PRIVACY POLICY

Please note: This is a translated version of our Privacy Policy originally written in German. In case of any discrepancies or legal questions, the German version of the Privacy Policy, available at https://kuby.info/de/ueber-uns/datenschutz/, shall prevail and take precedence over this translation.

We, the company KUBY Ltd. (hereinafter referred to as “we” or “us”), take the protection of your personal data seriously and inform you here about the data protection on our website. In the context of our data protection responsibilities, additional duties have been imposed on us with the implementation of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: “GDPR”) to ensure the protection of personal data of the individuals affected by processing (we refer to you, the affected person, hereinafter as “customer,” “user,” “you,” “your,” or “data subject”). To the extent that we, either alone or in cooperation with others, determine the purposes and means of processing personal data, this includes primarily the duty to inform you transparently about the nature, scope, purpose, duration, and legal basis of the processing (cf. Art. 13 and 14 GDPR). With this statement (hereinafter: “Privacy Notice”), we inform you about how we process your personal data.

This privacy notice consists of a general part for any processing of personal data and processing situations that apply to every visit of a website (General) and a specific part, which relates only to the processing situation specified there, identifying the relevant service or product, especially the more detailed handling of visits to websites (Visit of Websites). To find the parts relevant to you, please refer to the following overview of the structure of the privacy notice:

Section	Title	This part is relevant for you
Part A	General	always relevant.
Part B	Website and Social Media Presence	relevant when you use our online offerings, including social media appearances.

General

Definitions

Following the model of Art. 4 GDPR, the following definitions apply to this privacy statement:

“Personal data” (Art. 4 No. 1 GDPR) means any information relating to an identified or identifiable natural person (“data subject”). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, online identifier, location data, or information concerning the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. Identifiability can also result from the combination of such information or other additional knowledge. The form or embodiment of the information does not matter (even photos, video, or audio recordings may contain personal data).
“Processing” (Art. 4 No. 2 GDPR) means any operation or set of operations which is performed on personal data, whether by automated or non-automated means. This includes, in particular, the collection (i.e., obtaining), recording, organization, structuring, storage, alteration or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction of personal data, as well as changing the objective or purpose for which personal data was initially collected.
“Controller” (Art. 4 No. 7 GDPR) is the natural or legal person, authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
“Third party” (Art. 4 No. 10 GDPR) means any natural or legal person, authority, agency, or other body, other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or processor, are authorized to process personal data; this includes other legal entities within the corporate group.
“Processor” (Art. 4 No. 8 GDPR) is a natural or legal person, authority, agency, or other body that processes personal data on behalf of the controller, particularly according to the controller’s instructions (e.g., IT service providers). In terms of data protection law, a processor is not considered a third party.
“Consent” (Art. 4 No. 11 GDPR) of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, either by a statement or by a clear affirmative action, which signifies agreement to the processing of personal data relating to them.

Name and Address of the Controller

The entity responsible for processing your personal data, within the meaning of Art. 4 No. 7 GDPR, is:

KUBY Ltd.
6 Agiou Theodosiou
C 203 Desire Gardens
CY 8560 Peyia
office@kuby.info
Contact Data Protection Officer:
KUBY Ltd.
c/o Data Protection Officer
E-Mail: office@kuby.info

Legal Basis for Data Processing

According to the law, the processing of personal data is generally prohibited and only permitted if the data processing falls under one of the following justifications:

Art. 6 para. 1 sentence 1 lit. a GDPR (“Consent”): If the data subject has voluntarily, in an informed manner, and unambiguously indicated, through a statement or other clear affirmative action, that they consent to the processing of their personal data for one or more specific purposes;
Art. 6 para. 1 sentence 1 lit. b GDPR: If the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the data subject;
Art. 6 para. 1 sentence 1 lit. c GDPR: If the processing is necessary for compliance with a legal obligation to which the controller is subject (e.g., a legal retention obligation);
Art. 6 para. 1 sentence 1 lit. d GDPR: If the processing is necessary to protect the vital interests of the data subject or another natural person;
Art. 6 para. 1 sentence 1 lit. e GDPR: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
Art. 6 para. 1 sentence 1 lit. f GDPR (“legitimate interests”): If the processing is necessary for the purposes of the legitimate (particularly legal or economic) interests pursued by the controller or a third party, unless the interests or rights and freedoms of the data subject outweigh those interests (especially if the data subject is a minor).

For the processing operations carried out by us, we will indicate the applicable legal basis below. A processing operation may also be based on several legal grounds.

Data Deletion and Retention Period

For the processing operations carried out by us, we will indicate below how long the data will be stored and when it will be deleted or blocked. If no specific retention period is mentioned, your personal data will be deleted or blocked as soon as the purpose or legal basis for storing it no longer applies. In principle, your data will only be stored on servers within the EU, subject to potential transfer according to the provisions in A.(6) and A.(7).

However, storage may extend beyond the specified period in the case of (potential) legal disputes with you or other legal proceedings, or if the storage is required by legal regulations to which we, as the controller, are subject (e.g., § 257 HGB, § 147 AO). Once the storage period prescribed by legal regulations expires, the personal data will be blocked or deleted unless further storage is necessary and there is a legal basis for it.

Data Security

We use appropriate technical and organizational security measures to protect your data from accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties (e.g., TLS encryption, formerly known as SSL encryption, for our websites), taking into account the state of the technology, implementation costs, and the nature, scope, context, and purpose of the processing, as well as the existing risks of a data breach (including their likelihood and consequences) for the data subject. Our security measures are continuously improved in line with technological developments. Further information on this is available upon request.

Collaboration with Processors

Like many companies, we also use external service providers, both domestic and foreign, for business operations (e.g., in the areas of IT, telecommunications, sales, and marketing). These service providers only act on our instructions and have been contractually obligated, in accordance with Art. 28 GDPR, to comply with data protection regulations.

Conditions for the Transfer of Personal Data to Third Countries

As part of our business relationships, your personal data may be shared or disclosed to third parties. These may also be located outside the European Economic Area (EEA), i.e., in third countries. Such processing will only occur for the fulfillment of contractual and business obligations and to maintain your business relationship with us. We will inform you of the specific details of the transfer at the relevant points.

Some third countries have been recognized by the European Commission through so-called adequacy decisions in accordance with Article 45(1) GDPR, as having a data protection level comparable to that of the EEA (a list of these countries and a copy of the adequacy decisions can be found here: ec.europa.eu). This includes the United States of America since 10.07.2023, so that the data transfer to the US does not require special authorization, provided that US companies are certified under the EU-US Data Privacy Framework; this is available at www.dataprivacyframework.gov. In other third countries where personal data may be transferred, however, there may not be a consistently high level of data protection due to the absence of legal provisions. If this is the case, we ensure that adequate data protection is guaranteed. This can be achieved through binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data, certifications, or recognized codes of conduct. Please contact us if you would like more information on this. Specific information about the service providers used can be found in this privacy statement and on the consent page (or so-called cookie banner).

No Automated Decision-Making (Including Profiling)

We do not intend to use the personal data collected from you for automated decision-making processes (including profiling).

No Obligation to Provide Personal Data

We generally do not make the use of our services conditional upon you providing personal data in advance. As a customer, there is generally no legal or contractual obligation for you to provide your personal data to us; however, it may be the case that we can only provide certain services (e.g., the purchase of goods or services through our online shop) in a limited manner or not at all if you do not provide the necessary data. If this should exceptionally apply to any of the products we offer below, you will be specifically informed about it.

Legal Obligation to Provide Certain Data

We may, in certain circumstances, be subject to a special legal or regulatory obligation to provide legally processed personal data to third parties, particularly public authorities (Art. 6 para. 1 sentence 1 lit. c GDPR).

Your Rights

You can exercise your rights as a data subject regarding your processed personal data at any time by contacting us using the contact details provided at the beginning. As a data subject, you have the right to:

Request information about the personal data we process about you in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the categories of data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from you, and the existence of automated decision-making, including profiling, as well as meaningful information about the details thereof;
Request the correction of inaccurate or the completion of your personal data stored with us in accordance with Art. 16 GDPR;
Request the deletion of your personal data stored with us in accordance with Art. 17 GDPR, unless the processing is necessary for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest, or for the assertion, exercise, or defense of legal claims;
Request the restriction of the processing of your data in accordance with Art. 18 GDPR, if the accuracy of the data is contested by you or the processing is unlawful;
Receive your data that you have provided to us in a structured, commonly used, and machine-readable format or request the transfer to another controller in accordance with Art. 20 GDPR (“Data Portability”);
Object to the processing in accordance with Art. 21 GDPR, if the processing is based on Art. 6 para. 1 sentence 1 lit. e or lit. f GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. If this is not an objection to direct marketing, we request that you explain the reasons why we should not process your data as we have done. In the case of a justified objection, we will examine the situation and either cease or adjust the data processing or show you our compelling legitimate grounds for continuing the processing;
Withdraw your consent given once (also before the application of the GDPR, i.e., before May 25, 2018) at any time in accordance with Art. 7 para. 3 GDPR – that is, your voluntary, informed, and unambiguous indication through a statement or other clear affirmative action that you agree to the processing of the relevant personal data for one or more specific purposes – if you have provided such consent. This will result in the termination of the data processing based on this consent for the future. You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data, such as the one responsible for us: Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia CY, E-Mail: commissioner@dataprotection.gov.cy.

Changes to the Privacy Notice

As part of the ongoing development of data protection laws as well as technological or organizational changes, we regularly review our privacy notices for any need for adjustments or additions. You will be informed of any changes, particularly on our website www.kuby.info. These privacy notices are effective as of October 8, 2023.

Visit and Use of Our Websites

Information about our company and the services we offer can be found particularly on www.clemenskuby.com, www.kuby.info, and www.portal.kuby.info, along with the associated subpages (hereinafter collectively referred to as “Websites”). When you visit our websites and our online shop, personal data may be processed. If you leave our website via links to other providers or open corresponding pages, our responsibility ends with the click, as we no longer have any influence over the processing of any data transferred to third parties, such as your IP address. Please refer to the privacy policies of the respective providers for information on how they handle your personal data when using these websites, especially if the use of other providers’ websites involves the collection, processing, or use of personal data.

Processed Personal Data

When using the websites for informational purposes, the following categories of personal data are collected, stored, and further processed by us:

Log Data

When you visit our website, a temporary and anonymized log entry (so-called server log files) is stored on our web server. This consists of:

the page from which the page was requested (so-called referrer URL)
the name and URL of the requested page
the date and time of the request
the description of the type, language, and version of the used web browser
the IP address of the requesting computer, shortened in a way that prevents identification of a person
the amount of data transferred
the operating system
the message whether the request was successful (access status/HTTP status code)
the GMT time zone difference

The storage of the log data is based on our legitimate interests in protecting against unauthorized use and abuse, as well as to protect our customers from this.

“Contact Form Data”: When using contact forms, the data transmitted through these forms is processed (e.g., depending on the inquiry: first name, last name, gender, address, phone number, email, occupation, workplace, possibly payment data, and the time of submission).

Purpose and Legal Basis of Data Processing

We need and use your data to introduce our company and, if necessary, provide you with current information about our activities and provide contact opportunities. We process the personal data mentioned above in accordance with the provisions of the GDPR, other relevant data protection regulations, and only to the extent necessary. To the extent that the processing of personal data is based on Art. 6 para. 1 sentence 1 lit. f GDPR, the mentioned purposes also represent our legitimate interest.

The processing of log data serves statistical purposes and the improvement of the quality of our website, particularly the stability and security of the connection (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR). The processing of contact form data is carried out to process customer inquiries (legal basis is Art. 6 para. 1 sentence 1 lit. a, b, or f GDPR).

Duration of Data Processing

Your data will only be processed as long as necessary to achieve the aforementioned processing purposes; the legal grounds for processing in relation to these purposes apply accordingly. Regarding the use and storage duration of cookies, please refer to the section “Data Deletion and Retention Period.” Third parties we use will store your data on their systems as long as it is necessary to provide the services for us in accordance with the respective contract. Further details on storage duration can be found under “Data Deletion and Retention Period.”

Transfer of Personal Data to Third Parties; Legal Basis

The following categories of recipients, who are generally processors (see A. (6)), may have access to your personal data:

Service providers for the operation of our website and the processing of data stored or transmitted by the systems; the legal basis for the transfer is then Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR, as long as they are not processors;
Government agencies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the transfer is then Art. 6 para. 1 sentence 1 lit. c GDPR;
Persons involved in the conduct of our business operations (e.g., auditors, banks, insurers, legal advisors, supervisory authorities, parties involved in company acquisitions or the formation of joint ventures). The legal basis for the transfer is then Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR.

For the guarantees of an adequate level of data protection in the transfer of data to third countries, please see above under “Conditions for the Transfer of Personal Data to Third Countries.”

Furthermore, we will only pass on your personal data to third parties if you have explicitly consented to it in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

Use of Cookies, Plugins, and Other Services on Our Website

We use cookies on our website. Cookies are small text files that are assigned and stored on your hard drive by the browser you use, containing a characteristic string that allows the entity placing the cookie to access certain information. Cookies cannot execute programs or transfer viruses to your computer, and thus do not cause any damage. They are used to make the internet offering more user-friendly and effective, and thus more pleasant for you.

Cookies may contain data that allows the device used to be recognized. However, some cookies may only contain information about certain settings that are not personally identifiable. Cookies cannot directly identify a user.

Cookies are divided into session cookies, which are deleted as soon as you close your browser, and persistent cookies, which are stored beyond a single session. Cookies are further distinguished by their function:

Technical Cookies: These are strictly necessary to navigate the website, use basic features, and ensure the website’s security; they do not collect information about you for marketing purposes, nor do they store which websites you have visited;
Performance Cookies: These collect information about how you use our website, which pages you visit, and, for example, whether errors occur during website use; they do not collect information that could identify you – all collected information is anonymous and is used solely to improve our website and understand what interests our users;
Advertising Cookies, Targeting Cookies: These serve to offer users appropriate advertisements on the website or offers from third parties and measure the effectiveness of these offers; Advertising and Targeting cookies are stored for a maximum of 13 months;
Sharing Cookies: These improve the interactivity of our website with other services (e.g., social networks); Sharing cookies are stored for a maximum of 13 months.

Any use of cookies that is not strictly necessary for technical purposes constitutes data processing, which is only allowed with your explicit and active consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. This particularly applies to the use of Advertising, Targeting, or Sharing cookies. Furthermore, we will only share your personal data processed through cookies with third parties if you have explicitly consented to it in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

You can object to the use of cookies for reach measurement and advertising purposes via optout.networkadvertising.org/ (Network Advertising Initiative opt-out page), the U.S. website www.aboutads.info/choices, or the European website www.youronlinechoices.com/uk/your-ad-choices/.

Use of Google Calendar

We use the service Google Calendar, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage and organize appointments. In the course of using this service, personal data such as name, email address, and appointment details may be processed.

The processing is carried out based on your consent in accordance with Art. 6 para. 1 lit. a GDPR or to fulfill a contract in accordance with Art. 6 para. 1 lit. b GDPR.

Google may transfer data to servers in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection. Further information can be found in the Google Privacy Policy.

Social Media Plugins

We do not use social media plugins on our website. If our websites contain symbols from social media providers (e.g., Facebook, LinkedIn, Xing, Instagram, TikTok), we only use these for passive linking to the respective provider’s pages. No data is transmitted to the network providers before these links are clicked.

When subscribing to our newsletter, we use your email address for our own promotional purposes (sending emails) until you unsubscribe. Unsubscribing is possible at any time. In this context, we collect your name (first and last name) and email address. The registration is carried out using the so-called double-opt-in procedure. After registration, you will be asked by email to confirm your subscription to the newsletter. The registration is logged for verification purposes, and data related to the usage (time of registration and confirmation, IP address) is processed. The processing is based on your explicit consent (Article 6 para. 1 letter a GDPR); the logging is carried out due to legal requirements (Article 6 para. 1 letter c, Article 7 GDPR) and to safeguard our legitimate interests (Article 6 para. 1 letter f GDPR). You can withdraw your consent at any time with effect for the future by clicking the appropriately labeled link at the end of the newsletter email and confirming the unsubscription. Email addresses may be stored for up to three years after withdrawal to document the consent for the newsletters sent up until the withdrawal.

Quentn

We use the service Quentn for the creation, organization, sending, and analysis of email newsletters. The provider of Quentn is Quentn.com GmbH, Friedrich-Ebert-Str. 51, 14469 Potsdam, Germany. When you enter data to subscribe to our newsletter, this data is stored on Quentn’s servers. Information about data protection at Quentn can be found at https://quentn.com/datenschutz/. We can analyze the behavior of newsletter recipients using data from the newsletters sent through Quentn. This includes insights into how many recipients opened the newsletter message or how often specific links in the newsletter were clicked. Additionally, we can track conversions, meaning we analyze whether a specific action was taken after clicking a link in the newsletter.

Intercom

We use the Intercom service from R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 St. Stephen’s Green, Dublin 2, Ireland, to explain, create, organize, and analyze our website features. Through the Intercom Chat Messenger, visitors to our website can directly communicate with the website operator to clarify pre-contractual questions and enable consultations. Intercom stores the IP address and the conversation ID to answer queries. Additionally, a cookie is set, which allows chats to be continued later without registration. These data are automatically deleted after nine months unless a subsequent visit occurs. Visitors can voluntarily provide their email address to enable a later response via email. This email address is only used to respond to the inquiry and is not used for promotional purposes or shared with third parties. We also use Intercom to analyze the usage of our services, where only a limited amount of your data, such as registration date and some personal information, is provided. More information on Intercom’s use of cookies can be found in their cookie policy on the website. Intercom also collects publicly available contact and social information related to you to improve the user experience. Details about Intercom’s privacy practices are available at https://www.intercom.com/legal/privacy.

Hosting and Content Delivery Networks, Cloud Services

The use of cloud services, CDN, and hosting providers is carried out to fulfill our contractual obligations to our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of providing our online services securely, quickly, and efficiently through a professional provider (Art. 6 para. 1 lit. f GDPR). We have this website and potentially other data stored or hosted by an external service provider. The host or service provider stores, among other things, the data from your inquiries via the contact form; this data is deleted after we have processed it. Additionally, other personal data collected on this website is stored on the host’s servers. This includes IP addresses, contact inquiries, meta and communication data, contractual data, contact details, names, website access, and other data generated via the website. Our host will process your data only as necessary to fulfill its service obligations and will follow our instructions regarding this data. There is a data processing agreement with our host or service provider according to Art. 28 GDPR.

OVH GmbH

We use OVH GmbH, Dudweiler Landstraße 5, 66123 Saarbrücken, Germany, as our cloud service provider. The privacy policy of OVH GmbH can be found at https://www.ovhcloud.com/de/personal-data-protection/. We have entered into a data processing agreement with OVH GmbH.

Web Hosting

We use Webspace-Verkauf.de ISP e.K., Lichtenfelser Str. 17 a, D-96271 Grub am Forst, Germany, as our web host. Their privacy policy is publicly available at https://www.webspace-verkauf.de/datenschutz.html. We have entered into a data processing agreement with Webspace-Verkauf.de ISP e.K.

AWS

For hosting our database and web content, we use the service “Amazon Web Services” (AWS) provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, United States of America. Your data is stored exclusively in a data center in Frankfurt/Main, Germany, which is certified according to ISO 27001, 27017, and 27018, as well as PCI DSS Level 1. Strict access restrictions are implemented, and all data is transmitted and stored encrypted. AWS has self-certified under the EU-US Privacy Shield, which aims to ensure compliance with European data protection standards. Detailed information on data protection at AWS can be found at https://aws.amazon.com/de/compliance/eu-data-protection/ and https://aws.amazon.com/de/privacy/.

Tracking and Analysis Services, Marketing

On our websites, we use analytics services to collect information about your visit, which helps us track the functionality of our website and make it more user-friendly. The data processing is carried out in a statistical manner. Your IP address is automatically truncated to the last octet, ensuring that the previously personal user data is anonymized, and no association can be made with an individual user. We analyze your usage behavior pseudonymously to tailor our advertising to your personal interests. For this, we collect your activities on this website (e.g., browsing behavior, visited subpages, duration of visits, etc.). The data will not be merged with the holder of the pseudonym without your explicit consent. We, as the provider, have a legitimate interest in analyzing user behavior to optimize both our web offerings and our advertising. Necessary consents will be obtained from you.

Google Analytics

We use Google Analytics for web analysis, reach measurement, and user flow tracking. For more information on Google Analytics, visit marketingplatform.google.com/intl/de/about/analytics/. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). The legal basis for use is Art. 6 para. 1 sentence 1 lit. a) and Art. 49 para. 1 sentence 1 lit. a GDPR. The level of data protection is guaranteed through both standard contractual clauses (business.safety.google/adsprocessorterms) and certification under the EU-US Privacy Shield Agreement (www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). The data processing agreement can be found under business.safety.google/adsprocessorterms. Privacy policy: policies.google.com/privacy. You can opt-out of Google Analytics using the opt-out tool available here: tools.google.com/dlpage/gaoptout?hl=de. Settings for the display of ads can also be adjusted under adssettings.google.com/authenticated.

By using cookies, Google generates information about the usage of websites; Google Ireland allows the data to be processed by Google LLC in the USA. Google uses the collected information to evaluate your use of the website, compile reports on website activities for the website operators, and provide additional services related to website and internet usage.

We use IP masking, i.e., a method that protects user data through pseudonymization by truncating the IP address. Google shortens your IP address within the European Union or other contracting states of the Agreement on the European Economic Area before storing and transmitting it, ensuring that direct personal identification is excluded. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our website. The Google Tag Manager allows various codes and services to be integrated into our websites in a structured and standardized way. The Google Tag Manager implements or activates the corresponding tags. When such activation occurs, Google may process certain information, including personal data, such as online identifiers (including cookie IDs) and IP addresses. It is possible that Google may forward this information to a server in a third country outside the EU. Information about Google Tag Manager can be found at https://www.google.de/tagmanager/use-policy.html and at https://www.google.com/intl/de/policies/privacy/index.html. We have entered into a data processing agreement with Google. Our goal in implementing Google Tag Manager is to integrate various services in a simple and structured way. Additionally, Google Tag Manager helps optimize the loading time of various services. The legal grounds for processing your data are your consent (Article 6 para. 1 letter a GDPR) and our legitimate interest (Article 6 para. 1 letter f GDPR).

Facebook Pixel, Custom Audiences, and Conversion

For operating, optimizing, and analyzing customer behavior, we use the “Facebook Pixel” of the social network Facebook (Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or for EU citizens Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, “Facebook”). Facebook is certified under the EU-US Privacy Shield Agreement, www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active. In addition, the general information in this privacy policy regarding the transfer of data to third countries applies.

Visitors to our websites are assigned to a target group for displaying advertisements (“Facebook Ads”) using the Facebook Pixel. Advertisements are shown only to those who match the information we provide to Facebook and who are likely to be interested in the measures or have certain characteristics (e.g., interests in specific topics or products, determined by visited pages) which we pass to Facebook (so-called “Custom Audiences”). With the Facebook Pixel, we also aim to ensure that our Facebook ads are not intrusive. Moreover, the effectiveness of the ads on Facebook can be used for statistical and market research purposes by determining whether users were redirected to our website after clicking a Facebook ad (so-called “conversion”).

The legal basis for use is Art. 6 para. 1 sentence 1 lit. a) and Art. 49 para. 1 sentence 1 lit. a GDPR. We have entered into a data processing agreement with Facebook. The processing of data by Facebook occurs within Facebook’s data usage policy (www.facebook.com/policy.php). Information can be accessed in Facebook’s help section (www.facebook.com/business/help/651294705016616). You can opt-out of being tracked by the Facebook Pixel and the use of your data for Facebook Ads. You can adjust your settings for usage-based advertising on Facebook under www.facebook.com/settings?tab=ads.

Automation and AI

Zapier

We use “Zapier,” a service by Zapier Inc. (548 Market St #6241, San Francisco, CA 94104, United States), to automate actions between different web applications. This helps us optimize and speed up our online presence. It is possible that data may be transferred to Zapier’s servers in the USA. However, we have signed a data processing agreement with Zapier. Furthermore, the EU standard contractual clauses secure this data processing. This use serves our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR. You can learn more about Zapier’s privacy policies here: https://zapier.com/privacy/

OpenAI

For responding to inquiries and optimizing our customer service, we use “ChatGPT,” an AI-powered chat function from OpenAI, L.L.C., 3180 18th St, San Francisco, CA 94110, United States. When interacting with ChatGPT, entered questions and answers are processed to generate an appropriate response. Data transmission is encrypted. OpenAI does not store these conversations long-term or use them for advertising purposes or sharing with third parties. However, interactions with ChatGPT may be anonymized and analyzed by OpenAI for research and improvement purposes. Data processing by ChatGPT aims to improve our service offering and serves our legitimate interest under Art. 6 para. 1 lit. f) GDPR. For more information on data processing and privacy at OpenAI and ChatGPT, you can refer to OpenAI’s official privacy policy at https://openai.com/policies/privacy-policy.

Video, Conference, and Webinar Services

Vimeo

We embed videos on our website using the Vimeo service, provided by Vimeo LLC, 555 West 18th Street, New York, NY 10011, USA. When visiting a webpage that contains a Vimeo video, a connection to Vimeo’s server is established. Data such as your IP address, browser or operating system, the website you accessed the video from, and the type and extent of your usage actions on the website (duration, clicks, etc.) are processed. For more information on privacy at Vimeo, please refer to https://vimeo.com/privacy and https://vimeo.com/cookie_policy regarding the cookies set. The legal basis for our processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR, as well as our legitimate interest in offering our services in a simple and convenient manner.

Zoom

We use the video conferencing system “Zoom,” provided by Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, United States, https://support.zoom.us/hc/de, for communication with you. For appointment scheduling, registration, participation, and post-processing of such video conferences, we and/or Zoom process the data collected, such as image data, spoken words, text inputs, IP address, username, and email. If you transmit image data, sensitive information such as health data or religious beliefs may be shared. A recording of the video conference will only be made with your consent and after prior notice. We have contracted Zoom for data processing. Zoom’s privacy policy can be found here: https://zoom.us/de-de/privacy.html.

Demio

We use the “Demio” service to conduct webinars. This service is provided by Banzai International, Inc., 101 Yesler Way, Suite 600, Seattle, WA 98104, United States. We process data based on your consent and for contract fulfillment (Art. 6 para. 1 sentence 1 letters a and b GDPR). In this context, we process your personal data that becomes known during your participation (e.g., email address, name, text inputs, reactions, IP address). We have entered into a data processing agreement with Demio. For more information about Demio’s data processing, visit their privacy policy at https://www.demio.com/privacy-policy.

WebinarJam

We use WebinarJam for the organization and execution of webinars. The service provider is Genesis LLC, 7660 Fay Ave #H184, La Jolla, California, United States. When you participate in a webinar via WebinarJam, your personal data, including your IP address and any content you enter (such as your email address or chat messages), is stored on WebinarJam’s servers. The basis for using WebinarJam is Art. 6 para. 1 lit. b GDPR (fulfillment of a contract) as well as our legitimate interest in conducting high-quality webinars in accordance with Art. 6 para. 1 lit. f GDPR. If consent has been obtained, data processing is solely based on Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. This applies especially if the consent involves the storage of cookies or access to device information within the meaning of TTDSG. Such consent can be revoked at any time. For detailed information about the data processing by WebinarJam, please refer to their privacy policy at https://home.webinarjam.com/privacypolicy.

Payment Service Providers / Contract Processing

Digistore24

Our products are not sold by us directly, but by Digistore24 GmbH, St.-Godehard-Straße 32, D-31139 Hildesheim, Germany, email: support@digistore24.com, in their own name. In this case, Digistore24 GmbH will be your contractual partner. In the event of a purchase, the terms and conditions and the privacy policy of Digistore24 GmbH apply, which can be accessed on the respective product page or at https://www.digistore24.com/page/privacy. Digistore24 GmbH does not process data on our behalf but acts independently. Digistore24 is obligated and declares that customer data is processed in accordance with data protection laws. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b) GDPR. We receive from Digistore24 GmbH the data collected during your purchase to enable us to fulfill the contract for Digistore24 GmbH and process this data in our customer account for the purpose of contract fulfillment and communication, including legally permissible offers of additional services.

Other Service Providers for Websites and Cloud Storage

Clickfunnels

We use the service Clickfunnels by Etison LLC, headquartered at 3443 W. Bavaria Street, Eagle, Idaho 83616, USA, to create and publish our website, conduct marketing tests, and perform other performance measurements of our website(s). Clickfunnels is a landing page generator that collects personal data (especially IP addresses) during its operation. The processing is based on Art. 6 para. 1 lit. f GDPR. The transmission of data to the USA occurs based on the adequacy decision of the EU as well as Art. 46 para. 2 lit. c GDPR (EU Standard Contractual Clauses). For more information on data processing and privacy notices by Clickfunnels, please refer to https://signup.clickfunnels.com/privacy-policy and https://signup.clickfunnels.com/gdpr-policy.

pCloud

We use the cloud storage service pCloud. This service is provided by pCloud AG, Zugerstrasse 74, CH-6340 Baar/Switzerland. More information about pCloud can be found on their website https://www.pcloud.com/de/ and their privacy policy is available at https://www.pcloud.com/de/privacy_policy.html. The processing is based on Art. 6 para. 1 lit. f GDPR.