This legal basis also applies to processing that is necessary for pre-contractual measures, such as inquiries about our products or services.
Art. 6 (1) sentence 1 lit. c GDPR applies where we process personal data to comply with a legal obligation, as may be the case under tax law, for example.
Art. 6 (1) sentence 1 lit. f GDPR serves as the legal basis where we can rely on legitimate interests to process personal data, for example for cookies that are necessary for the technical operation of our website.

1.3 Data processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, adequacy decisions of the EU Commission pursuant to Art. 45 (3) GDPR guarantee the security of the data during the transfer, provided such decisions exist, as is the case for the United Kingdom, Canada and Israel, for example.

When data is transferred to service providers in the USA, the legal basis for the transfer is an adequacy decision of the EU Commission, provided the service provider is additionally certified under the EU US Data Privacy Framework.

In other cases (for example where no adequacy decision exists), the legal basis for the transfer is generally, that is unless we state otherwise, standard contractual clauses. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. Pursuant to Art. 46 (2) lit. b GDPR, they ensure the security of the data transfer. Many providers have given contractual guarantees that go beyond the standard contractual clauses and protect the data beyond them. These include, for example, guarantees regarding the encryption of the data or regarding an obligation of the third party to notify data subjects if law enforcement authorities seek to access the data.

1.4 Retention period

Unless expressly stated otherwise in this privacy policy, the data we store is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. Where data is not deleted because it is required for other, legally permissible purposes, its processing is restricted, meaning the data is blocked and not processed for other purposes. This applies, for example, to data that we must retain for commercial or tax law reasons.

1.5 Rights of data subjects

Data subjects have the following rights against us with regard to the personal data concerning them:

right of access,
right to rectification or erasure,
right to restriction of processing,
right to object to processing,
right to data portability,
right to withdraw consent given at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority about the processing of their personal data. Contact details of the data protection supervisory authorities are available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6 Obligation to provide data

Within the scope of a business relationship or other relationship, customers, prospects or third parties only have to provide us with the personal data that is required to establish, carry out and end the business relationship or other relationship, or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude a contract or provide a service, or we will no longer be able to carry out an existing contract or other relationship.

Mandatory information is marked as such.

1.7 No automated decision-making in individual cases

To establish and carry out a business relationship or other relationship, we generally do not use fully automated decision-making pursuant to Article 22 GDPR. Should we use such procedures in individual cases, we will provide separate information about this where legally required.

1.8 Contacting us

When you contact us, for example by email or telephone, the data you provide (such as names and email addresses) is stored by us in order to answer questions. The legal basis for the processing is our legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR) in answering inquiries addressed to us. We delete the data arising in this context once storage is no longer necessary, or we restrict the processing if statutory retention obligations apply.

We reserve the right to inform customers who have already used our services or purchased goods from us about our offerings from time to time by email or by other means, provided they have not objected. The legal basis for this data processing is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in direct marketing (recital 47 GDPR). Customers can object to the use of their email address for advertising purposes at any time at no additional cost, for example via the link at the end of every email or by emailing the address given above.

Interested parties can subscribe to a free newsletter. We process the data provided at registration solely for sending the newsletter. Registration takes place by selecting the corresponding field on our website, by checking the corresponding box in a paper document, or through another clear affirmative action by which interested parties declare their consent to the processing of their data, meaning that the legal basis is Art. 6(1)(1)(a) GDPR. Consent can be withdrawn at any time, for example by clicking the corresponding link in the newsletter or by notifying us at the email address given above. The processing of data up to the point of withdrawal remains lawful even in the event of withdrawal.

On the basis of the recipients' consent (Art. 6(1)(1)(a) GDPR), we also measure the open and click rates of our newsletters in order to understand which content is relevant to our recipients.

We send newsletters using the HubSpot tool provided by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin. In doing so, the provider processes content, usage, meta/communication and contact data within the EU. Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.

3. Data processing on our website

3.1 Notice for website visitors from Germany

Our website stores information on website visitors' terminal equipment (e.g. cookies) or accesses information already stored on that equipment (e.g. IP addresses). Details of this information can be found in the following sections.

This storage and access take place on the basis of the following provisions:

Where such storage or access is strictly necessary for us to provide the service of our website expressly requested by website visitors (e.g. to run a chatbot used by the website visitor or to ensure the IT security of our website), it takes place on the basis of Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
In all other cases, such storage or access takes place on the basis of the website visitors' consent (Section 25(1) TDDDG).

Subsequent data processing takes place in accordance with the following sections and on the basis of the provisions of the GDPR.

3.2 Informational use of the website

When the website is used for informational purposes only, meaning when site visitors do not send us any information separately, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This constitutes our legitimate interest, meaning that the legal basis is Art. 6(1)(1)(f) GDPR.

This data includes:

IP address
Date and time of the request
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Volume of data transferred in each case
Website from which the request originates
Browser
Operating system and its interface
Language and version of the browser software.

This data is also stored in log files. It is deleted once its storage is no longer necessary, at the latest after 14 days.

3.3 Web hosting and provision of the website

Our website is hosted by Vercel. The provider is Vercel Inc., 340 S Lemon Ave Unit 4133 Walnut, CA, USA. In doing so, the provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication or contact data, within the EU. Further information can be found in the provider's privacy policy at https://vercel.com/legal/privacy-policy.

It is our legitimate interest to provide a website, meaning that the legal basis for the data processing described is Art. 6(1)(1)(f) GDPR.

Our website is hosted by Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. In doing so, the provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication or contact data, within the EU. Further information can be found in the provider's privacy policy at https://www.shopify.de/legal/datenschutz.

It is our legitimate interest to provide a website, meaning that the legal basis for the data processing described is Art. 6(1)(1)(f) GDPR.

We use the Vercel content delivery network for our website. The provider is Vercel Inc., 340 S Lemon Ave Unit 4133 Walnut, CA, USA. In doing so, the provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication or contact data, within the EU. Further information can be found in the provider's privacy policy at https://vercel.com/legal/privacy-policy.

We have a legitimate interest in using sufficient storage and delivery capacity to ensure optimal data throughput even during heavy peak loads. The legal basis for the data processing described is therefore Art. 6(1)(1)(f) GDPR.

We use the Shopify content delivery network for our website. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. In doing so, the provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication or contact data, in the USA. Further information can be found in the provider's privacy policy at https://www.shopify.de/legal/datenschutz.

The legal basis for the transfer to a country outside the EEA is standard contractual clauses. The security of the data transferred to the third country (i.e. a country outside the EEA) is ensured by standard data protection clauses adopted in accordance with the examination procedure under Art. 93(2) GDPR (Art. 46(2)(c) GDPR), which we have agreed with the provider.

3.4 Contact form

When you contact us via the contact form on our website, we store the data requested there and the content of the message. The legal basis for the processing is our legitimate interest in responding to inquiries addressed to us. The legal basis for the processing is therefore Art. 6(1)(1)(f) GDPR. We delete the data arising in this context once storage is no longer necessary, or we restrict the processing if statutory retention obligations apply.

3.5 Job postings

We publish job postings on our website, on pages connected to the website, or on third-party websites. The data provided as part of an application is processed in order to carry out the application procedure. Insofar as this data is necessary for our decision on whether to enter into an employment relationship, the legal basis is Art. 88(1) GDPR in conjunction with Section 26(1) BDSG. We have marked the data required to carry out the application procedure accordingly or point it out. If applicants do not provide this data, we cannot process the application. Any additional data is voluntary and not required for an application. If applicants provide further information, the basis is their consent (Art. 6(1)(1)(a) GDPR).

We ask applicants not to include information about political opinions, religious beliefs or similarly sensitive data in their résumé and cover letter. Such information is not required for an application. If applicants provide it anyway, we cannot prevent it from being processed as part of processing the résumé or cover letter. In that case, its processing is also based on the applicant's consent (Art. 9 para. 2 lit. a GDPR).

Finally, we process applicants' data for further application procedures if they have given us their consent to do so. In this case, the legal basis is Art. 6 para. 1 sent. 1 lit. a GDPR.

We pass on applicants' data to the responsible employees in the HR department, to our processors in the area of recruiting and to the other employees involved in the application procedure.

If we enter into an employment relationship with the applicant following the application procedure, we do not delete the data until the employment relationship has ended. Otherwise, we delete the data no later than six months after an applicant has been rejected.

If applicants have given us their consent to use their data for further application procedures as well, we do not delete their data until one year after receipt of the application.

3.6 Booking appointments

Site visitors can book appointments with us on our website. For this purpose, we process metadata or communication data in addition to the data entered. We have a legitimate interest in offering prospects a user-friendly way to schedule appointments. The legal basis for this data processing is therefore Art. 6 para. 1 sent. 1 lit. f GDPR. Where we use a third-party tool for scheduling, you will find the relevant information under "Third-party providers".

3.7 Customer account

Visitors can open a customer account on our website. We process the data requested in this context in order to fulfill the respective user agreement concluded for the account, so the legal basis for the processing is Art. 6 para. 1 sent. 1 lit. b GDPR.

3.8 Single sign-on

Users can log in to our website using one or more single sign-on procedures. In doing so, they use the login credentials they have already created with a provider. This requires that the user is already registered with the respective provider. When a user logs in via a single sign-on procedure, we receive the information from the provider that the user is logged in with the provider, and the provider receives the information that the user is using the single sign-on procedure on our website. Depending on the user's settings in their account with the provider, the provider may make additional information available to us. The legal basis for this processing is Art. 6 para. 1 sent. 1 lit. f GDPR. We have a legitimate interest in providing users with a simple login option. At the same time, users' interests are safeguarded, since use is entirely voluntary.

The provider or providers of the procedures offered are:

Auth0

3.9 Offering goods and services

We offer goods and services via our website. As part of the order process, we process the following data:

Name
Company
Address
Email
Position in the company
Phone number
Credit card information

The data is processed in order to perform the contract concluded with the respective site visitor (Art. 6 para. 1 sent. 1 lit. b GDPR).

We pass on the data listed above to the following service providers to the extent this is necessary to process the order:

Leon Fulfillment GmbH, Bockholtstraße 96-98, 41460 Neuss, Germany

The legal basis for the processing is Art. 6 para. 1 sent. 1 lit. b GDPR, as it is necessary to perform the contract.

3.10 Payment service providers

We use payment processors to handle payments; these processors are themselves controllers within the meaning of Art. 4 no. 7 GDPR. Where they receive data entered during the order process and payment data from us, we do so in order to perform the contract concluded with our customers (Art. 6 para. 1 sent. 1 lit. b GDPR).

These payment service providers are:

Apple Inc., USA (for Apple Pay)
Klarna Bank AB (publ), Sweden (for "Klarna auf Rechnung")
Mastercard Europe SA, Belgium
Shopify Inc., Canada (for Shop Pay)
Stripe Payments Europe, Ltd., Ireland
Visa Europe Services Inc., Great Britain

3.11 Technically necessary cookies

Our website uses cookies. Cookies are small text files stored in the web browser on a site visitor's device. Cookies help make our offering more user-friendly, more effective and more secure. Where these cookies are necessary for the operation of our website or its functions (hereinafter "technically necessary cookies"), the legal basis for the associated data processing is Art. 6 para. 1 sent. 1 lit. f GDPR. We have a legitimate interest in providing customers and other site visitors with a functioning website. Specifically, we use technically necessary cookies for the following purposes:

Cookies that save the shopping cart
Cookies that save login data
Cookies that remember search terms
Cookies that store language settings
Cookies set by payment providers to process payments and not to analyze user behavior
Flash cookies set to play back media content

3.12 Third-party providers

3.12.1 HubSpot

We use HubSpot for analytics, marketing automation, and lead generation. The provider is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. The provider processes usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), and content data (e.g., entries in online forms) within the EU.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in managing data in a simple and cost-effective way.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligations prevent deletion.

Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.

3.12.2 Weglot

We use Weglot for translations. The provider is Weglot, 138, rue Pierre Joigneaux in BOIS-COLOMBES (92270), France. The provider processes meta/communication data (e.g., device information, IP addresses) within the EU.

The legal basis for the processing is Art. 6(1)(1)(a) GDPR. The processing is based on consent. Data subjects can withdraw their consent at any time, for example by contacting us using the contact details provided in our Privacy Policy. The withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://weglot.com/de/privacy/.

3.12.3 HubSpot LiveChat

We use HubSpot LiveChat as a live chat tool. The provider is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. The provider processes usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), and content data (e.g., entries in online forms) within the EU.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligations prevent deletion.

Further information is available in the provider's privacy policy at https://legal.hubspot.com/de/privacy-policy.

3.12.4 Microsoft Clarity

We use Microsoft Clarity for analytics and to identify business opportunities. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) within the EU.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

3.12.5 GDPR Legal Cookie

We use GDPR Legal Cookie to manage consent. The provider is beeclever GmbH, Universitätsstraße 3, 56070 Koblenz, Germany. The provider processes meta/communication data (e.g., device information, IP addresses) within the EU.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in managing website visitors' cookie consent in a simple way.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://gdpr-legal-cookie.com/pages/datenschutzerklarung.

3.12.6 Auth0

We use Auth0 to manage authentication. The provider is Okta, Inc, 100 First Street, San Francisco, California 94105, USA. The provider processes contact data (e.g., email addresses, phone numbers), meta/communication data (e.g., device information, IP addresses), and master data (e.g., names, addresses) within the EU.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in adequately authenticating users of our applications.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://auth0.com/privacy.

3.12.7 Spotify

We use Spotify for audio streaming. The provider is Spotify AB, Regeringsgatan 19. SE-111 53 Stockholm, Sweden. The provider processes meta/communication data (e.g., device information, IP addresses), usage data (e.g., websites visited, interest in content, access times), and location data within the EU.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://www.spotify.com/de/legal/privacy-policy/.

3.12.8 LinkedIn Ads

We use LinkedIn Ads for advertising. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the EU.

The legal basis for processing is Art. 6(1)(1)(a) GDPR. Processing takes place on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our Privacy Policy. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://www.linkedin.com/legal/privacy-policy?.

3.12.9 DeepL

We use DeepL for translations. The provider is DeepL SE, Maarweg 165, 50825 Cologne, Germany. The provider processes usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses) and content data (e.g., entries in online forms) in the EU.

The legal basis for processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in offering our products translated into different languages in order to make them more accessible.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://www.deepl.com/de/privacy.

3.12.10 Azure OpenAI Service

We use Azure OpenAI Service for artificial intelligence features. The provider is Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times), content data (e.g., entries in online forms) and meta/communication data (e.g., device information, IP addresses) in the EU.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://privacy.microsoft.com/de-de/privacystatement?culture=de-de&country=DE.

3.12.11 Google Analytics

We use Google Analytics for analytics. The provider is Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

Personal data is transferred to a country outside the EEA on the legal basis of an adequacy decision. The security of the data transferred to the third country (i.e., a country outside the EEA) is ensured because the EU Commission has determined, by means of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country offers an adequate level of protection.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.12 Google Tag Manager

We use Google Tag Manager for advertising and analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.13 Google Web Fonts

We use Google Web Fonts for fonts on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes meta/communication data (e.g., device information, IP addresses) in the USA.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.14 Meta Pixel

We use Meta Pixel for analytics. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://www.facebook.com/policy.php.

3.12.15 YouTube Videos

We use YouTube Videos for videos on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes meta/communication data (e.g., device information, IP addresses) and usage data (e.g., websites visited, interest in content, access times) in the USA.

Personal data is transferred to a country outside the EEA on the legal basis of consent.

Further information is available in the provider's privacy policy at https://policies.google.com/privacy.

3.12.16 Zapier

We use Zapier for automation between applications. The provider is Zapier, Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

The legal basis for processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in easily connecting the applications used in our company and thus optimizing how we work.

Personal data is transferred to a country outside the EEA on the legal basis of an adequacy decision. The security of data transferred to the third country (i.e., a country outside the EEA) is ensured because the EU Commission has decided, by way of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country offers an adequate level of protection.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://zapier.com/privacy.

3.12.17 Google reCAPTCHA

We use Google reCAPTCHA to manage authentication. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

The legal basis for processing is Art. 6(1)(1)(a) GDPR. Processing takes place on the basis of consent. Data subjects can withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.18 Google Conversion Tag

We use Google Conversion Tag for conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.19 Facebook Conversion API

We use the Facebook Conversion API for analytics. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://www.facebook.com/policy.php.

3.12.20 Paddle

We use Paddle for payments. The provider is Paddle.com Market Limited, 15 Briery Close, Great Oakley, Corby, Northamptonshire, NN18 8JG, United Kingdom. The provider processes content data (e.g., entries in online forms), payment data (e.g., bank details, invoices, payment history) and meta/communication data (e.g., device information, IP addresses) in the United Kingdom.

The legal basis for processing is Art. 6(1)(1)(b) GDPR. Processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://paddle.com/privacy/.

3.12.21 Google Ads

We use Google Ads for advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.22 Stripe

We use Stripe for payments. The provider is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The provider processes payment data (e.g., bank details, invoices, payment history) and master data (e.g., names, addresses) in the USA.

Personal data is transferred to a country outside the EEA on the legal basis of an adequacy decision. The security of the data transferred to the third country (that is, a country outside the EEA) is ensured because the EU Commission has determined, by way of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country offers an adequate level of protection.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://stripe.com/de/privacy#translation.

3.12.23 Google My Business

We use Google My Business for customer reviews, for our public presence and for communication with customers. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes contact data (e.g., email addresses, phone numbers) and meta/communication data (e.g., device information, IP addresses) in the United States.

The legal basis for processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in receiving feedback on our services through reviews from our customers.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.24 Meta Ads

We use Meta Ads for advertising. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the United States.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://www.facebook.com/policy.php.

3.12.25 Google Ads Customer Match

We use Google Ads Customer Match for communication with customers. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses) and contact data (e.g., email addresses, phone numbers) in the United States.

We delete the data once the purpose for which it was collected no longer applies.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.26 google customer reviews

We use google customer reviews for customer satisfaction surveys and customer reviews. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, Ireland. The provider processes contact data (e.g., email addresses, phone numbers), meta/communication data (e.g., device information, IP addresses) and master data (e.g., names, addresses) in the United States.

The legal basis for processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in receiving feedback on our services through reviews from our customers.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation prevents deletion.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

3.12.27 heyData

We have embedded a data protection seal on our website. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g., IP addresses) in the EU.

The legal basis for processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in providing website visitors with confirmation of our data protection compliance. At the same time, the provider has a legitimate interest in ensuring that only customers with active contracts use its seals, which is why a simple image copy of the certificate is not a viable alternative for confirmation.

The data is masked after collection so that it can no longer be linked to a person. Further information is available in the provider's privacy policy at https://heydata.eu/datenschutzerklaerung.

We maintain a presence on social media networks in order to present our organization and our services there. The operators of these networks regularly process their users' data for advertising purposes. Among other things, they create user profiles from online behavior, which are used, for example, to display advertising that matches users' interests, both on the networks' pages and elsewhere on the internet. To do so, the network operators store information about usage behavior in cookies on users' computers. It also cannot be ruled out that the operators combine this information with other data. Users can find further information, as well as instructions on how to object to processing by the platform operators, in the respective operators' privacy policies listed below. It is also possible that the operators or their servers are located in non-EU countries, meaning that they process data there. This may create risks for users, for example because enforcing their rights becomes more difficult or because government authorities may access the data.

If users of these networks contact us through our profiles, we process the data they provide in order to respond to their inquiries. This is our legitimate interest, so the legal basis is Art. 6(1)(1)(f) GDPR.

4.1 YouTube

We maintain a profile on YouTube. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The privacy policy is available here: https://policies.google.com/privacy?hl=de.

4.2 LinkedIn

We maintain a profile on LinkedIn. It is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy is available here: https://www.linkedin.com/legal/privacy-policy?_l=de_DE. You can object to this data processing through the advertising settings: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

5. Changes to this privacy policy

We reserve the right to change this privacy policy with effect for the future. The current version is always available here.

6. Questions and comments

If you have questions or comments about this privacy policy, feel free to reach us using the contact details above.

Privacy Policy

1. Introduction

1.1 Contact details

1.2 Scope of data processing, purposes of processing and legal bases

1.3 Data processing outside the EEA

1.4 Retention period

1.5 Rights of data subjects

1.6 Obligation to provide data

1.7 No automated decision-making in individual cases

1.8 Contacting us

2. Newsletter

3. Data processing on our website

3.1 Notice for website visitors from Germany

3.2 Informational use of the website

3.3 Web hosting and provision of the website

3.4 Contact form

3.5 Job postings

3.6 Booking appointments

3.7 Customer account

3.8 Single sign-on

3.9 Offering goods and services

3.10 Payment service providers

3.11 Technically necessary cookies

3.12 Third-party providers

3.12.1 HubSpot

3.12.2 Weglot

3.12.3 HubSpot LiveChat

3.12.4 Microsoft Clarity

3.12.5 GDPR Legal Cookie

3.12.6 Auth0

3.12.7 Spotify

3.12.8 LinkedIn Ads

3.12.9 DeepL

3.12.10 Azure OpenAI Service

3.12.11 Google Analytics

3.12.12 Google Tag Manager

3.12.13 Google Web Fonts

3.12.14 Meta Pixel

3.12.15 YouTube Videos

3.12.16 Zapier

3.12.17 Google reCAPTCHA

3.12.18 Google Conversion Tag

3.12.19 Facebook Conversion API

3.12.20 Paddle

3.12.21 Google Ads

3.12.22 Stripe

3.12.23 Google My Business

3.12.24 Meta Ads

3.12.25 Google Ads Customer Match

3.12.26 google customer reviews

3.12.27 heyData

4. Data processing on social media platforms

4.1 YouTube

4.2 LinkedIn

5. Changes to this privacy policy

6. Questions and comments