Privacy Policy. Last updated: November 2026

1. Introduction and Overview

The protection of your personal data is our highest priority. This website, truck-abschleppdienst-luebeck.de, is part of the network for truck towing services, TruckNetz.DE. In the following, we inform you about how we collect, process, and store your personal data when you use our online services.

2. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

GEARS Digital UG (haftungsbeschränkt)

Neue Straße 28

97711 Maßbach

Germany

Commercial Register: HRB 10186, Amtsgericht Schweinfurt

Phone:+49 3221 2243834

E-mail:info@trucknetz.de

You can direct questions regarding data protection at any time to the following e-mail address: datenschutz@trucknetz.de

Data Protection Officer

We are not legally obliged to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). For all questions regarding data protection, you can reach us at datenschutz@trucknetz.de.

3. Legal Basis for Data Processing

We process personal data on the basis of the following legal provisions:

  • Art. 6(1)(a) GDPR: Provided you have given us explicit consent.
  • Art. 6(1)(b) GDPR: For the fulfilment of a contract (e.g. commissioning a truck tow) or pre-contractual measures.
  • Art. 6(1)(c) GDPR: For the fulfilment of legal obligations.
  • Art. 6(1)(f) GDPR: To safeguard our legitimate interests (optimising website stability and security).

4. Data Transfer to Third Countries

Our registered office and our hosting infrastructure are located in Germany; the processing of your data generally takes place within the European Union. Individual service providers we use (e.g. Cloudflare, Google, and messenger services) may transfer personal data to third countries — in particular to the USA. For these transfers, we rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) insofar as the recipient is certified under it, and otherwise on appropriate safeguards pursuant to Art. 46 GDPR, in particular the EU Standard Contractual Clauses (SCC) pursuant to Implementing Decision (EU) 2021/914, or on your explicit consent pursuant to Art. 49(1)(a) GDPR. Further details on the individual services can be found in the following sections.

5. Hosting and Infrastructure

  • This website is hosted by the service provider Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany), https://www.hetzner.com/, in a data centre in Germany. The personal data collected on this website is stored on the host's servers in Germany. Encrypted backups are additionally kept in a data centre of Hetzner Online GmbH in Finland (EU). We have entered into a data processing agreement (DPA) pursuant to Art. 28 GDPR with our hosting provider to ensure that your data is processed only on our instructions and in accordance with the GDPR.
  • In addition, we use other carefully selected IT service providers based in the EU (e.g. for sending and receiving e-mails and for data backup), with each of whom a data processing agreement pursuant to Art. 28 GDPR is in place.
  • Cloudflare: We use Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) http://cloudflare.com/ as a Content Delivery Network (CDN) and security service (WAF). Your data traffic is routed through Cloudflare's infrastructure to protect our website from attacks (e.g. DDoS). Data transfers to the USA are based on the EU-US Data Privacy Framework and the Standard Contractual Clauses (SCC). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and availability of the website). Cloudflare's privacy policy.

Further services to ensure website functionality and security:

  • Google Fonts (Local usage) from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): To ensure a uniform display of fonts, we use Google Web Fonts. For data protection reasons, these are hosted locally on our server. No connection to Google servers is established and your IP address is not transmitted to Google. Information on data protection at Google Fonts can be found at: https://policies.google.com/privacy

6. Communication, Contacts and Processing of Contact Information

If you send us an enquiry by telephone, messenger (Viber, WhatsApp, Telegram, etc.), contact form or e-mail (e.g. in the event of a truck breakdown), your details, including the contact data you provide, will be stored by us for the purpose of processing your enquiry and in the event of follow-up questions. We do not pass on this data without your consent; excepted from this is the disclosure to the partner companies commissioned to carry out the order, insofar as this is necessary to fulfil your enquiry. We delete this data as soon as it is no longer required for the purposes for which it was collected, and at the latest upon expiry of any statutory retention periods.

Communication via WhatsApp, Telegram and Viber We offer you the possibility of contacting us via instant messaging services. When using these services, personal data is collected and processed by the respective messenger provider.

6.1. WhatsApp (WhatsApp Business Platform / Cloud API)

  • Provider: WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (a Meta group company). For business communication we use the WhatsApp Business Platform (Cloud API).
  • Processing on our behalf: With the Cloud API your messages are processed and hosted via Meta's cloud infrastructure. In this respect Meta acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR (part of the WhatsApp Business Terms). We then consolidate the messages received in our own system in order to handle your enquiry.
  • Data processed: Mobile phone number, profile name, message content and metadata (time of message, device data, IP address).
  • Legal basis: Art. 6(1)(b) GDPR (initiation/performance of contract) and Art. 6(1)(f) GDPR (our legitimate interest in rapid communication).
  • Third-country transfer: Data may be transferred to servers of Meta Platforms, Inc. in the USA. The transfer is made on the basis of the EU-US Data Privacy Framework and, additionally, the EU Standard Contractual Clauses.
  • Privacy policy:https://www.whatsapp.com/legal/privacy-policy-eea.

6.2. Telegram

  • Provider: Telegram Messenger Inc., 71-75 Shelton Street, Covent Garden, London, UK / Telegram FZ-LLC, Dubai, UAE.
  • Data processed: Mobile phone number, profile name, IP address, message content (cloud storage for standard chats).
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in platform-independent communication).
  • Third-country transfer: Transfer to third countries (including UAE) is possible. For this transfer to third countries without an adequacy decision we rely, insofar as you communicate with us via Telegram, on the fact that the transfer is necessary for the communication you have requested and for the initiation of a contract (Art. 49(1)(b) GDPR).
  • Internal dispatching: Irrespective of the channel through which you contact us, we transmit the details required to handle your call-out (e.g. name, phone number, location, vehicle and damage data) to our dispatchers via closed Telegram groups, so that assistance can be organised without delay, including at night and at weekends. Legal basis: Art. 6(1)(b) GDPR (initiation/performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in rapid emergency dispatching). As Telegram may also process data outside the EU, we limit the data transmitted to the minimum required for the call-out. Where data is thereby transferred to third countries without an adequacy decision, this takes place because the transfer is necessary for the performance of the contract concluded with you or being initiated with you (emergency dispatching) (Art. 49(1)(b) GDPR).
  • Privacy policy:https://telegram.org/privacy.

6.3. Viber

  • Provider: Viber Media S.à r.l., 2, rue Edward Steichen, L-2540 Luxembourg.
  • Data processed: Mobile phone number, device identifier, IP address, metadata. Messages are end-to-end encrypted by default.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in modern customer communication).
  • Third-country transfer: Data may be processed worldwide. Viber uses standard contractual clauses as a safeguard.
  • Privacy policy:https://www.viber.com/en/terms/viber-privacy-policy/.

7. Cookies, Consent Management and Analysis Tools

Our website uses cookies. These are small text files that are stored on your device. 

7.1. Necessary Cookies: These are technically required for the operation of the website.

7.2. Optional Cookies (Marketing/Analytics)
We only use these if you give us your explicit consent via our consent banner (see Section 7.4 – Consent Management Tool Klaro). You can revoke or change your settings at any time via the “⚙ Cookie” button at the bottom left of every page. Non-essential cookies are stored and accessed only with your prior consent (§ 25(1) TDDDG).

7.3. Google Forms 
We use Google Forms from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to collect structured enquiries (e.g. partner registrations or specific service requests). When you fill in a form, the data you enter is transmitted to Google's servers. A transfer to the USA is possible; it takes place on the basis of the EU-US Data Privacy Framework. The use is based on your consent (Art. 6(1)(a) GDPR) or for the initiation of a partner agreement (Art. 6(1)(b) GDPR). Information on data protection at Google Forms can be found at: https://policies.google.com/privacy. 

7.4. Consent Management Tool Klaro
We use the open-source consent management tool Klaro to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies, and to document this in a data-protection-compliant manner. 

  • Software: Klaro is open-source software (originally developed by KIProtect GmbH, Bismarckstr. 10-12, 10625 Berlin, Germany) and is hosted by us ourselves. No data is transmitted to KIProtect.
  • How it works: Klaro stores your decision (consent or refusal) locally in your browser so that it can be taken into account on a return visit.
  • Legal basis: Storing your consent decision is technically necessary in order to implement the choice you have made (§ 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR).
  • Privacy policy of Klaro: https://klaro.org/de/ressourcen/datenschutz. 

Klaro is configured to fully support Google Consent Mode v2 and to transmit the corresponding consent signals to Google.

The following consent parameters are transmitted:

  • analytics_storage – for Google Analytics
  • ad_storage – for Google Ads / advertising cookies
  • ad_user_data – use of user data for advertising purposes
  • ad_personalization – personalised advertising / remarketing

Without your consent, no advertising or analytics cookies will be set and no personal data will be transmitted to Google. In this case, Google can only use anonymised modelling data (Modeling) to estimate conversions and traffic.

We regularly review the configuration of Klaro and the transmission of consent signals.

7.5. Google Analytics 4 (GA4) 
We use Google Analytics 4 from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to evaluate the use of our website on a statistical and pseudonymous basis. The integration is carried out via Google Tag Manager and is only activated after your consent via our consent banner (Klaro). GA4 does not store IP addresses; they are only used to derive the approximate location and are then discarded.

  • Protective measures: We have concluded a data processing agreement. Data is not shared with other Google services. The transfer to the USA is made on the basis of the EU-US Data Privacy Framework.
  • Legal basis: Art. 6(1)(a) GDPR (consent via Klaro).
  • Privacy policy: https://policies.google.com/privacy.

7.6. Google Ads (Conversion Tracking & Remarketing) 
We use Google Ads from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to place advertisements.

  • Data processed: Within the framework of conversion tracking and remarketing, personal data (e.g. cookie or device identifiers) is processed. The transfer to the USA is made within the framework of the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
  • Legal basis: Art. 6(1)(a) GDPR (consent via Klaro).
  • Privacy policy: https://policies.google.com/privacy.

7.7. Conversion measurement with the OpenAI Ads Pixel
On the basis of your consent (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG) we use the “OpenAI Ads Pixel”, a service provided by OpenAI (controller in the EEA: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland). For the data collected via the pixel, we and OpenAI are each separate (independent) controllers; OpenAI processes the data for its own purposes in accordance with its own privacy policy. It lets us measure whether a visit or a contact request originates from an advertisement in ChatGPT. For this purpose the pixel sets the cookies “__oppref” (stored for 30 days) and “__obref” (stored for 365 days) containing pseudonymous identifiers and, when a page is viewed or a request is sent, transmits usage data (the page visited, the time, the IP address, browser and device information, a pseudonymous identifier) to OpenAI. We do not transmit names, telephone numbers or e-mail addresses via the pixel. Data may be transferred to OpenAI in the USA; as OpenAI is not certified under the EU-US Data Privacy Framework, we base this transfer on Standard Contractual Clauses (Art. 46(2)(c) GDPR). A level of protection fully equivalent to EU standards cannot be guaranteed in every case; your consent also covers this transfer (Art. 49(1)(a) GDPR). The pixel is loaded only after you have given your consent; without consent no data is transmitted to OpenAI. You may withdraw your consent at any time with effect for the future via the cookie settings. Further information: openai.com/policies/eu-privacy-policy.

7.8. Microsoft Advertising – UET (Conversion Tracking & Remarketing) 
We use the Universal Event Tracking (UET) of Microsoft Advertising from Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to measure conversions and for remarketing.

  • Data processed: Within the framework of conversion tracking and remarketing, personal data (e.g. cookie or device identifiers, IP address) is processed. The transfer to the USA (Microsoft Corporation) is made within the framework of the EU-US Data Privacy Framework as well as the EU Standard Contractual Clauses.
  • Legal basis: Art. 6(1)(a) GDPR (consent via Klaro).
  • Privacy policy: https://privacy.microsoft.com/privacystatement.

8. Data Collection during Website Visit (Server Log Files)

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is stored in so-called server log files:

  • Browser type and version
  • Operating system used
  • Referrer URL (the previously visited page)
  • Host name of the accessing computer (IP address)
  • Time of the server request

This data is technically necessary to display the website correctly and to ensure the security of our IT systems. This data is not merged with other data sources.

The server log files are deleted after 30 days at the latest, unless statutory retention obligations apply. Legal basis: Art. 6(1)(f) GDPR (security and stability).

9. Data Security (SSL/TLS Encryption)

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL/TLS) via HTTPS. You can recognise an encrypted connection by the "https://" prefix and the lock symbol in your browser bar.

10. Map Services

To display locations and service areas, we use the open-source library Leaflet https://leafletjs.com/. Leaflet itself does not collect personal data. However, when loading map data (tiles) from third-party providers (e.g. OpenStreetMap), your IP address is technically transmitted to their servers. This is based on our legitimate interest in a visual display of our services (Art. 6(1)(f) GDPR).

11. Telephony and Payment Processing

11.1. Telephony
For telephone availability and call handling we use the telephony service of Zadarma (Zadarma Project LLP) as a processor, as well as our own telephone system operated on our servers in Germany. Calls via WhatsApp are received via the WhatsApp Business Platform (Section 6.1). This involves processing your phone number and connection data (time, duration, number called) in order to handle your enquiry, return missed calls and measure the quality of our brokerage service. Legal basis: Art. 6(1)(b) and (f) GDPR.

11.2. Online payment (Stripe)
For the online payment of our invoices we use the payment service of Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). If you use the payment link in an invoice, your payment data (e.g. name, e-mail address, invoice amount, invoice number, card or account details) is collected directly by Stripe; we ourselves do not receive complete card or account details, but only confirmation of the payment status. Stripe is itself the controller for payment processing, fraud prevention and compliance with financial-law obligations (e.g. anti-money laundering). A transfer to Stripe, Inc. in the USA is possible; it takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (legal obligations). Privacy policy: https://stripe.com/de/privacy.

11.3. Payment via Klarna
If you choose to pay via Klarna, your data (including name, address, date of birth, e-mail address, invoice amount) is transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, which, as an independent controller, may carry out identity and credit checks. Legal basis: Art. 6(1)(b) GDPR. Privacy policy: https://www.klarna.com/de/datenschutz/.

12. Your Rights as a Data Subject

Within the framework of the applicable statutory provisions, you have the right at any time to:

  • Access (Art. 15 GDPR): Regarding the data we have stored about you.
  • Rectification (Art. 16 GDPR): Correction of inaccurate data.
  • Erasure (Art. 17 GDPR): "Right to be forgotten".
  • Restriction of Processing (Art. 18 GDPR).
  • Data Portability (Art. 20 GDPR).
  • Objection (Art. 21 GDPR): Against processing carried out on the basis of a legitimate interest.
  • No automated decision-making (Art. 22 GDPR): No decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you takes place. The automatic preselection of suitable Service Partners is always reviewed by our dispatchers.
  • Withdrawal of consent (Art. 7(3) GDPR): Insofar as the processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

To exercise these rights, please contact us using the contact details provided above (datenschutz@trucknetz.de).

13. Supervisory Authorities (Right to Lodge a Complaint)

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of your personal data violates the GDPR.

Supervisory authority responsible for us:

  • Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Phone: +49 (0) 981 180093-0, https://www.lda.bayern.de/.

Irrespective of this, you can also contact the data protection supervisory authority of your usual place of residence or workplace.

14. Information for Partner Companies and Complaints

Depending on the order model (§ 2 GTC), your contractual partner is either GEARS Digital UG itself (own performance) or the Service Partner named in the order confirmation (brokerage).

  • For complaints regarding the technical platform, please contact us (GEARS Digital UG).
  • For complaints regarding the physical execution (e.g. damage during towing, quality of repairs, or tyre service provided by our network partners), the respective partner is your direct contact. If mediation at the company level is not possible, you can contact the specialist authorities responsible for the partner's registered office:

15. Consumer Dispute Resolution

Our e-mail address can be found above in Section 2. We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer dispute resolution body.

16. Registration and Data Processing for Partner Companies (B2B)

Should you register or apply on our website as a service partner (e.g. towing service, workshop), we collect additional company-related data. This is necessary in order to include you in the TruckNetz.DE network and to be able to broker orders to you. This data includes:

  • Company name and legal form
  • Location(s) and radius of operation
  • Business contact details (phone, e-mail, website)
  • Information on the vehicle fleet and services offered
  • Value added tax identification number (VAT ID) or tax number

Legal basis: The processing is carried out on the basis of Art. 6(1)(b) GDPR (initiation and performance of a partner agreement) and Art. 6(1)(f) GDPR (our legitimate interest in quality assurance and the brokering of specialist businesses).

16a. Data from Publicly Accessible Sources
In order to acquire new service partners, we collect business contact details of towing, breakdown assistance and workshop businesses (company name, owner's name in the case of sole proprietorships, address, telephone, e-mail, website, range of services) from publicly accessible sources (e.g. company and trade directories, map services, the businesses' websites). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in acquiring partners). You may object to this processing at any time (Art. 21 GDPR, datenschutz@trucknetz.de); the data will then be erased or blocked.

17. Publication of Partner Data and Order Brokerage

As part of the TruckNetz.DE network, this website serves to broker orders.

  • Public profiles: The public display of your business contact details (company name, address, phone number, services offered) on our website, so that drivers seeking assistance can contact you directly, forms part of the partner agreement (Art. 6(1)(b) GDPR).
  • Disclosure to customers: In the event of a specific brokered order, your data is transmitted to the customer (driver/haulage company). In return, you receive the customer's data necessary for processing the order (location, vehicle data, driver's contact).

18. Duration of Storage of Partner Data

Partner company data is stored for the duration of the active cooperation. Upon termination of the partnership, the data is deleted, unless statutory retention obligations (e.g. 8 years for invoices and accounting vouchers, 10 years for books and annual financial statements, § 147 AO, § 257 HGB) apply.

19. Mobile App "LKW Abschleppdienst: Truck-Netz"

In addition to our website, we offer the mobile app "LKW Abschleppdienst: Truck-Netz". Below we inform you about what data the app collects and how it is processed.

19.1. What data the app collects

Contact form data (when you submit an enquiry):

  • Name, phone number, description of the damage — when submitting a request via the form in the app.
  • Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Geolocation (with your permission):

  • GPS coordinates — only when the location button in the cost calculator is pressed.
  • The data is not stored on the server and is used solely for distance calculation.
  • Legal basis: Art. 6(1)(a) GDPR (consent).

Technical data (automatic):

  • Pseudonymous device identifier (UUID) — to prevent API abuse.
  • Interface language, app version.
  • Stored in the device's encrypted storage (Keystore / Keychain).
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest — security).

Usage events:

  • Taps on the call button, messenger interactions and form submissions — in anonymised or pseudonymised form. These events are processed on our own server (api.trucknetz.de). If you consent in the app's consent dialog, corresponding events are additionally analysed via Google Analytics for Firebase (see Section 19.6).
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest — service improvement) or, where analysis by Google takes place, Art. 6(1)(a) GDPR (consent).

19.2. Map service

19.3. Local data storage

  • Settings (language, selected city) are stored locally on the device.
  • Cache data for offline access is stored locally.
  • Data is not synchronised with cloud services.

19.4. What data is not collected

  • Advertising identifiers (GAID / IDFA)
  • Contacts, photos, files
  • Browsing history
  • Data from other apps

19.5. Crash and error diagnostics (Firebase Crashlytics)

To detect, analyse and fix program errors, we use Firebase Crashlytics, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). If the app crashes or a serious error occurs, technical diagnostic data is automatically collected and transmitted to Google, in particular: the type and time of the error, the state of the program at the time of the error (so-called stack trace), device model and operating system version, language setting and app version, as well as a randomly generated installation identifier (Firebase Installation ID). This data does not contain any form or contact data entered by you and is used exclusively to improve the stability and security of the app. Transmission to and storage on Google's servers, including in the USA, may occur; for this transfer we rely on the EU Standard Contractual Clauses and/or Google's certification under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in the stable and error-free operation of the app pursuant to Art. 6(1)(f) GDPR. Further information: https://firebase.google.com/support/privacy

19.6. Usage analysis (Google Analytics for Firebase)

If you consent in the app's consent dialog, we use Google Analytics for Firebase, an analytics service provided by Google Ireland Limited, to evaluate the use of the app on a statistical and pseudonymous basis (e.g. screens viewed, interactions with buttons, frequency and duration of use). For this purpose, a pseudonymous app instance identifier is processed. Advertising identifiers (IDFA on iOS, GAID on Android) are not used. We use Google Consent Mode v2: without your consent, no analytics data is transmitted to Google. Data may be transmitted to Google's servers, including in the USA (EU Standard Contractual Clauses and/or EU-US Data Privacy Framework). Your consent is voluntary and can be withdrawn at any time with effect for the future in the app's privacy settings. Legal basis: Art. 6(1)(a) GDPR (consent).

19.7. Provision via app stores

The app is obtained and installed via the respective app store, i.e. the Apple App Store (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) or Google Play (Google Ireland Limited). When downloading, certain data — such as your user identifier, e-mail address, the time of download and a device- or account-related identifier — is processed by the respective store operator under its own data protection responsibility. We have no influence on the nature and scope of this processing. In this respect, only the privacy policy of the respective provider (Apple or Google) applies.

19.8. Storage period of app data

Contact data submitted via the app form is stored for the duration of processing your request and any follow-up questions and is then deleted, unless statutory retention obligations apply. Crash and usage data (sections 19.5 and 19.6) are processed in accordance with Google's retention periods. Data stored locally on the device remains there until you uninstall the app or delete the data in the app settings.

20. Presence on social media

We maintain publicly accessible profiles on social media in order to communicate with customers, prospects and partners and to inform them about our services (public relations). When you visit these profiles, your personal data is collected and processed by the respective platform operator – in particular usage and interaction data, IP address, and information collected via cookies and comparable technologies. The operator generally provides us with anonymised statistics (Insights) derived from this. The legal basis for our presence and reach analysis is Art. 6(1)(f) GDPR (legitimate interest in public relations and marketing).

20.1. Joint controllership (Art. 26 GDPR)

For the processing of page and interaction data we and the respective platform operator are joint controllers (cf. CJEU, judgment of 5 June 2018, C-210/16). With Meta (Facebook/Instagram), the "Page Insights Controller Addendum" applies: https://www.facebook.com/legal/terms/page_controller_addendum. The essential content of these arrangements is made available by the platforms in their privacy notices.

20.2. Right to object (Art. 21 GDPR)

You may object at any time to processing based on Art. 6(1)(f) GDPR. You can also configure advertising and tracking settings directly in your account or in the privacy settings of the respective platform.

20.3. Third-country transfer

The providers may transfer data to the USA and other third countries. This is based on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (Art. 46 GDPR).

20.4. Your rights

Access, rectification, erasure, restriction, data portability and the right to lodge a complaint with a supervisory authority. You may assert these both against us and against the respective provider; for data collected on the platforms, the provider can process such requests most effectively.

We are present on the following platforms:

  • Facebook & Instagram — Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland — https://www.facebook.com/privacy/policy/
  • YouTube — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — https://policies.google.com/privacy
  • TikTok — TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland — https://www.tiktok.com/legal/privacy-policy
  • X (formerly Twitter) — Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland — https://x.com/privacy

21. Storage Periods at a Glance

Unless a more specific period is stated in this policy, we store personal data only for as long as is necessary for the respective purpose. We retain order and invoice records in accordance with the retention obligations under commercial and tax law (in Germany up to 10 years, § 147 AO, § 257 HGB).

22. Changes to this Privacy Policy

We amend this privacy policy when our services, the service providers we use or the legal situation change. The version published on this page applies in each case; the date of the current version is given in the heading.