What is Heartbeat AI?

Privacy Policy

Last updated: January 2026

This translation is provided for convenience only. The German version is legally binding.

We are pleased that you are interested in Heartbeat AI GmbH (hereinafter "We", "Us") and that you are visiting Our website. With the information set out below, We give you an overview of the processing of your personal data on Our website heartbeat-ai.com (hereinafter "Website") and of your rights under data protection law.

We always process your personal data in accordance with the statutory provisions, in particular the EU General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG").

1Controller

The controller within the meaning of Art. 4(7) GDPR for the Website and the associated data processing is:

Heartbeat AI GmbH
Neuer Wall 35
20354 Hamburg

Email: contact@heartbeat-ai.com

2Data Protection Officer

You can reach Our external data protection officer at:

Martin Trutt
ITADA Enterprise Solutions GmbH
Jahnallee 14
04109 Leipzig

Email: dsb@itada.de

3General Information

Below, We give you an overview of the personal data We process. To this end, We set out to what extent, for what purposes and on which legal basis We process your personal data. We also state which third-party providers We use.

3.1International Data Transfers

Where We transfer personal data to a third country, We ensure compliance with Art. 44 et seq. GDPR, i.e. before any disclosure of personal data to third parties in a country outside the European Economic Area, We check whether an adequate level of protection is ensured. This may be guaranteed by an adequacy decision of the European Commission or by the transfer to the third country being permitted under other safeguards provided for in Art. 46 et seq. GDPR. If you would like further information on international data transfers and existing safeguards, or would like to receive copies of these safeguards, please contact Our data protection officer.

3.2Erasure of Data

We erase your personal data in accordance with standardised processes as soon as it is no longer necessary for the purposes of the processing, there are no overriding legitimate grounds in the event of an objection, or there is no other legal basis for the processing in the event that you withdraw your consent. In certain cases, e.g. where there is a statutory retention obligation, your personal data will first be restricted and then erased once the retention period has expired. This privacy policy may contain further specific information on the retention and erasure of personal data.

3.3Data Security

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of personal data by controlling physical and electronic access to the personal data, as well as access to it, its input, its disclosure, the securing of its availability and its separation. Furthermore, We have established procedures that ensure the exercise of data subject rights, the erasure of personal data and responses to threats to the data. We also take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principle of data protection by design and by default.

3.4Recipients of Personal Data

In the course of Our processing of personal data, personal data may be transferred to or disclosed to other bodies, (affiliated) companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website.

4Categories of Personal Data Processed and the Source of Your Personal Data

4.1Provision of the Website

4.1.1Scope of Processing

To provide Our Website, We use storage space, computing capacity and software that We rent from a corresponding server provider (web host). These services also include sending, receiving and storing emails. In addition, when you visit Our Website, data that your browser transmits to Our server is processed automatically. This general data and information is stored in the server's log files (so-called server log files). The following may be recorded:

  • information about the browser type and version used;
  • operating system of the end device;
  • internet service provider;
  • IP address;
  • date and time of access; and
  • the previous website from which you reached the Website.

4.1.2Purpose of Processing

The collection and further processing of your IP address by Our system is necessary to enable you to use the Website, to optimise it and to prevent fraud.

4.1.3Legal Basis

The legal basis for the data processing is Our legitimate interest within the meaning of Art. 6(1)(f) GDPR. We have an overriding legitimate interest in making a website available and in being able to offer Our services in a technically flawless manner.

4.1.4Storage Period

For security reasons (e.g. to investigate misuse or fraud), the log files are stored for a maximum of 7 days and then deleted. Data whose further retention is required for evidentiary purposes is retained until the matter has been finally resolved.

4.1.5Recipients of Personal Data

Your personal data is disclosed to the extent necessary to service providers for hosting and content delivery network (CDN) services acting as processors.

4.2Use of Cookies

4.2.1General Information

We use cookies on Our Website. Cookies are files that your browser creates automatically and that are stored on your IT system when you visit Our site. The cookie stores information that relates to the specific end device used.

Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters by which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognised and identified by means of the unique cookie ID. When you visit Our Website or a subpage for the first time and it contains these cookies, you will be shown "Privacy Settings". There you will be informed about the individual cookies We use. You can obtain information about each individual cookie with regard to its name, provider, purpose of processing and storage period. You can also allow Us to use non-essential cookies and revoke this decision there at any time. A distinction must be made between technically necessary and non-necessary cookies.

4.2.2Technically Necessary Cookies

We use technically necessary cookies. These are cookies that are technically necessary to provide all functions of Our Website. The legal basis for the data processing is Our legitimate interest within the meaning of Art. 6(1)(f) GDPR. We have an overriding legitimate interest in being able to offer Our services in a technically flawless manner. The legal basis for the use of cookies in relation to Our contractual partners who use services owed by Us under contract via Our Website is Art. 6(1)(b) GDPR, the performance of Our contractual services. Information pursuant to Art. 13 GDPR on the services We use that set essential cookies on Our Website can be found in Our cookie banner. You can open the cookie banner at any time via the "Cookie Settings" button in the footer of Our Website.

4.2.3Non-Necessary Cookies

In addition, We also use non-necessary cookies (e.g. analytics and marketing cookies). These are cookies that are not technically necessary. We use them to understand your behaviour on Our Website and to improve Our services. The legal basis for the data processing is your consent pursuant to Art. 6(1)(a) GDPR. The cookies are only set after you have given your consent via Our cookie banner. Information pursuant to Art. 13 GDPR on the services We use that set non-essential cookies on Our Website can be found in Our cookie banner. You can open the cookie banner at any time via the "Cookie Settings" button in the footer of Our Website.

4.2.4Storage Period

With regard to the storage period, a distinction is made between the following types of cookies:

i. Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).

ii. Persistent cookies: Persistent cookies remain stored even after the end device has been closed. For example, the login status can be saved or preferred content displayed directly when the user visits a website again. Likewise, user data collected with the help of cookies can be used for reach measurement. Unless We provide users with explicit information on the type and storage period of cookies (e.g. when obtaining consent), users should assume that cookies are persistent and that the storage period can be up to two years.

4.3Cookie Banner

4.3.1Scope of Processing

In order to present you with information on cookies in the form of "Privacy Settings", We use a cookie banner on Our Website. With Our cookie banner, We inform you about the specific cookies We use. In addition, We give you the option of deciding whether you wish to consent to the setting of non-essential cookies. The following may be processed:

i. usage data (e.g. websites visited, time of access); and

ii. meta and communication data (e.g. IP address).

4.3.2Purpose of Processing

We process your personal data for the following purposes:

i. informing the user about the cookies We use; and

ii. providing a means of consenting to technically non-necessary cookies.

4.3.3Legal Basis for Processing

The legal basis for the use of the cookie banner is Art. 6(1)(f) GDPR. We have an overriding legitimate interest in using the cookie banner, which enables Us to obtain the legally required consent for the use of non-essential cookies and to comply with Our information obligations regarding cookies.

4.3.4Storage Period

The cookie banner stores the preferences you have selected until you reset or change them.

4.3.5Recipients of Personal Data

Your personal data is disclosed to the extent necessary to a cookie banner service provider acting as a processor.

4.4Contact Options

4.4.1Scope of Processing

Via Our Website, you can contact Us by email contact form or via Our partner portal. When you contact Us and We respond to your enquiry, We process the personal data shown in the respective contact form. This may include the following personal data:

  • first and last name;
  • email;
  • address;
  • telephone number;
  • date and time of the enquiry;
  • IP address; and
  • other personal data that you provide to Us when contacting Us.

4.4.2Purpose of Processing

We process your personal data in order to respond to your enquiry and to deal with any other matters arising from it.

4.4.3Legal Basis

If your enquiry is related to pre-contractual measures or to an existing contract with Us, the legal basis is the performance of a contract and the implementation of pre-contractual measures pursuant to Art. 6(1)(b) GDPR.

If your enquiry is made independently of pre-contractual measures or existing contracts with Us, Our overriding legitimate interests pursuant to Art. 6(1)(f) GDPR constitute the legal basis. We have an overriding legitimate interest in offering visitors to Our Website a way to contact Us.

4.4.4Storage Period

We erase your personal data as soon as it is no longer required to achieve the purpose for which it was collected. In the case of contact enquiries, this is generally the case when it is clear from the circumstances that the matter in question has been conclusively resolved.

4.4.5Recipients of Personal Data

Your personal data is disclosed to the extent necessary to a customer contact management service provider acting as a processor.

4.4.6Contact via WhatsApp

If you are interested in a consultation with Our employees, have provided Us with your mobile phone number and are registered with WhatsApp, We may contact you via the WhatsApp messenger. WhatsApp is a messenger app of WhatsApp LLC (1 Meta Way, Menlo Park, California 94025, USA) for end-to-end encrypted message transmission. Using WhatsApp allows Us to exchange offer information and details about your specific requirements via a secure transmission channel. If you do not wish to be contacted in this way, you can let Us know at any time.

4.5Ordering and Activating Our Product Heartbeat

4.5.1Scope of Processing

Via Our Website, you can order or activate Our product "Heartbeat". To carry out these processes, We process your personal data. In particular, We process the following personal data:

  • first and last name;
  • postal address;
  • email address;
  • telephone number; and
  • communication content, where applicable.

4.5.2Purpose of Processing

We process your personal data in order to handle your request.

4.5.3Legal Basis

If your request is related to pre-contractual measures or to an existing contract with Us, the legal basis is the performance of a contract and the implementation of pre-contractual measures pursuant to Art. 6(1)(b) GDPR.

4.5.4Recipients of Personal Data

Your personal data is disclosed to the extent necessary to service providers acting as processors for carrying out the product order or activation.

4.6Newsletter

4.6.1Scope of Processing

If you have provided Us with your email address when purchasing one of Our services, We use it to inform you about Our own similar goods or services by newsletter.

You can object to receiving Our newsletters at any time by clicking on the unsubscribe link at the end of each newsletter We send. Your email address will then be removed from the newsletter mailing list.

Our newsletters contain so-called tracking links, which enable Us to analyse the behaviour of newsletter recipients. This makes it possible, for example, to analyse how many recipients opened the newsletter message and how often which link in the newsletter was clicked. This enables Us to statistically evaluate the success or failure of online marketing campaigns. The personal data collected via the tracking links is stored and evaluated by Us in order to optimise the sending of the newsletter and to tailor the content of future newsletters even more closely to your interests.

When sending the newsletter, We process, among other things, the following personal data:

  • email address;
  • first and last name;
  • organisation;
  • preferred language;
  • metadata (e.g. device information, IP address, date and time of registration); and
  • interaction with the newsletter.

4.6.2Purpose of Processing

We process your personal data for the following purposes:

i. Newsletter dispatch: carrying out marketing measures; and

ii. Newsletter tracking: measuring success.

4.6.3Legal Basis

The legal basis for sending Our newsletter is the consent you have given pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by making the corresponding changes or adjustments in your cookie settings. The legal basis for newsletter tracking is Our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR in finding out whether Our newsletter meets your interests and expectations.

4.6.4Storage Period

We erase your personal data as soon as it is no longer required to achieve the purpose for which it was collected. In the context of sending the newsletter, this is generally the case when you object to the processing.

4.6.5Recipients of Personal Data

Your personal data is disclosed to the extent necessary to a newsletter service provider acting as a processor.

4.7Applications via Our Website

4.7.1Scope of Processing

If you apply via Our Website (e.g. via Our contact forms or Our recruiting website), we process the personal data you voluntarily provide, such as your name, contact details (email address, telephone number), information on qualifications, professional background, free-text fields and any documents uploaded (e.g. CV, references, cover letter).

4.7.2Purpose of Processing

The processing serves to assess your suitability for the advertised position, to carry out the application process and to decide on a possible hiring. Where necessary, we will contact you to clarify any open questions.

4.7.3Legal Basis

The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG (implementation of pre-contractual measures or initiation of an employment relationship). Longer storage for future vacancies only takes place on the basis of your express consent pursuant to Art. 6(1)(a) GDPR.

4.7.4Storage Period

Your application data is stored for the duration of the application process and erased no later than 6 months after its conclusion (offer, rejection or withdrawal), unless longer statutory retention obligations (e.g. under commercial or tax law) apply. If you have given your consent, a storage period of one year or until you withdraw your consent applies.

4.7.5Recipients of Personal Data

Internally, your personal data is received exclusively by the departments responsible for the application process (HR, financial accounting, controlling/auditing, the relevant specialist department). Within Our group of companies, only those bodies and departments that need personal data to fulfil the aforementioned purposes receive it. Data is not disclosed to third parties, except to processors (e.g. HR software, hosting services, recruitment service providers, IT service providers). Our recruiting website (https://1komma5grad.jobs.personio.de/) is operated by Personio SE & Co. KG, a company based in Germany that provides HR management and applicant management software. Personio processes this data as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement. We remain the controller under data protection law for the processing of your personal data in connection with the application. The data is stored in Amazon Web Services (AWS) data centres in Frankfurt or within the European Union and does not leave the EU. Further information on data processing by Personio can be found in Personio's privacy policy at https://www.personio.com/privacy-policy/ and in the Personio Trust Center (https://www.personio.com/security/).

4.8Social Media Presence

We use third-party platforms to provide you with information about Our company and Our products and services. In doing so, interactions such as messages, likes and content on Our social media channels are processed. Insofar as personal data is processed in the course of communication, this serves to handle feedback about Our services.

Your personal data is only stored in personally identifiable form for as long as is necessary for the purposes for which it is processed, for example until the expiry of any guarantee, warranty, limitation and statutory retention periods, unless otherwise specified in this privacy policy.

We receive non-personal data from third-party platforms, such as the total number of measures delivered by the platform operator or preferred visiting and posting times. We have no influence on the creation and provision of this data. The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in improving Our marketing measures.

The associated data processing takes place exclusively within the sphere of responsibility of the platform operators. Further information on data processing can be found in the privacy policies of the respective providers:

4.9Integration of Third-Party Services

On the basis of your consent within the meaning of Art. 6(1)(a) GDPR, We use content or service offerings from third-party providers on Our Website in order to embed their content and services, such as videos or fonts (hereinafter uniformly referred to as "Content").

This always requires that the third-party providers of this Content perceive the IP address of the users, as they could not send the Content to their browsers without the IP address. The IP address is therefore required to display this Content. We endeavour to use only Content whose respective providers use the IP address solely to deliver the Content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this Website. The pseudonymous information may also be stored in cookies on the users' devices and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of Our online services, and may also be combined with such information from other sources.

4.9.1fraud0

As the website provider, we use fraud0 of fraud0 GmbH, Sendlinger Straße 7, 80331 München (https://www.fraud0.com/) to detect invalid traffic, bots and low-quality traffic and to prevent fraud on our Website. This serves to improve our online marketing measures, clean up marketing-relevant statistics and increase user-friendliness. In doing so, personal data such as IP address, browser and device information (e.g. device type, operating system, user agent), location data, page views, click paths, session data and usage and behavioural data are processed. The data is used exclusively for the real-time classification and analysis of traffic; in the admin interface, we only receive aggregated classifications without personal data. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR in fraud prevention and marketing optimisation (Recital 47 GDPR). fraud0 processes data as a processor (Art. 28 GDPR) under a concluded data processing agreement. Further information on data protection at fraud0 can be found at https://fraud0.com/privacy-policy/.

4.9.2Trustpilot

On Our Website, We use Trustpilot of Trustpilot Group plc, Pilestræde 34, 1112 Copenhagen, Denmark (https://www.trustpilot.com/) to collect and display customer reviews. This serves transparency and the improvement of Our services. In doing so, personal data such as name, email address, IP address, browser data, review content, star ratings and, where applicable, profile information are processed. The data is processed in order to invite you to submit reviews and to publish and analyse feedback. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (e.g. via the consent banner or opt-in for invitations) and our legitimate interest pursuant to Art. 6(1)(f) GDPR in qualified feedback. Trustpilot acts as a processor (Art. 28 GDPR) under a concluded data processing agreement. Further information on data protection at Trustpilot can be found at https://de.legal.trustpilot.com/.

4.9.3Optimeleon

On Our Website, We use Optimeleon of Optimeleon GmbH, Bodelschwinghstraße 15, 01445 Radebeul, Germany (https://www.optimeleon.com/). This AI-supported CRO (conversion rate optimisation) tool serves to analyse and optimise user behaviour in order to improve the Website's functions and user experience. In doing so, personal data such as IP address, usage and device data, browser information and behavioural data (e.g. page views, clicks) are processed. The processing serves to provide, optimise and analyse the Website and to identify optimisation potential. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR in the technical optimisation and security of Our Website, or your consent pursuant to Art. 6(1)(a) GDPR (e.g. via the cookie banner). Optimeleon acts as a processor (Art. 28 GDPR). Further information on data protection at Optimeleon can be found at https://www.optimeleon.com/imprint.

4.9.4Hello Charles

On Our Website, We use Hello Charles of Hello Charles GmbH, Kurfürstendamm 71, 10709 Berlin, Germany (https://www.hello-charles.com/). In this context, data from you is collected, logged and forwarded to Our customer service accordingly. Only data that you enter yourself when interacting with the chatbot is collected, as well as your account ID if you are logged in as a customer at the time. The information you share is neither disclosed to third parties nor used to train the AI. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (e.g. via chat opt-in or the cookie banner) and our legitimate interest pursuant to Art. 6(1)(f) GDPR in efficient customer communication. Hello Charles acts as a processor (Art. 28 GDPR) under a concluded data processing agreement. Further information on data protection at Hello Charles can be found in its privacy policy at https://www.hello-charles.com/en-gb/privacy-policy/.

4.9.5telli

In Our telephone service, We use voice AI from telli technologies GmbH, Knaackstraße 78, 10435 Berlin (https://www.telli.com/de) to recognise natural language and to improve service quality. With your consent, this AI agent is used to schedule appointments and to record basic data in order to provide customers and prospective customers with high-quality service. The content of a conversation with the AI assistant is logged, forwarded to Our customer service and assigned to your customer account. The information you share is neither disclosed to third parties nor used to train the AI. The processing serves the efficient handling of customer enquiries, natural conversations and the optimisation of the customer journey. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (e.g. via opt-in for calls) or our legitimate interest pursuant to Art. 6(1)(f) GDPR in automated customer communication. telli acts as a processor (Art. 28 GDPR) under a concluded data processing agreement. Further information on data protection at telli can be found in its privacy policy at https://www.telli.com/de/data-privacy.

4.9.6Calendly

On Our Website, We use Calendly of Calendly, LLC, 130 King Street, Suite 322, San Francisco, CA 94107, USA (https://calendly.com/). This tool enables simple online scheduling and calendar integration for efficient arrangements with customers. As part of appointment scheduling, you can arrange an appointment with Our sales advisors via the online service Calendly. In this case, the data you enter for this appointment (name, contact details) and any other data you enter regarding the appointment are processed. In doing so, personal data such as name, email address, telephone number, appointment preferences, IP address and calendar data (e.g. from Google/Outlook) are processed. The processing serves to handle booking requests and to avoid double bookings. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (e.g. via booking opt-in) or our legitimate interest pursuant to Art. 6(1)(f) GDPR in optimised appointment management. Calendly acts as a processor (Art. 28 GDPR). Where data is transferred to third countries (in particular the USA), this takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular standard contractual clauses and the EU‑US Data Privacy Framework. Further information on data protection at Calendly can be found at https://calendly.com/legal/privacy-notice.

4.9.7autarc

As part of project planning, We use the tool autarc of autarc GmbH, Invalidenstr. 5, 10115 Berlin (https://www.autarc.energy/) to calculate heating loads. This serves to enable Us to offer you the best possible solution. In this context, data on the planning object (postcode, location, consumption, room data) together with your customer data is stored and processed by autarc GmbH for the purpose of initiating and performing the contract. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (e.g. via booking opt-in) or our legitimate interest pursuant to Art. 6(1)(f) GDPR in effective project planning. autarc acts as a processor (Art. 28 GDPR). Further information on data protection can be found in autarc's privacy policy at https://www.autarc.energy/datenschutz.

4.9.8Aircall

On Our Website, We use Aircall of Aircall SAS, 5 rue Lafayette, 75009 Paris, France (https://aircall.io/) as part of Our telephone communication with customers. In this context, the metadata of the call (number, time and duration) is processed. If you consent to a recording during the call, this call recording is also processed and assigned to your customer account. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (e.g. for recordings) or our legitimate interest pursuant to Art. 6(1)(f) GDPR in professional telephone communication. Aircall acts as a processor (Art. 28 GDPR). Further information on data protection at Aircall can be found at https://aircall.io/privacy/.

4.9.9Heyflow

On Our Website, We use the tool Heyflow of Heyflow GmbH, Jungfernstieg 49, 20354 Hamburg (https://heyflow.com/). Heyflow enables us to create interactive funnels and forms in order to process your enquiries efficiently and to increase user-friendliness. In doing so, personal data such as name, email address and other information you enter in the form are processed by Heyflow. In addition, technical data such as IP address and browser information may be collected. The data is processed exclusively to handle your enquiries and to optimise Our online services. The legal basis for the data processing is your consent pursuant to Art. 6(1)(a) GDPR. The data is stored and processed in accordance with a data processing agreement concluded with Heyflow (Art. 28 GDPR). Further information on data protection at Heyflow can be found at https://heyflow.com/de/datenschutz/.

4.9.10Zendesk

For our customer service and the handling of enquiries, we use the Zendesk platform of Zendesk Inc., 989 Market Street, San Francisco, CA 94103, USA (https://www.zendesk.de/). Zendesk bundles enquiries from various channels (e.g. email, contact form, chat where applicable) in a ticket system in order to handle them in a structured way and to improve service quality. In doing so, personal data such as name, contact details (e.g. email address), content data from enquiries/tickets, attachments where applicable, technical metadata (e.g. IP address, time, browser information) and usage and communication histories are processed. Zendesk processes this data as a processor on our behalf; a data processing agreement pursuant to Art. 28 GDPR has been concluded. The legal basis for the use of Zendesk is Art. 6(1)(b) GDPR, insofar as the communication is necessary for the performance of a contract or for the implementation of pre-contractual measures, and Art. 6(1)(f) GDPR for our legitimate interests in efficient and traceable customer communication. Where data is transferred to third countries (in particular the USA), this takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular standard contractual clauses and the EU‑US Data Privacy Framework. The data is stored and processed in accordance with a data processing agreement concluded with Zendesk (Art. 28 GDPR). Further information on data processing by Zendesk can be found in Zendesk's privacy notice at https://www.zendesk.de/company/agreements-and-terms/privacy-notice/.

5Your Rights as a Data Subject

In this section, We inform you about the rights you have as a data subject with regard to the processing of your data. If you wish to exercise your data subject rights, please contact Our external data protection officer by email (dsb@itada.de).

As a data subject, you have the right to obtain confirmation as to whether personal data concerning you is being processed by Us and, where that is the case, the right of access to the data stored about you and to receive a copy of it (Art. 15 GDPR). If inaccurate personal data is processed, you have the right to rectification (Art. 16 GDPR). If the statutory requirements are met, you can request erasure or restriction of processing (Art. 17 and 18 GDPR).

If the processing is based on your consent within the meaning of Art. 6(1)(a) GDPR, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Insofar as you have consented to the processing or the processing of your data is carried out for the performance of the contract with you and the processing is carried out by automated means, you have the right to data portability with regard to the data you have provided to Us (Art. 20 GDPR).

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data where the processing is based solely on Art. 6(1)(e) or (f) GDPR (Art. 21(1) GDPR).

You have the right to lodge a complaint with a data protection supervisory authority about Our processing of personal data.

6Necessity of Providing Personal Data

The provision of your personal data is neither required by law nor by contract, and you are not obliged to provide Us with personal data. However, without the provision of personal data, We cannot conclude contracts with you or make the Website available to you.

7No Automated Individual Decision-Making

We do not use your personal data for automated individual decision-making within the meaning of Art. 22(1) GDPR.

8Changes to This Privacy Policy

If We further develop Our Website and Our services, or if statutory or regulatory requirements change, it may be necessary to amend this privacy policy.

Last updated: January 2026