Privacy Policy - Solid Labs GmbH

1. Data Protection at a Glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this
website. Personal data is any data that can be used to identify you personally. For detailed information on the
subject of data protection, please refer to our data protection declaration listed below this text.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact
details in the “Information on the controller” section of this privacy policy.

‍How do we collect your data?

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter
in a contact form. Other data is collected by our IT systems automatically or with your consent when you visit
the website. This is primarily technical data (e.g. internet browser, operating system or time of page view). This
data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors. Other data may be used to
analyze your user behavior.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipient and purpose of your stored personal data
free of charge at any time. You also have the right to request the correction or deletion of this data. If you have
given your consent to data processing, you can revoke this consent at any time for the future. You also have the
right to request the restriction of the processing of your personal data under certain circumstances. You also
have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time if
you have any further questions on the subject of data protection.

Analysis tools and tools from third-party providers

When you visit this website, your surfing behavior may be statistically evaluated. This is mainly done with so-
called analysis programs. Detailed information on these analysis programs can be found in the following privacy
policy.‍

‍

2. Hosting

We host the content of our website with the following provider:

Canva

The provider is Sydney, 110 Kippax Street, Australia (hereinafter referred to as Canva).

When you visit our website, Canva collects various log files including your IP addresses.

Canva is a tool for creating and hosting websites. Canva stores cookies or other recognition technologies that
are required to display the page, to provide certain website functions and to ensure security (necessary
cookies).

Details can be found in Canva’s privacy policy: https://www.canva.com/policies/privacy-policy.

The use of Canva is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in displaying our website as
reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on
the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of
cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of
the TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://www.canva.com/policies/privacy-policy. The company is certified in accordance with the
“EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA,
which is intended to ensure compliance with European data protection standards for data processing in the
USA.

Every company certified under the DPF undertakes to comply with these data protection standards. Further
information on this can be obtained from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt0000000TT9jAAG&status=Active

‍

3. General Notes and Mandatory Information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal
data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify
you personally. This privacy policy explains what data we collect and what we use it for, as well as how and for
what purpose this is done.

We would like to point out that data transmission over the Internet (e.g. when communicating by email) may be
subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Note on the responsible body

The controller responsible for data processing on this website is

Solid Labs GmbH

Mülhauser Str. 5

c/o Prokesch

14050 Berlin

E-Mail: patrick@withsolid.com‍

The controller is the natural or legal person who alone or jointly with others determines the purposes and means
of the processing of personal data (e.g. names, email addresses, etc.).

Duration of storage

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain
with us until the purpose for processing the data no longer applies. If you assert a justified request for deletion
or revoke your consent to data processing, your data will be deleted unless we have other legally permissible
reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case,
the deletion will take place after these reasons no longer apply.

General information on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a
GDPR or Art. 9 para. 2 lit. a GDPR, insofar as special categories of data are processed in accordance with Art. 9
para. 1 GDPR. In the event of express consent to the transfer of personal data to third countries, data
processing is also carried out on the basis of Art. 49 para. 1 lit. a GDPR. If you have consented to the storage of
cookies or access to information in your end device (e.g. via device fingerprinting), the data processing is also
carried out on the basis of Section 25 (1) TTDSG. Consent can be revoked at any time. If your data is required to
fulfill the contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6 para. 1
lit. b GDPR. Furthermore, we process your data if this is necessary to fulfill a legal obligation on the basis of Art.
6 para. 1 lit. c GDPR. Data processing may also be carried out on the basis of our legitimate interest in
accordance with Art. 6 para. 1 lit. f GDPR. Information on the relevant legal bases in each individual case is
provided in the following paragraphs of this privacy policy.

Recipients of personal data

As part of our business activities, we work together with various external bodies. In some cases, it is also
necessary to transfer personal data to these external bodies. We only pass on personal data to external bodies
if this is necessary for the fulfillment of a contract, if we are legally obliged to do so (e.g. passing on data to tax
authorities), if we have a legitimate interest in passing on the data in accordance with Art. 6 Para. 1 lit. f GDPR or
if another legal basis allows the data to be passed on. When using processors, we only pass on our customers'
personal data on the basis of a valid contract for order processing. In the case of joint processing, a joint
processing agreement is concluded. The company is certified in accordance with the “EU-US Data Privacy
Framework” (DPF).

The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance
with European data protection standards for data processing in the USA. Every company certified under the
DPF undertakes to comply with these data protection standards. Further information on this can be obtained
from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-
search/participantdetail?contact=true&id=a2zt0000000GnywAAC&status=Active

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw your consent
at any time. The legality of the data processing carried out until the revocation remains unaffected by the
revocation.

Right to object to the collection of data in special cases and to direct advertising (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6 ABS. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT
TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME ON GROUNDS RELATING TO YOUR
PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE
LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT,
WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE
COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS
AND FREEDOMS OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL
CLAIMS (OBJECTION PURSUANT TO ART. 21 PARA. 1 GDPR). IF YOUR PERSONAL DATA ARE PROCESSED FOR
DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF
PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO
PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR
PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING
(OBJECTION PURSUANT TO ART. 21 PARA. 2 GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory
authority, in particular in the Member State of their habitual residence, place of work or place of the alleged
infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a
contract handed over to you or to a third party in a common, machine-readable format. If you request the direct
transfer of the data to another controller, this will only take place if it is technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right to free information about your stored
personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to
correction or deletion of this data at any time. You can contact us at any time if you have further questions on
the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any
time to do this. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we generally need time to verify this.
For the duration of the review, you have the right to request that the processing of your personal data be
restricted.
If the processing of your personal data was/is carried out unlawfully, you can request the restriction of data
processing instead of erasure.
If we no longer need your personal data, but you need it for the exercise, defense or assertion of legal
claims, you have the right to request the restriction of the processing of your personal data instead of its
erasure.
If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balance must be struck between your
interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to
request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data - apart from its storage - may only be
processed with your consent or for the establishment, exercise or defense of legal claims or for the
protection of the rights of another natural or legal person or for reasons of important public interest of the
European Union or of a Member State.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential
content, such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted
connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock
symbol in your browser line.

‍If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Encrypted payment transactions on this website

If there is an obligation to send us your payment data (e.g. account number for direct debit authorization) after
the conclusion of a fee-based contract, this data is required for payment processing.

Payment transactions via the usual means of payment (Visa/MasterCard, direct debit) are made exclusively via
an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the address
line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.

With encrypted communication, the payment data you transmit to us cannot be read by third parties.

‍

4. Data collection on this website

Cookies

Our Internet pages use so-called “cookies”. Cookies are small data packets and do not cause any damage to
your end device. They are stored on your device either temporarily for the duration of a session (session
cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit.
Permanent cookies remain stored on your device until you delete them yourself or they are automatically
deleted by your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party
cookies). Third-party cookies enable the integration of certain services from third-party companies within
websites (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not
work without them (e.g. the shopping cart function or the display of videos). Other cookies can be used to
evaluate user behavior or for advertising purposes.

Cookies that are required to carry out the electronic communication process, to provide certain functions that
you have requested (e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the
web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal
basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the
technically error-free and optimized provision of its services. If consent to the storage of cookies and
comparable recognition technologies has been requested, the processing is carried out exclusively on the basis
of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG); consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in
individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic
deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may
be restricted.

You can find out which cookies and services are used on this website in this privacy policy.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your
browser automatically transmits to us. These are

Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

‍This data is not merged with other data sources.

‍This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in
the technically error-free presentation and optimization of its website - the server log files must be recorded for
this purpose.

Contact form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you
provide there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up
questions. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the fulfillment of a
contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing
is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f
GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; consent can be revoked at any
time.

We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its
storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Mandatory statutory
provisions - in particular retention periods - remain unaffected.

Request by e-mail, telephone or fax

If you contact us by email, telephone or fax, we will store and process your request, including all personal data
(name, request), for the purpose of processing your request. We will not pass on this data without your consent.

‍This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the fulfillment of a
contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing
is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f
GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; consent can be revoked at any
time.

‍The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your
consent to storage or the purpose for data storage no longer applies (e.g. after your request has been
processed). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

Typeform

We have integrated Typeform on this website. The provider is TYPEFORM S.L., Carrer Bac de Roda, 163, 08018
Barcelona, Spain (hereinafter referred to as Typeform).

Typeform enables us to create online forms and integrate them into our website. The data you enter in our
Typeform forms will be stored on Typeform's servers until you ask us to delete it, revoke your consent to
storage or the purpose for data storage no longer applies (e.g. after your request has been processed).
Mandatory statutory provisions - in particular retention periods - remain unaffected.

The use of Typeform is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in
functioning online forms. If a corresponding consent has been requested, the processing is carried out
exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the
storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the
meaning of the TDDDG. Consent can be revoked at any time.

Calendly

You can make appointments with us on our website. We use the “Calendly” tool to book appointments. The
provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA (hereinafter “Calendly”).

For the purpose of booking an appointment, you enter the requested data and the desired date in the mask
provided for this purpose. The data entered will be used for the planning, execution and, if necessary, follow-up
of the appointment. The appointment data is stored for us on the servers of Calendly, whose privacy policy you
can view here: https://calendly.com/privacy. The data you enter will remain with us until you ask us to delete it,
revoke your consent to storage or the purpose for data storage no longer applies. Mandatory statutory
provisions - in particular retention periods - remain unaffected.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in
making appointments with interested parties and customers as uncomplicated as possible. If a corresponding
consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR
and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the
user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at
any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find
details here: https://calendly.com/pages/dpa.

Cal

We use Cal.com for appointment scheduling. The provider is Cal.com, Inc., 2261 Market Street #4008, San
Francisco, CA 94114, USA.

Cal.com facilitates online scheduling and appointment management. Data provided during booking, such as your
name, email, and selected date, is stored on Cal.com's servers until you request deletion, withdraw consent, or
the storage purpose expires. Legal retention periods remain unaffected.

The legal basis is Art. 6 para. 1 lit. f GDPR, as we have a legitimate interest in efficient scheduling. Where
consent is obtained, processing is based on Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG if it involves
cookies or device access. Consent can be withdrawn anytime.

Data transfers to the USA rely on EU Commission standard contractual clauses. Details:
https://cal.com/legal/privacy.

Tally

We use Tally.so for online forms. The provider is Tally BV, Vlasgaardstraat 52, 9000 Ghent, Belgium.

Tally.so collects information via embedded forms, storing your data on Tally's servers until you request deletion,
withdraw consent, or the purpose of storage expires. Legal retention periods remain unaffected.

The legal basis is Art. 6 para. 1 lit. f GDPR, as we have a legitimate interest in functional forms. Where consent is
required, processing is based on Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG for cookies or device access.
Consent can be withdrawn anytime.

Further details on Tally.so’s data protection: https://tally.so/help/privacy-policy.

‍

5. Analysis Tools and Advertising

Google Tag Manager

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin
4, Ireland.

Google Tag Manager is a tool that enables us to integrate tracking or statistical tools and other technologies on
our website. Google Tag Manager itself does not create any user profiles, does not store any cookies and does
not carry out any independent analyses. It is only used to manage and display the tools integrated via it.
However, Google Tag Manager records your IP address, which may also be transmitted to Google's parent
company in the United States.

The Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate
interest in the fast and uncomplicated integration and management of various tools on its website. If a
corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para.
1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to
information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent
can be revoked at any time.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an
agreement between the European Union and the USA, which is intended to ensure compliance with European
data protection standards for data processing in the USA. Every company certified under the DPF undertakes to
comply with these data protection standards. Further information on this can be obtained from the provider at
the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt000000001L5AAI&status=Active

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited
(“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the
website operator receives various usage data, such as page views, length of visit, operating systems used and
origin of the user. This data is summarized in a user ID and assigned to the respective end device of the website
visitor. We can also use Google Analytics to record your mouse and scroll movements and clicks, among other
things. Google Analytics also uses various modeling approaches to supplement the data records collected and
uses machine learning technologies for data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user
behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this
website is generally transmitted to a Google server in the USA and stored there.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1
TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://privacy.google.com/businesses/controllerterms/mccs/.

IP anonymization

Google Analytics IP anonymization is activated. This means that your IP address will be shortened by Google
within member states of the European Union or in other contracting states of the Agreement on the European
Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be
transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the
operator of this website for the purpose of evaluating your use of the website, compiling reports on website
activity and providing other services relating to website activity and internet usage to the website operator. The
IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Browser plugin

You can prevent the collection and processing of your data by Google by downloading and installing the
browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

You can find more information on how Google Analytics handles user data in Google's privacy policy:
https://support.google.com/analytics/answer/6004245?hl=de.

Google signals

We use Google signals. When you visit our website, Google Analytics collects data such as your location, search
history and YouTube history as well as demographic data (visitor data). This data can be used for personalized
advertising with the help of Google Signal. If you have a Google account, the visitor data from Google Signal is
linked to your Google account and used for personalized advertising messages. The data is also used to compile
anonymous statistics on the user behavior of our users.

Order processing

We have concluded an order processing contract with Google and fully implement the strict requirements of the
German data protection authorities when using Google Analytics.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited
(“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when
the user enters certain search terms into Google (keyword targeting). Furthermore, targeted advertisements
can be displayed based on the user data available at Google (e.g. location data and interests) (target group
targeting). As the website operator, we can evaluate this data quantitatively by analyzing, for example, which
search terms led to the display of our advertisements and how many advertisements led to corresponding
clicks.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1
TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://policies.google.com/privacy/frameworks and
https://business.safety.google/controllerterms/.

Google Ads Remarketing

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited (“Google”),
Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing, we can assign people who interact with our online offer to specific target groups
in order to subsequently display interest-based advertising in the Google advertising network (remarketing or
retargeting).

Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google's
cross-device functions. In this way, interest-based, personalized advertising messages that have been adapted
to you depending on your previous usage and surfing behavior on one device (e.g. cell phone) can also be
displayed on another of your devices (e.g. tablet or PC).

If you have a Google account, you can object to personalized advertising at the following link:
https://adssettings.google.com/anonymous?hl=de.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 25
para. 1 TDDDG. Consent can be revoked at any time.

Further information and the data protection provisions can be found in Google's privacy policy at:
https://policies.google.com/technologies/ads?hl=de.

Target group formation with customer matching

Among other things, we use Google Ads Remarketing customer matching to create target groups. Here we
transfer certain customer data (e.g. email addresses) from our customer lists to Google. If the customers in
question are Google users and are logged into their Google account, they are shown suitable advertising
messages within the Google network (e.g. on YouTube, Gmail or in the search engine).

Google conversion tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited (“Google”), Gordon
House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognize whether the user has performed
certain actions. For example, we can evaluate which buttons on our website were clicked how often and which
products were viewed or purchased particularly frequently. This information is used to create conversion
statistics. We find out the total number of users who have clicked on our ads and what actions they have taken.
We do not receive any information with which we can personally identify the user. Google itself uses cookies or
comparable recognition technologies for identification purposes.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1
TDDDG. Consent can be revoked at any time.

You can find more information about Google Conversion Tracking in Google's privacy policy:
https://policies.google.com/privacy?hl=de.

Meta Pixel (formerly Facebook Pixel)

This website uses the Facebook/Meta visitor action pixel to measure conversions. The provider of this service is
Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the
data collected is also transferred to the USA and other third countries.

This allows the behavior of site visitors to be tracked after they have been redirected to the provider's website
by clicking on a Facebook ad. This allows the effectiveness of Facebook ads to be evaluated for statistical and
market research purposes and future advertising measures to be optimized.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about
the identity of the users. However, the data is stored and processed by Facebook so that a connection to the
respective user profile is possible and Facebook can use the data for its own advertising purposes in
accordance with the Facebook Data Usage Policy ( https://de-de.facebook.com/about/privacy/). This allows
Facebook to place advertisements on Facebook pages and outside of Facebook. This use of the data cannot be
influenced by us as the site operator.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1
TDDDG. Consent can be revoked at any time.

We use the advanced matching function within the meta pixel.

Advanced matching allows us to transmit various types of data (e.g. place of residence, state, zip code, hashed
email addresses, names, gender, date of birth or telephone number) of our customers and interested parties
that we collect via our website to Meta (Facebook). This activation enables us to tailor our advertising
campaigns on Facebook even more precisely to people who are interested in our offers. In addition, the
extended comparison improves the allocation of website conversions and expands Custom Audiences.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to
Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2,
Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited
exclusively to the collection of the data and its transfer to Facebook. The processing carried out by Facebook
after forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out
in an agreement on joint processing. The text of the agreement can be found at:
https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for
providing the data protection information when using the Facebook tool and for the secure implementation of
the tool on our website in accordance with data protection law. Facebook is responsible for the data security of
the Facebook products. You can assert data subject rights (e.g. requests for information) regarding the data
processed by Facebook directly with Facebook. If you assert your data subject rights with us, we are obliged to
forward them to Facebook.

You can find further information on protecting your privacy in Facebook's data protection information:
https://de-de.facebook.com/about/privacy/.

You can also deactivate the remarketing function “Custom Audiences” in the settings for advertisements at
https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be
logged in to Facebook.

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the
website of the European Interactive Digital Advertising Alliance:
http://www.youronlinechoices.com/de/praferenzmanagement/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an
agreement between the European Union and the USA that is intended to ensure compliance with European data
protection standards for data processing in the USA. Every company certified under the DPF undertakes to
comply with these data protection standards. Further information on this can be obtained from the provider at
the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?
contact=true&id=a2zt0000000GnywAAC&status=Active

Facebook Custom Audiences

We use Facebook Custom Audiences. The provider of this service is Meta Platforms Ireland Limited, 4 Grand
Canal Square, Dublin 2, Ireland.

When you visit or use our websites and apps, take advantage of our free or paid offers, transmit data to us or
interact with the Facebook content of our company, we collect your personal data. If you give us your consent
to use Facebook Custom Audiences, we will transmit this data to Facebook, which Facebook can use to display
suitable advertising to you. Your data can also be used to define target groups (lookalike audiences).

Facebook processes this data as our processor. Details can be found in the Facebook user agreement:
https://www.facebook.com/legal/terms/customaudience.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1
TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://www.facebook.com/legal/terms/customaudience and
https://www.facebook.com/legal/terms/dataprocessing.

TikTok Pixel

We have integrated the TikTok pixel on this website. The provider is TikTok Technology Limited, 10 Earlsfort
Terrace, Dublin, D02 T380, Ireland (hereinafter referred to as TikTok)

With the help of TikTok Pixel, we can display interest-based advertising on TikTok to website visitors who have
viewed our offers (TikTok Ads). At the same time, we can use the TikTok Pixel to determine how effective our
advertising on TikTok is. This allows the effectiveness of TikTok ads to be evaluated for statistical and market
research purposes and optimized for future advertising measures. Various usage data is processed, such as IP
address, page views, length of stay, operating systems used and origin of the user, information about the ad
that a person clicked on TikTok or an event that was triggered (timestamp). This data is summarized in a user ID
and assigned to the respective end device of the website visitor.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1
TDDDG. Consent can be revoked at any time.

Data transfer to third countries is based on the standard contractual clauses of the EU Commission. Details can
be found here: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE and
https://ads.tiktok.com/i18n/official/policy/controller-to-controller.

Order processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a
contract required by data protection law, which ensures that it processes the personal data of our website
visitors only in accordance with our instructions and in compliance with the GDPR.

LinkedIn Insight Tag

This website uses the LinkedIn Insight Tag. The provider of this service is LinkedIn Ireland Unlimited Company,
Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Data processing by LinkedIn Insight Tag

With the help of the LinkedIn Insight Tag, we receive information about visitors to our website. If a website
visitor is registered with LinkedIn, we can, among other things, analyze the key professional data (e.g. career
level, company size, country, location, industry and job title) of our website visitors and thus better tailor our
site to the respective target groups. We can also use LinkedIn Insight Tags to measure whether visitors to our
websites make a purchase or take another action (conversion measurement). Conversion measurement can also
be carried out across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting function
that we can use to display targeted advertising to visitors to our website outside the website, whereby,
according to LinkedIn, no identification of the advertising addressee takes place.

LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser properties and time of
access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices)
hashed (pseudonymized). The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days.
The remaining pseudonymized data is then deleted within 180 days.

The data collected by LinkedIn cannot be assigned to specific individuals by us as the website operator.
LinkedIn will store the personal data collected from website visitors on its servers in the USA and use it for its
own advertising purposes. Details can be found in LinkedIn's privacy policy at
https://www.linkedin.com/legal/privacy-policy#choices-oblig.

Legal basis

If consent has been obtained, the above-mentioned service is used exclusively on the basis of Art. 6 para. 1 lit. a
GDPR and § 25 TDDDG. Consent can be revoked at any time. If consent has not been obtained, this service is
used on the basis of Art. 6 para. 1 lit. f GDPR; the website operator has a legitimate interest in effective
advertising measures, including social media.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

Objection to the use of the LinkedIn Insight Tag

You can object to the analysis of usage behavior and targeted advertising by LinkedIn at the following link:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in their
account settings. To prevent LinkedIn from linking data collected on our website to your LinkedIn account, you
must log out of your LinkedIn account before visiting our website.

Order processing

‍

6. Plugins and Tools

YouTube with extended data protection

This website integrates videos from the YouTube website. The operator of the website is Google Ireland Limited
(“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of these websites on which YouTube is integrated, a connection to the YouTube servers is
established. This tells the YouTube server which of our pages you have visited. If you are logged into your
YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can
prevent this by logging out of your YouTube account.

We use YouTube in extended data protection mode. According to YouTube, videos that are played in extended
data protection mode are not used to personalize browsing on YouTube. Ads that are played in extended data
protection mode are also not personalized. No cookies are set in extended data protection mode. Instead,
however, so-called local storage elements are stored in the user's browser, which contain personal data similar
to cookies and can be used for recognition. Details on the extended data protection mode can be found here:
https://support.google.com/youtube/answer/171780.

After activating a YouTube video, further data processing operations may be triggered over which we have no
influence.

The use of YouTube is in the interest of an appealing presentation of our online offers. This constitutes a
legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been
requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1
TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device
(e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Further information about data protection at YouTube can be found in their privacy policy at:
https://policies.google.com/privacy?hl=de.

7. eCommerce and Payment Providers

Processing of customer and contract data

We collect, process and use personal customer and contract data to establish, structure the content of and
amend our contractual relationships. We collect, process and use personal data about the use of this website
(usage data) only insofar as this is necessary to enable the user to use the service or to bill the user. The legal
basis for this is Art. 6 para. 1 lit. b GDPR.

The customer data collected will be deleted after completion of the order or termination of the business
relationship and expiry of any existing statutory retention periods. Statutory retention periods remain
unaffected.

Data transfer upon conclusion of a contract for services and digital content

We only transfer personal data to third parties if this is necessary in the context of contract processing, for
example to the credit institution responsible for processing payments.

Any further transmission of data will not take place or will only take place if you have expressly consented to the
transmission. Your data will not be passed on to third parties without your express consent, for example for
advertising purposes.

Your data will not be passed on to third parties or will only be passed on if you have expressly consented to
this. Your data will not be passed on to third parties without your express consent, for example for advertising
purposes.

Payment services

We integrate third-party payment services on our website. When you make a purchase from us, your payment
details (e.g. name, payment amount, account details, credit card number) are processed by the payment service
provider for the purpose of payment processing. The respective contractual and data protection provisions of
the respective providers apply to these transactions. The payment service providers are used on the basis of
Art. 6 para. 1 lit. b GDPR (contract processing) and in the interest of a smooth, convenient and secure payment
process (Art. 6 para. 1 lit. f GDPR). Insofar as your consent is requested for certain actions, Art. 6 para. 1 lit. a
GDPR is the legal basis for data processing; consent can be revoked at any time for the future.

We use the following payment services / payment service providers on this website

PayPal

The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449
Luxembourg (hereinafter referred to as “PayPal”).

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full.

Details can be found in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Stripe

The provider for customers within the EU is Stripe Payments Europe, Ltd, 1 Grand Canal Street Lower, Grand
Canal Dock, Dublin, Ireland (hereinafter referred to as “Stripe”).

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be
found here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation.

‍

8. Audio and Video Conferencing

Data processing

We use online conferencing tools, among others, to communicate with our customers. The individual tools we
use are listed below. If you communicate with us by video or audio conference via the internet, your personal
data will be collected and processed by us and the provider of the respective conference tool.

Data processing Among other things, we use online conferencing tools to communicate with our customers. The
individual tools we use are listed below. If you communicate with us by video or audio conference via the
internet, your personal data will be collected and processed by us and the provider of the respective
conference tool.

Furthermore, the provider of the tool processes all technical data that is required to process the online
communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating
system type and version, client version, camera type, microphone or loudspeaker and the type of connection.

Furthermore, the provider of the tool processes all technical data required to process online communication.
This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and
version, client version, camera type, microphone or loudspeaker and the type of connection.

Purpose and legal basis

The conference tools are used to communicate with prospective or existing contractual partners or to offer
certain services to our customers (Art. 6 para. 1 lit. b GDPR). Furthermore, the use of the tools serves the
general simplification and acceleration of communication with us or our company (legitimate interest within the
meaning of Art. 6 para. 1 lit. f GDPR). If consent has been requested, the tools in question are used on the basis
of this consent; consent can be withdrawn at any time with effect for the future.

Storage duration

The data collected directly by us via the video and conference tools will be deleted from our systems as soon as
you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Stored
cookies remain on your end device until you delete them. Mandatory statutory retention periods remain
unaffected.

We have no influence on the storage period of your data that is stored by the operators of the conference tools
for their own purposes. For details, please contact the operators of the conference tools directly.

Conference tools used

We use the following conference tools.

Google Meet

We use Google Meet. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Details on data processing can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de.

Zoom

We use Zoom for video conferencing. The provider is Zoom Video Communications, Inc., 55 Almaden Blvd, Suite
600, San Jose, CA 95113, USA (Zoom). The data you provide during meetings (e.g., name, email, meeting
content) is stored on Zoom's servers until you request deletion, revoke consent, or the purpose no longer
applies. Legal retention periods remain unaffected. The use of Zoom is based on Art. 6 para. 1 lit. f GDPR
(legitimate interest in efficient communication). If consent is required, processing is conducted under Art. 6
para. 1 lit. a GDPR and § 25 para. 1 TDDDG for cookies or device access, with revocable consent. Data transfer
to the USA is based on EU standard contractual clauses. For details, visit: https://zoom.us/privacy.

Order processing

9. Use and Analysis of Advertising Platform KPIs

‍When using Voices, we collect and process certain key performance indicators (KPIs) of your advertising
campaigns on various platforms, including but not limited to Facebook, Google and TikTok. Only the ad name
and associated metrics are passed on to artificial intelligence (AI) models, including, but not limited to, ChatGPT.
No information about your company, industry or other sensitive data is transmitted. This data is used to
optimize our services, make individual recommendations and perform performance analyses. All data collected
by Voices is processed in accordance with applicable data protection laws. We take appropriate measures to
ensure the security and confidentiality of your data. By using Voices, you consent to the processing and
analysis of your advertising platform KPIs as described above.

‍

Table of contents

1. Data Protection at a Glance

2. Hosting

3. General Notes and Mandatory Information

4. Data collection on this website

5. Analysis Tools and Advertising

6. Plugins and Tools

7. eCommerce and Payment Providers

8. Audio and Video Conferencing

9. Use and Analysis of Advertising Platform KPIs