Legal

Privacy Policy

Last updated: 31.12.2100

1. Introduction

Below, we provide information on the processing of personal data when using

our website heydata.eu
our social media profiles.

Personal data is any information that can be linked to a specific natural person, such as their name or IP address.

1.1. Contact details

The controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany, email: info@heydata.eu. We are legally represented by Milos Djurdjevic and Daniel Deutsch.

Our Data Protection Officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.

1.2. Scope of data processing, purposes of processing, and legal bases

We detail the scope of data processing, the purposes of processing, and the legal bases below. In principle, the following may serve as the legal basis for data processing:

Article 6(1)(a) of the GDPR serves as the legal basis for processing operations for which we obtain consent.
Article 6(1)(b) of the GDPR serves as the legal basis when processing personal data is necessary to fulfill a contract, for example, when a visitor purchases a product from us or we provide a service for them. This legal basis also applies to processing required for pre-contractual measures, such as inquiries about our products or services.
Article 6(1)(c) of the GDPR applies when we process personal data to fulfill a legal obligation, such as in tax law.
Art. 6(1) sentence 1(f) GDPR serves as the legal basis when we rely on legitimate interests to process personal data, for example, for cookies that are necessary for the technical operation of our website.

1.3. Data processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, adequacy decisions by the EU Commission pursuant to Art. 45(3) GDPR guarantee the security of the data during transfer, where such decisions exist, as is the case for the UK, Canada, and Israel, for example.

When transferring data to service providers in the USA, the legal basis for the transfer is an adequacy decision by the EU Commission, provided the service provider is additionally certified under the EU-U.S. Data Privacy Framework.

In other cases (e.g., where no adequacy decision exists), the legal basis for data transfer is generally standard contractual clauses, unless we provide a different indication. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. Pursuant to Art. 46(2)(b) GDPR, they ensure the security of data transfers. Many providers have provided contractual guarantees beyond the standard contractual clauses that protect data even further. These include, for example, guarantees regarding data encryption or the third party's obligation to notify data subjects if law enforcement agencies seek access to the data.

1.4. Storage period

Unless expressly stated otherwise in this privacy policy, data stored by us will be deleted as soon as it is no longer required for its intended purpose and provided that no statutory retention obligations prevent such deletion. If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted; i.e., the data will be blocked and not processed for other purposes. This applies, for example, to data that we must retain for commercial or tax law reasons.

1.5. Rights of data subjects

Data subjects have the following rights regarding their personal data held by us:

Right of access,
Right to rectification or erasure,
Right to restriction of processing,
Right to object to processing,
Right to data portability,
Right to withdraw consent at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. Contact details for data protection supervisory authorities can be found at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6. Obligation to provide data

As part of our business or other relationships, customers, prospective clients, or third parties are only required to provide the personal data necessary for the establishment, execution, and termination of the relationship, or data that we are legally obligated to collect. Without this data, we will generally be unable to enter into a contract or provide a service, or we may be unable to continue an existing contract or relationship.

Mandatory fields are marked as such.

1.7. No automated individual decision-making

We generally do not use fully automated decision-making as per Article 22 GDPR for the establishment and implementation of a business relationship or other relationship. Should we use these procedures in individual cases, we will inform you separately if required by law.

1.8. Contacting us

When you contact us, e.g., by email or telephone, the data you provide (e.g., names and email addresses) is stored by us to answer your questions. The legal basis for this processing is our legitimate interest (Art. 6(1)(f) GDPR) in responding to inquiries directed at us. We delete the data generated in this context once storage is no longer necessary, or restrict processing if statutory retention requirements apply.

1.9. Prize draws

We occasionally offer prize draws via our website or through other means. We process the data requested for these to determine and notify the winners. We then delete the data. We may also offer prize draws exclusively for existing customers. In such cases, we only process names to determine the winners and contact details to notify them. It is our legitimate interest to offer prize draws for customer acquisition or to interact with our existing customers. The legal basis for this data processing is Art. 6(1)(f) GDPR.

1.10. Customer surveys

From time to time, we conduct customer surveys to better understand our customers and their needs. We collect the data requested in each case. It is our legitimate interest to better understand our customers and their needs, making Art. 6(1)(f) GDPR the legal basis for the associated data processing. We delete the data once the survey results have been analyzed.

1.11. Whitepapers

Interested parties can obtain free whitepapers from us. In exchange for providing these whitepapers free of charge, we may contact interested parties via email and telephone to present a contract offer. The legal basis for this processing is the contract concluded with the interested party regarding the free receipt of the whitepaper and the promotional use of their contact data.

Interested parties may object to being contacted at any time, for example, by using the contact details provided above.

2. Newsletter

We reserve the right to inform customers who have already used our services or purchased goods about our offers from time to time via email or other means, provided they have not objected to this. The legal basis for this data processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in direct marketing (Recital 47 GDPR). Customers may object to the use of their email address for marketing purposes at any time at no additional cost, for example, via the link at the end of every email or by sending an email to the address mentioned above.

Interested parties have the option to subscribe to a free newsletter. We process the data provided during registration exclusively for the purpose of sending the newsletter. Registration occurs by selecting the corresponding field on our website, checking the appropriate box on a paper document, or through another clear affirmative action by which interested parties declare their consent to the processing of their data; the legal basis is Art. 6(1)(a) GDPR. Consent can be withdrawn at any time, for example, by clicking the link provided in the newsletter or by notifying us at the email address mentioned above. The lawfulness of data processing prior to withdrawal remains unaffected.

Based on the recipients' consent (Art. 6(1)(a) GDPR), we also measure the open and click rates of our newsletters to understand which content is relevant to our recipients.

We send newsletters using the tool HubSpot, provided by HubSpot, Inc., 25 1st Street, Cambridge, MA 02141, USA. The provider processes content, usage, meta/communication, and contact data within the EU. Further information is available in the provider's privacy policy at https://legal.hubspot.com/de/privacy-policy.

3. Data processing on our website

3.1. Notice for website visitors from Germany

Our website stores information on website visitors' end devices (e.g., cookies) or accesses information already stored on the end device (e.g., IP addresses). Details regarding this information can be found in the following sections.

This storage and access is based on the following provisions:

Insofar as this storage or access is strictly necessary for us to provide the service on our website that is expressly requested by website visitors (e.g., to operate a chatbot used by the visitor or to ensure the IT security of our website), it is based on Section 25(2) no. 2 of the Telecommunications-Digital Services-Data Protection Act (TDDDG).
Otherwise, this storage or access is based on the consent of the website visitors (Section 25(1) TDDDG).

Subsequent data processing is carried out in accordance with the following sections and based on the provisions of the GDPR.

3.2. Informational use of the website

When using the website for informational purposes—that is, if site visitors do not provide us with information separately—we collect the personal data that the browser transmits to our server to ensure the stability and security of our website. This constitutes our legitimate interest, making Article 6(1)(f) GDPR the legal basis.

This data includes:

IP address
Date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Volume of data transferred
Website from which the request originates
Browser
Operating system and its interface
Language and version of the browser software.

This data is also stored in log files. It is deleted when it is no longer required, at the latest after 14 days.

3.3. Web hosting and website provision

Our website is hosted by Hetzner. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The provider processes the personal data transmitted via the website, such as content, usage, meta/communication, or contact data, within the EU. Further information can be found in the provider's privacy policy at https://www.hetzner.com/de/rechtliches/datenschutz.

It is our legitimate interest to provide a website, so the legal basis for the described data processing is Art. 6(1)(f) GDPR.

3.4. Contact form

When you contact us via the contact form on our website, we store the data requested there and the content of your message.
The legal basis for this processing is our legitimate interest in responding to inquiries directed at us. Therefore, the legal basis for the processing is Art. 6(1)(f) GDPR.
We delete the data collected in this context once it is no longer required for storage, or we restrict processing if there are statutory retention obligations.

3.5. Job advertisements

We publish job advertisements on our website, on pages linked to our website, or on third-party websites.
Data provided during the application process is processed for the purpose of conducting the application procedure. Where this data is necessary for our decision to establish an employment relationship, the legal basis is Art. 88(1) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG). We have marked or indicated the data required to conduct the application process. If applicants do not provide this data, we cannot process their application.
Other data is provided voluntarily and is not required for an application. If applicants provide additional information, the basis for this is their consent (Art. 6(1)(a) GDPR).

We ask applicants to refrain from including information about political opinions, religious beliefs, or similar sensitive data in their CVs and cover letters. This information is not required for an application. If applicants provide such information anyway, we cannot prevent its processing as part of the CV or cover letter. Its processing is then also based on the applicant's consent (Art. 9(2)(a) GDPR).

Finally, we process applicant data for future application processes if they have given us their consent to do so. In this case, the legal basis is Art. 6(1)(a) GDPR.

We share applicant data with the relevant HR staff, our recruitment data processors, and other employees involved in the application process.

If we enter into an employment relationship with the applicant following the application process, we will only delete the data after the employment relationship has ended. Otherwise, we will delete the data no later than six months after an applicant has been rejected.

If applicants have given us their consent to use their data for future application processes, we will delete their data one year after receiving the application.

3.6. Booking appointments

Site visitors can book appointments with us via our website. For this purpose, we process the data entered as well as meta or communication data. We have a legitimate interest in offering prospective customers a user-friendly way to schedule appointments. Therefore, the legal basis for this data processing is Art. 6(1)(f) GDPR. Where we use a third-party tool for scheduling, information regarding this can be found under "Third-party providers."

3.7. Login area

We maintain a login area for customers. In this context, we process data based on the data processing agreement concluded with our customers.

3.8. Technically necessary cookies

Our website uses cookies. Cookies are small text files stored in the web browser on a visitor's device. Cookies help make our services more user-friendly, effective, and secure. Where these cookies are necessary for the operation of our website or its functions (hereinafter "technically necessary cookies"), the legal basis for the associated data processing is Art. 6(1)(f) GDPR. We have a legitimate interest in providing customers and other site visitors with a functional website.
Specifically, we use technically necessary cookies for the following purpose(s):

Cookies that store language settings

3.9. Third-party providers

3.9.1. LinkedIn Ads

We use LinkedIn Ads for advertising. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) within the EU.

The legal basis for processing is Art. 6(1)(a) GDPR. Processing is based on consent. Data subjects may withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

We delete data once the purpose for its collection no longer applies. Further information is available in the provider's privacy policy at https://www.linkedin.com/legal/privacy-policy?.

3.9.2. HubSpot

We use HubSpot for lead generation, marketing automation, and analytics. The provider is HubSpot, Inc., 25 1st Street, Cambridge, MA 02141, USA. The provider processes usage data (e.g., websites visited, interest in content, access times), content data (e.g., entries in online forms), and meta/communication data (e.g., device information, IP addresses) in the EU.

The legal basis for processing is Art. 6(1)(f) GDPR. We have a legitimate interest in managing data in a simple and cost-effective manner.

Data is deleted once the purpose for its collection no longer applies and there are no legal retention requirements to the contrary. Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.

3.9.3. LinkedIn Insight Tag

We use the LinkedIn Insight Tag for conversion tracking. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the EU.

3.9.4. Usercentrics

We use Usercentrics for consent management. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. The provider processes meta/communication data (e.g., device information, IP addresses) in the EU.

The legal basis for processing is Art. 6(1)(f) GDPR. We have a legitimate interest in managing website visitor cookie consent in a simple manner.

3.9.5. Strapi

We use Strapi for content management. The provider is Strapi, Inc., 3500 S Dupont Hwy, Dover, DE 19901, USA. The provider processes meta/communication data (e.g., device information, IP addresses) in the USA.

The legal basis for processing is Art. 6(1)(f) GDPR. We have a legitimate interest in managing content efficiently.

Personal data is transferred to a country outside the EEA based on standard contractual clauses. The security of data transferred to the third country (i.e., a country outside the EEA) is guaranteed by standard data protection clauses adopted in accordance with the review procedure under Art. 93(2) GDPR (Art. 46(2)(c) GDPR), which we have agreed upon with the provider.

3.9.6. G2

We use G2 for customer reviews and to receive product feedback. The provider is G2.com, Inc., 100 S. Wacker Dr., Ste. 600, Chicago, IL 60606, USA. The provider processes usage data (e.g., websites visited, interest in content, access times), contact data (e.g., email addresses, phone numbers), meta/communication data (e.g., device information, IP addresses), and master data (e.g., names, addresses) in the USA.

The legal basis for processing is Art. 6 (1) sentence 1 (f) GDPR. We have a legitimate interest in improving our product based on reviews.

Personal data is transferred to a country outside the EEA based on an adequacy decision. The security of data transferred to a third country (i.e., a country outside the EEA) is guaranteed because the EU Commission has determined, within the framework of an adequacy decision pursuant to Art. 45 (3) GDPR, that the third country offers an adequate level of protection.

Data is deleted once the purpose for its collection has been fulfilled and no statutory retention requirements prevent its deletion. Further information is available in the provider's privacy policy at https://legal.g2.com/privacy-policy.

3.9.7. Meta Pixel

We use Meta Pixel for analysis. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.

The legal basis for processing is Art. 6 (1) sentence 1 (a) GDPR. Processing is based on consent. Data subjects may withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

3.9.8. Google Analytics

We use Google Analytics for analysis. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

3.9.9. Google Conversion Tag

We use Google Conversion Tag for conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.

3.9.10. YouTube Videos

We use YouTube to display videos on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

Personal data is transferred to a country outside the EEA based on consent.

Further information is available in the provider's privacy policy at https://policies.google.com/privacy.

3.9.11. Reddit Conversion Pixel

We use Reddit Conversion Pixel for analytics. The provider is Reddit, Inc., 548 Market St. #16093, San Francisco, California 94104, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

Personal data is transferred to a country outside the EEA based on standard contractual clauses. The security of data transferred to the third country (i.e., a country outside the EEA) is guaranteed by standard data protection clauses adopted in accordance with the examination procedure under Art. 93(2) GDPR (Art. 46(2)(c) GDPR), which we have agreed upon with the provider.

Data is deleted once the purpose for its collection has been fulfilled and no statutory retention obligations prevent this. Further information is available in the provider's privacy policy at https://www.reddit.com/policies/privacy-policy.

3.9.12. Facebook Conversion API

We use Facebook Conversion API for analytics. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

Personal data is transferred to a country outside the EEA based on an adequacy decision. The security of data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the EU Commission has determined, via an adequacy decision under Art. 45(3) GDPR, that the third country provides an adequate level of protection.

3.9.13. Google Tag Manager

We use Google Tag Manager for analytics and advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.

We delete the data once the purpose for its collection has been fulfilled. Further information is available in the provider's privacy policy at https://policies.google.com/privacy?hl=en.

3.9.14. Zapier

We use Zapier for automation between applications. The provider is Zapier, Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

The legal basis for processing is Art. 6 (1) sentence 1 (f) GDPR. We have a legitimate interest in easily connecting the applications within our company to optimize our workflows.

Personal data is transferred to a country outside the EEA based on an adequacy decision. The security of data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the EU Commission has determined, within the framework of an adequacy decision pursuant to Art. 45 (3) GDPR, that the third country offers an adequate level of protection.

We delete the data once the purpose for its collection no longer applies. Further information is available in the provider's privacy policy at https://zapier.com/privacy.

3.9.15. Facebook Custom Audiences

We use Facebook Custom Audiences for advertising purposes. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.

Personal data is transferred to a country outside the EEA based on an adequacy decision. The security of data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the EU Commission has determined, within the framework of an adequacy decision pursuant to Art. 45 (3) GDPR, that the third country offers an adequate level of protection.

We delete the data once the purpose for its collection no longer applies. Further information is available in the provider's privacy policy at https://www.facebook.com/policy.php.

3.9.16. Google Ads

We use Google Ads for advertising purposes. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

Personal data is transferred to a country outside the EEA based on an adequacy decision. The security of data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the EU Commission has determined, within the framework of an adequacy decision pursuant to Art. 45 (3) GDPR, that the third country offers an adequate level of protection.

We delete the data once the purpose for its collection no longer applies. Further information is available in the provider's privacy policy at https://policies.google.com/privacy?hl=de.

3.9.17. Microsoft Advertising (Bing Ads)

We use Microsoft Advertising (Bing Ads) for analysis and conversion tracking. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.

Personal data is transferred to a country outside the EEA based on an adequacy decision. The security of data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the EU Commission has determined, within the framework of an adequacy decision pursuant to Art. 45 (3) GDPR, that the third country offers an adequate level of protection.

Data is deleted once the purpose for its collection no longer applies and no legal retention requirements prevent its deletion. Further information is available in the provider's privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

3.9.18. Stape

We use Stape for analytics and data analysis. The provider is Stape Europe OÜ, Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) within the EU.

The legal basis for this processing is Article 6(1)(a) of the GDPR. Processing is based on consent. Data subjects may withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Data is deleted once the purpose for its collection has been fulfilled and no legal retention requirements prevent its deletion. Further information is available in the provider's privacy policy at https://stape.io/privacy-notice.

3.9.19. Provenexpert

We use Provenexpert for customer reviews. The provider is Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany. The provider processes usage data (e.g., websites visited, interest in content, access times) within the EU.

3.9.20. Spotify Ads

We use Spotify Ads for advertising and promotional campaigns. The provider is Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) within the EU.

3.9.21. VidLab7

We use VidLab7 for artificial intelligence features for videos on our website. The provider is VidLab7 GmbH, Rosental 7, 80331 Munich, Germany. The provider processes meta/communication data (e.g., device information, IP addresses) and usage data (e.g., websites visited, interest in content, access times) within the EU.

3.9.22. Make

We use Make for automation between applications. The provider is Celonis, Inc., One World Trade Center, 87th Floor, New York, NY, 10007, USA. The provider processes meta/communication data (e.g., device information, IP addresses) and usage data (e.g., websites visited, interest in content, access times) within the EU.

The legal basis for this processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in easily connecting applications within our company to optimize our workflows.

3.9.23. n8n

We use n8n for workflow automation. The provider is n8n GmbH, Borsigstr. 27, 10115 Berlin. The provider processes usage data (e.g., websites visited, interest in content, access times), contact data (e.g., email addresses, phone numbers), and meta/communication data (e.g., device information, IP addresses) within the EU.

The legal basis for processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in retrieving data quickly and effectively.

Data is deleted once the purpose for its collection has been fulfilled and no statutory retention obligations prevent such deletion. Further information is available in the provider's privacy policy at https://n8n.io/legal/#privacy.

3.9.24. Google Consent Mode v2

We use Google Consent Mode v2 for consent management. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes meta/communication data (e.g., device information, IP addresses) in the USA.

Consent Mode ensures that Google services (e.g., Google Analytics, Google Ads) only process personal data such as IP addresses or online identifiers if you have given us your consent. You can withdraw or adjust your consent at any time via our cookie settings. If you do not provide consent, only anonymous or aggregated data will be transmitted.

The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of data transferred to a third country (i.e., a country outside the EEA) is guaranteed because the EU Commission has decided, within the framework of an adequacy decision under Article 45(3) of the GDPR, that the third country offers an adequate level of protection.

The legal basis for processing is Article 6(1)(c) of the GDPR. Processing is necessary for compliance with a legal obligation to which we are subject.

We delete the data once the purpose for its collection has been fulfilled. Further information is available in the provider's privacy policy at https://policies.google.com/privacy?hl=en.

4. Data processing in conversations

4.1. Aircall

We use Aircall for telephone calls. The provider is Aircall SAS, 11 Rue Saint-Georges, 75009 Paris, France. The provider processes meta/communication data (e.g., contact numbers, IP addresses where applicable) in the USA.

The legal basis for processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in contacting our customers.

The legal basis for the transfer to a country outside the EEA is standard contractual clauses. The security of data transferred to a third country (i.e., a country outside the EEA) is guaranteed by standard data protection clauses adopted in accordance with the review procedure under Article 93(2) of the GDPR (Article 46(2)(c) of the GDPR), which we have agreed upon with the provider.

4.2. Kickscale

We use Kickscale to record conversations in order to simplify our internal filing. The provider is Kickscale GmbH, Stella-Klein-Löw-Weg 8, 1020 Vienna. The provider processes recordings of conversations and their content within the EU.

The legal basis for processing is Article 6(1)(a) of the GDPR. Processing is based on consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. Data processing in software products

The website through which customers log into our web app is hosted by Amazon AWS. The provider is Amazon Web Services EMEA Sàrl, Avenue John F. Kennedy 38, 1855 Luxembourg, Luxembourg. The provider processes the personal data transmitted via the website, e.g., content, usage, meta/communication data, or contact details, within the EU. Further information can be found in the provider's privacy policy at https://aws.amazon.com/privacy/.

It is our legitimate interest to provide our customers with an easily accessible login option, so the legal basis for the described data processing is Art. 6(1)(f) GDPR.

After logging in, we process personal data on the basis of the data processing agreement concluded with our customers.

In our software products, we offer the option to link third-party software via integrations. We provide such an option for Google Workspace, among others. In doing so, we comply with the requirements of Google's Limited Use Policy, which can be found at https://developers.google.com/terms/api-services-user-data-policy. For the sake of clarity, we state that our software products do not share data with third-party AI platforms.

6. Data processing on social media platforms

We are present on social media networks to introduce our organization and services. The operators of these networks regularly process user data for advertising purposes. Among other things, they create user profiles based on online behavior, which are used, for example, to display interest-based advertisements on the networks' pages and elsewhere on the internet. To this end, the network operators store information about usage behavior in cookies on the users' computers. It also cannot be ruled out that the operators may combine this information with other data. Further information and instructions on how users can object to processing by the site operators can be found in the privacy policies of the respective operators listed below. It is also possible that the operators or their servers are located in non-EU countries, meaning they process data there. This may result in risks for users, for example, because the enforcement of their rights may be more difficult or government authorities may have access to the data.

When users of these networks contact us via our profiles, we process the data provided to us in order to respond to their inquiries. This constitutes our legitimate interest, making Art. 6(1)(f) GDPR the legal basis.

6.1. Facebook

We maintain a profile on Facebook. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy can be found here: https://www.facebook.com/policy.php. You can object to data processing via the ad settings: https://www.facebook.com/settings?tab=ads.
Based on an agreement, we are joint controllers with Facebook within the meaning of Art. 26 GDPR for the processing of data of visitors to our profile. Facebook explains exactly which data is processed at https://www.facebook.com/legal/terms/information_about_page_insights_data. Data subjects can exercise their rights against both us and Facebook. However, under our agreement with Facebook, we are obligated to forward inquiries to Facebook. Data subjects will therefore receive a faster response if they contact Facebook directly.

6.2. Instagram

We maintain a profile on Instagram. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy can be found here: https://help.instagram.com/519522125107875.

6.3. TikTok

We maintain a profile on TikTok. The operator is TikTok Technology Limited, whose registered office is at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. The privacy policy can be found here: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

6.4. YouTube

We maintain a profile on YouTube. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The privacy policy can be found here: https://policies.google.com/privacy.

6.5. X (formerly Twitter)

We maintain a profile on X. The operator is X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. The privacy policy can be found here: https://twitter.com/en/privacy. You can object to data processing via the ad settings: https://twitter.com/personalization.

6.6. LinkedIn

We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy can be found here: https://www.linkedin.com/legal/privacy-policy. You can object to data processing via the ad settings: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

6.7. Xing

We maintain a profile on Xing. The operator is New Work SE, Dammtorstraße 29-32, 20354 Hamburg. The privacy policy can be accessed here: https://privacy.xing.com/de/datenschutzerklaerung.

7. Changes to this privacy policy

We reserve the right to amend this privacy policy with future effect. The current version is available here.

8. Questions and comments

If you have any questions or comments regarding this privacy policy, please feel free to contact us using the contact details provided above.

‍

Privacy Policy

1. Introduction

1.1. Contact details

1.2. Scope of data processing, purposes of processing, and legal bases

1.3. Data processing outside the EEA

1.4. Storage period

1.5. Rights of data subjects

1.6. Obligation to provide data

1.7. No automated individual decision-making

1.8. Contacting us

1.9. Prize draws

1.10. Customer surveys

1.11. Whitepapers

2. Newsletter

3. Data processing on our website

3.1. Notice for website visitors from Germany

3.2. Informational use of the website

3.3. Web hosting and website provision

3.4. Contact form

3.5. Job advertisements

3.6. Booking appointments

3.7. Login area

3.8. Technically necessary cookies

3.9. Third-party providers

4. Data processing in conversations

4.1. Aircall

4.2. Kickscale

5. Data processing in software products

6. Data processing on social media platforms

6.1. Facebook

6.2. Instagram

6.3. TikTok

6.4. YouTube

6.5. X (formerly Twitter)

6.6. LinkedIn

6.7. Xing

7. Changes to this privacy policy

8. Questions and comments

Heading