Skip to main content

Privacy Policy

Last updated on 02 October 2026

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites (linkbroker.de), within our platform (app.linkbroker.de), as well as within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”).

The terms used are not gender-specific.

Table of Contents

  1. Controller
  2. Overview of Processing Operations
  3. Relevant Legal Bases
  4. Security Measures
  5. Transfer of Personal Data
  6. Data Processing in Third Countries
  7. Erasure of Data
  8. Rights of Data Subjects
  9. Automated Decision-Making in Individual Cases and AI Features
  10. Use of Cookies and Consent Management
  11. Provision of the Online Offer and Web Hosting
  12. Registration and Customer Account
  13. Commercial Services
  14. Payment Procedures
  15. Contact and Inquiry Management
  16. Newsletter and Electronic Notifications
  17. Promotional Communication via Email, Mail, or Telephone
  18. Web Analytics, Monitoring, and Optimization
  19. Online Marketing
  20. Google Search Console Integration
  21. Customer Reviews and Rating Procedures
  22. Presence in Social Networks (Social Media)
  23. Plugins and Embedded Functions and Content
  24. Application Process
  25. Changes and Updates to the Privacy Policy

1. Controller

Justscale GmbH

Königswinterer Str. 418

53227 Bonn, Germany

Authorized Representative: Mats-Lennart Petersen (Managing Director)

Email address: support@linkbroker.io

Phone: +49 2223 7960 039

A Data Protection Officer has not been appointed, as the statutory requirements for a mandatory appointment pursuant to Section 38 BDSG are not met.

2. Overview of Processing Operations

The following overview summarizes the types of data processed and the purposes of their processing, referring to the affected data subjects.

Types of Data Processed: We process inventory data (such as names, addresses, and company details), access data (such as passwords in encrypted form), payment data (such as bank details, invoices, and payment history), contact data (such as email addresses and phone numbers), content data (such as entries in online forms, chat messages, and uploaded documents), contract data (such as subject matter, term, orders, and credits), usage data (such as visited websites, interest in content, and access times), applicant data (such as personal information, qualifications, and certificates), as well as meta, communication, and procedural data (such as IP addresses, timestamps, identification numbers, and consent status). We only process Search Console data from connected Google accounts if you have actively established such a connection (see Section 20).

Categories of Data Subjects: Customers and their employees, prospects, communication partners, users (such as website visitors and platform users), business and contractual partners (in particular publishers and authors), newsletter recipients, and applicants.

Purposes of Processing: Provision of our online offer and user-friendliness, performance of contractual services and customer service, contact requests and communication, payment processing, security measures and error analysis, reach measurement and product optimization, marketing, conversion measurement, remarketing and target group formation, creation of pseudonymous user profiles, feedback, office and organizational procedures, execution of application procedures, and compliance with legal obligations.

3. Relevant Legal Bases

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection requirements in your or our country of residence or establishment may apply. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

Consent (Art. 6 (1) sentence 1 lit. a GDPR): The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Performance of a contract and prior inquiries (Art. 6 (1) sentence 1 lit. b GDPR): Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Legal obligation (Art. 6 (1) sentence 1 lit. c GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject.

Legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National data protection regulations in Germany: In addition to the GDPR, the Federal Data Protection Act (BDSG) applies, including special regulations on data processing for employment purposes (Section 26 BDSG). Furthermore, the Telecommunications Digital Services Data Protection Act (TDDDG) applies: Storing and reading information on terminal equipment (such as cookies or local storage) only takes place with your consent pursuant to Section 25 (1) TDDDG, unless it is strictly necessary to provide a digital service explicitly requested by you (Section 25 (2) No. 2 TDDDG).

4. Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, entry, disclosure, availability, and separation of data. All data transfers are TLS-encrypted (HTTPS); particularly sensitive data, such as access tokens of connected third-party accounts, are stored with additional encryption. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data vulnerabilities. We also take the protection of personal data into account as early as the development or selection of hardware, software, and procedures in accordance with the principle of data protection by design and by default.

5. Transfer of Personal Data

In the course of our processing of personal data, data may be transferred or disclosed to other entities, companies, legally independent organizational units, or persons. Recipients of this data may include IT service providers, payment service providers, email dispatch providers, and publishers, insofar as this is necessary to fulfill your orders; publishers receive only the information necessary to execute the order, but not your account or payment data. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts and agreements designed to protect your data (data processing agreements pursuant to Art. 28 GDPR) with the recipients of your data.

6. Data Processing in Third Countries

If we process data in a third country (i.e., outside the European Union or the European Economic Area) or if processing takes place in the context of using third-party services, this is only done in accordance with the legal requirements of Articles 44 to 49 GDPR.

For providers based in the US, we rely on their certification under the EU-US Data Privacy Framework (DPF), which ensures an adequate level of data protection pursuant to the EU Commission's adequacy decision of July 10, 2023. In addition and independently of this, we have agreed standard contractual clauses of the EU Commission with the providers so that appropriate safeguards exist even in the event of a possible invalidation of the DPF. You can check the certification status of individual providers at https://www.dataprivacyframework.gov/s/participant-search. Providers without DPF certification and transfers to other third countries (such as the People's Republic of China in the case of TikTok) are highlighted separately in the respective section.

7. Erasure of Data

The data processed by us will be erased in accordance with legal requirements as soon as consents granted for processing are revoked or other permissions cease to apply, for example when the purpose of processing no longer applies. If data is not erased because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. This applies, for example, to data that must be retained for commercial or tax reasons (Section 257 HGB and Section 147 AO: six, eight, or ten years depending on the type of document) or whose storage is necessary for the establishment, exercise, or defense of legal claims.

Individual sections of this privacy policy contain further details on retention and erasure of data that take precedence for the respective processing operation.

8. Rights of Data Subjects

As a data subject under the GDPR, you have various rights, arising in particular from Articles 15 to 21 GDPR.

Right to Object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing.

Right to Revoke Consent: You have the right to revoke granted consents at any time with effect for the future. For cookies and tracking, use our cookie settings accessible via the banner icon at the bottom of the page or the “Cookie Settings” link in the footer; for the newsletter, use the unsubscribe link in each email.

Access, Rectification, Erasure, Restriction, and Data Portability: You have the right to request access to the data processed (Art. 15 GDPR), rectification of incorrect data (Art. 16 GDPR), erasure and restriction of processing (Art. 17 and 18 GDPR), and data portability (Art. 20 GDPR).

Right to Lodge a Complaint with a Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority competent for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

To exercise your rights, an informal notification to support@linkbroker.de is sufficient.

9. Automated Decision-Making in Individual Cases and AI Features

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing within the meaning of Art. 22 GDPR. Our AI features assist you at your request; the initiation and conclusion of contracts as well as material decisions remain with you or are subject to human review.

Our platform offers optional AI features: an AI assistant (“Lexa AI”), AI-supported processing of documents uploaded by you (“AI Memory”), an AI-based search in our marketplace, and an interface to connect your own AI assistant (MCP Server). When you use Lexa AI, AI Memory, or the AI search, the content entered by you, uploaded documents, and account and project data required to answer are transmitted to our AI service provider and processed there exclusively to generate the response. Our AI service provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; we use language models from Google (Gemini) and Anthropic (Claude) via the Google Cloud platform Vertex AI (Model Garden) or the Gemini API. Processing takes place within the Google Cloud infrastructure on the basis of Google's Cloud Data Processing Addendum (data processing agreement); your content is not used to train the models. Insofar as data is transferred to Google LLC (USA), Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally.

MCP Interface (connecting your own AI assistant): Via our interface based on the Model Context Protocol (MCP), you can connect your customer account with an AI assistant of your choice, for example Claude, ChatGPT, or a development environment. Which functions and data the interface covers is described in our MCP documentation at https://app.linkbroker.de/mcp-documentation. You establish the connection actively yourself. Unlike with Lexa AI and AI Memory, we do not select the AI provider: the recipient of the data is the provider chosen by you, who processes it under its own responsibility and for whom its own privacy policy applies. We transmit the data upon your request and have no influence on the further processing there.

Once the connection is established, the connected assistant can retrieve those data of your account that are required for the respective request. In particular master data of your account, credit balance and transactions, invoices, orders and order details, projects, stored authors, favorites, shopping cart, and budgets. Where you use the corresponding functions, the assistant can also read, update and delete the AI Memory of your projects and the content of documents you have uploaded there.

The assistant can place orders in your name. These are settled against your credit balance. If your balance does not cover the amount, the assistant does not complete the purchase; it returns a link to your cart in Linkbroker, where you complete the payment. The same applies to topping up your balance: the assistant can only return a payment link. Card payments are always completed in the Linkbroker interface or at our payment service provider, including any strong customer authentication required (for example 3-D Secure). No card data is transmitted to or processed by the assistant.

The connection grants access to all of these functions; the interface currently does not provide for a restriction to individual areas or for a separate confirmation for each order. Each order is displayed in your customer account. You can disconnect the connection at any time under Settings → MCP Integrations; we then revoke and delete the associated access credentials without undue delay.

To manage the connection, we store the API key generated by you or the access and refresh tokens issued in the authorization procedure (OAuth 2.0). These are stored exclusively in encrypted form and are not passed on to third parties. Your Linkbroker password is never transmitted to the connected assistant.

In addition, we log each call made via the interface in order to operate the service securely, to detect misuse, and to be able to trace actions taken in your account. This log contains the endpoint and tool used, your user ID and email address, the parameters transmitted with the call, whether the call resulted in an error together with the error message, and the duration of the call. These logs are stored for 90 days and are then deleted. The legal basis is our legitimate interest in the secure operation and traceability of the interface (Art. 6 (1) sentence 1 lit. f GDPR).

How long the provider chosen by you stores the data exchanged via the interface depends on its terms and on your settings there; we have no influence on this. Anthropic points out that the data exchanged via the MCP interface, including the results of the tool calls, is stored in accordance with its standard retention period and that an agreement on non-storage (Zero Data Retention) is not available for this feature. With OpenAI, corresponding calls are logged for 30 days by default, unless non-storage has been agreed for your organization. Please therefore review the data protection terms of your provider before establishing the connection. The legal basis is the performance of the user agreement with regard to the feature actively requested by you (Art. 6 (1) sentence 1 lit. b GDPR).

In addition, we use anonymized and aggregated usage data, without personal reference and without assignment to individual customers, to improve our services including our AI features (Art. 6 (1) sentence 1 lit. f GDPR; the anonymization itself takes place on the same basis). We do not use content from your conversations and uploaded documents to train AI models. Data obtained via the Google Search Console is used exclusively within the scope of Limited Use requirements (see Section 20) and not to train generalized AI models.

Processed Data Types: Content data (including documents you upload and their AI Memory), contract data, usage data, payment data (where retrieved via the MCP interface), access data (interface keys and tokens), and log data of interface calls. Data Subjects: Customers, users. Purposes of Processing: Performance of contractual services (AI features actively used by you), improvement of our services. Legal Bases: Contract performance (Art. 6 (1) sentence 1 lit. b GDPR); for improving our services based on anonymized usage data, legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

10. Use of Cookies and Consent Management

Cookies are small text files or other storage notices that store information on terminal devices and read information from terminal devices, for example to store login status, shopping cart contents, or used features of an online offer.

Notes on Consent: We use cookies in compliance with legal regulations. Non-essential cookies and comparable technologies are only set with your prior consent (Section 25 (1) TDDDG, Art. 6 (1) sentence 1 lit. a GDPR), which you grant via our consent banner. Strictly necessary cookies, such as login, shopping cart, and consent status cookies, as well as security and load-balancing cookies, are set on the basis of Section 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) sentence 1 lit. b or lit. f GDPR. In our consent banner, cookies and comparable technologies are divided into the categories “Necessary”, “Preferences”, “Statistics”, and “Marketing”; you can make your selection per category and change it at any time. A complete, automatically updated list of all cookies used with provider, purpose, and storage duration can be found in the cookie declaration within the banner.

Storage Duration: Temporary cookies (session cookies) are deleted at the latest after you leave our online offer and close your terminal device. Permanent cookies remain stored even after closing the terminal device; the specific storage duration per cookie can be found in the cookie declaration in the banner.

Revocation and Objection (Opt-out): You can revoke granted consents at any time via the cookie settings and also lodge an objection pursuant to Art. 21 GDPR. You can also disable cookies in your browser settings, although this may limit the functionality of our online offer.

Cookiebot (Consent Management): To obtain, log, manage, and revoke consent, we use Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Processed are your IP address in shortened form (the last three digits set to zero), date and time of consent, browser information, requested URL, and an anonymous random key; your consent status is stored in the cookie “CookieConsent” (storage duration: twelve months). Legal bases are Section 25 (2) No. 2 TDDDG (the consent cookie is strictly necessary) and Art. 6 (1) sentence 1 lit. c GDPR in conjunction with Art. 7 (1) GDPR (proof of consent). A data processing agreement exists with Usercentrics. Further information: https://www.cookiebot.com/en/privacy-policy/.

Google Consent Mode v2: We transmit your decision made in the banner as consent status to Google; Google services align their behavior accordingly. Without your consent, no advertising or statistics cookies are set and no data is processed for advertising purposes.

11. Provision of the Online Offer and Web Hosting

We process user data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to deliver contents and functions of our online services to the user's browser or terminal device.

Webflow (Website Hosting): Our website (linkbroker.de, linkbroker.io) is hosted by Webflow. Webflow processes on our behalf the data generated when the site is accessed, in particular the IP address, and delivers the content via a content delivery network; service provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. A data processing agreement exists with Webflow (https://webflow.com/legal/dpa); Webflow is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally. Further information: https://webflow.com/legal/privacy.

DigitalOcean (Platform Hosting): Our platform (app.linkbroker.de) and its application programming interface are operated on the App Platform of DigitalOcean; service provider is DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA. Processing takes place in a data center in Frankfurt am Main. A data processing agreement exists with DigitalOcean (https://www.digitalocean.com/legal/data-processing-agreement); DigitalOcean is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally. Further information: https://www.digitalocean.com/legal/privacy-policy.

Vercel (Hosting of the Visibility Check): Our free visibility check (check.linkbroker.de) is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. If you enter a domain and your email address there, we process this information to generate the report and send it to you by email (Art. 6 (1) sentence 1 lit. b GDPR); any subsequent promotional communication is governed by Sections 16 and 17. A data processing agreement exists with Vercel (https://vercel.com/legal/dpa); Vercel is certified under the EU-US Data Privacy Framework, and standard contractual clauses are agreed additionally. Further information: https://vercel.com/legal/privacy-notice.

Content Delivery Network jsDelivr: To deliver a program library that displays sliders and image galleries on our website, we call the content delivery network jsDelivr. When it is retrieved, the user's IP address is transmitted to its servers. Legal basis is our legitimate interest in the secure and efficient provision of our website (Art. 6 (1) sentence 1 lit. f GDPR). Further information: https://www.jsdelivr.com.

Hetzner: Individual internal systems, e.g. for automation and internal evaluation, are operated on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Processing takes place in data centers within the European Union; a data processing agreement exists with Hetzner. Legal basis is our legitimate interest in a secure and efficient operation of our systems (Art. 6 (1) sentence 1 lit. f GDPR). Further information: https://www.hetzner.com/legal/privacy-policy.

Collection of Access Data and Log Files: Access to our online offer is logged in the form of server log files. The log files may include the address and name of retrieved pages and files, date and time of retrieval, transferred data volumes, browser type and version, operating system, referrer URL, IP address, and requesting provider. Log files serve security purposes, such as defending against DDoS attacks, and ensuring server load and stability. Log file information is stored for a maximum of 30 days and then deleted or anonymized; data whose further retention is required for evidentiary purposes is excluded from deletion until final clarification of the respective incident.

Blog and Articles: On our website, we operate a blog with articles, guides, and news. Readers' data is processed only to the extent necessary to present the content and for security reasons; otherwise, the details of this privacy policy apply, in particular regarding web analytics and online marketing.

Processed Data Types: Usage data, contact data (visibility check), as well as meta, communication, and procedural data. Data Subjects: Users. Purposes of Processing: Provision of our online offer and user-friendliness, IT infrastructure, security measures, provision of the visibility check. Legal Bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR); for the visibility check, contract performance (Art. 6 (1) sentence 1 lit. b GDPR).

12. Registration and Customer Account

A customer account is required to use our platform (app.linkbroker.de). During registration and use, we process mandatory details and further account contents to provide the customer account and execute the contractual relationship. This includes your email address, password (exclusively in encrypted form), company and billing details, your projects and orders, credit and transaction data, as well as security-related log data such as IP address and login timestamp.

Supabase (Database and User Management): To provide the database, authentication, and storage infrastructure of our platform, we use Supabase, a service of Supabase, Inc. (USA). Data is stored in a data center within the European Union (AWS, Frankfurt region). A data processing agreement exists with Supabase (https://supabase.com/legal/dpa); for potential support access from the US, standard contractual clauses are agreed as a safeguard pursuant to Art. 46 (2) lit. c GDPR. Further information: https://supabase.com/privacy.

We store your account data for the duration of the contractual relationship; after deletion of the account, it will be removed subject to statutory retention obligations.

Mailgun (System Emails): To send system emails of our platform, such as order confirmations, invoices, team invitations, and notifications, we use Mailgun, a service of Mailgun Technologies, Inc. (Sinch), 112 E Pecan St. #1135, San Antonio, TX 78205, USA. Processed are your email address, name, and the content of the respective message. Legal basis is contract performance (Art. 6 (1) sentence 1 lit. b GDPR). A data processing agreement exists with Mailgun; transfer to the US is safeguarded by Mailgun's certification under the EU-US Data Privacy Framework and standard contractual clauses. Further information: https://www.mailgun.com/legal/privacy-policy/.

Processed Data Types: Inventory data, access data, contract data, as well as meta and security data. Data Subjects: Customers, users. Purposes of Processing: Performance of contractual services and customer service, security measures. Legal Bases: Contract performance (Art. 6 (1) sentence 1 lit. b GDPR); for security logs, legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

13. Commercial Services

We process data of our contractual and business partners, such as customers and prospects as well as publishers and authors (collectively referred to as “contractual partners”), within contractual and comparable legal relationships and related measures as well as within communication with contractual partners, for example to answer inquiries.

We process this data to fulfill our contractual obligations, in particular the brokerage and handling of content, link building, and digital PR services, to safeguard our rights, and for administrative tasks and corporate organization associated with these duties. Within the framework of applicable law, we only disclose data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations, such as transferring order-related details to publishers for order execution, or involving banks, tax and legal advisors, payment service providers, or tax authorities.

We delete data after expiration of statutory warranty and comparable obligations, generally after four years, unless the data is stored in a customer account or must be kept for legal archiving reasons; commercial books, inventories, and annual financial statements are kept for ten years, accounting records for eight years, and received and sent commercial letters for six years.

Economic Analyses: For business reasons and to recognize market trends and customer requirements, we analyze data available to us regarding business transactions, contracts, and orders, for example to evaluate revenue, product usage, and customer segments. Analyses serve internal purposes exclusively and are not disclosed externally unless they are anonymized, aggregated values; where possible, we conduct analyses pseudonymously or anonymously. Legal basis is our legitimate interest in business analysis and development of our offer (Art. 6 (1) sentence 1 lit. f GDPR).

Asana (Task and Order Management): For internal organization and processing of orders, we use Asana, a service of Asana, Inc., 633 Folsom Street, San Francisco, CA 94107, USA. Order-related data such as order details, domains, and contacts are processed. Legal basis is our legitimate interest in efficient order processing (Art. 6 (1) sentence 1 lit. f GDPR). A data processing agreement exists with Asana; Asana is certified under the EU-US Data Privacy Framework, and standard contractual clauses are agreed additionally. Further information: https://asana.com/terms#privacy-policy.

HubSpot (CRM): For customer relationship management and sales, we use HubSpot, a service of HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA. Contact and company data as well as communication history are processed. Legal basis is our legitimate interest in efficient customer management (Art. 6 (1) sentence 1 lit. f GDPR). A data processing agreement exists with HubSpot (https://legal.hubspot.com/dpa); HubSpot is certified under the EU-US Data Privacy Framework, and standard contractual clauses are agreed additionally. Further information: https://legal.hubspot.com/privacy-policy.

Google Meet (Video Conferences): We conduct consultation and analysis calls via Google Meet provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as part of our Google Workspace agreement including data processing. Your login data to the meeting, audio and video data during the conversation, and meeting metadata are processed. Legal basis is contract performance or taking pre-contractual steps (Art. 6 (1) sentence 1 lit. b GDPR). Further information: https://policies.google.com/privacy.

Fireflies (Recording and Transcription of Video Conferences): Provided participants have consented at the beginning of the call, we record video conferences and have them automatically transcribed and summarized to document meeting results and agreed tasks. The recording assistant is visible to all participants during the meeting. Service provider is Fireflies AI, Inc. (USA). Audio and video recordings, transcripts, names, and email addresses of participants, as well as meeting metadata, are processed. Legal basis is your consent (Art. 6 (1) sentence 1 lit. a GDPR); participation in the call is also possible without recording. Recordings and transcripts are deleted once the documentation purpose ceases, at the latest after twelve months. A data processing agreement exists with Fireflies; transfer to the US is safeguarded by standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR. Further information: https://fireflies.ai/privacy.

Processed Data Types: Inventory data, payment data, contact data, contract data, content data. Data Subjects: Customers, prospects, business and contractual partners (in particular publishers and authors). Purposes of Processing: Performance of contractual services and customer service, contact requests and communication, office and organizational procedures, management and response to inquiries. Legal Bases: Performance of a contract and prior inquiries (Art. 6 (1) sentence 1 lit. b GDPR), legal obligation (Art. 6 (1) sentence 1 lit. c GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR), consent (Art. 6 (1) sentence 1 lit. a GDPR) for meeting recordings.

14. Payment Procedures

In the context of contractual and other legal relationships, due to legal obligations, or on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and utilize bank institutions as well as payment service providers for this purpose.

The data processed by payment service providers includes inventory data such as name and address, payment data such as card numbers and bank accounts, as well as contract- and recipient-related information. The details are necessary to complete transactions. The payment data you enter is processed directly by the payment service providers; we do not receive complete card or account data, but only confirmation or rejection of the payment. This also applies to actions initiated via a connected AI assistant: payments are always completed in the Linkbroker interface or at the payment service provider, never through the assistant (see Section 9).

Payment processing on our platform is handled via Stripe as well as PayPal; available payment methods, such as credit card, Klarna, Apple Pay, Google Pay, Link, invoice purchase via bank transfer, and PayPal, are displayed during checkout.

Stripe: For payment processing, we use Stripe, offered by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Insofar as Stripe processes data for fraud prevention (Stripe Radar) or to fulfill its own legal obligations, Stripe acts as an independent controller; otherwise, Stripe processes data on our behalf based on a data processing agreement that is part of the Stripe Services Agreement. Cookies set by Stripe, such as “__stripe_mid”, serve fraud prevention and are strictly necessary for secure payment processing (Section 25 (2) No. 2 TDDDG). Data transfer to Stripe, Inc. (USA) is possible; Stripe is certified under the EU-US Data Privacy Framework, and standard contractual clauses are agreed additionally. Via Stripe, we offer various payment methods, including credit card, Klarna, Apple Pay, Google Pay, Link payment feature, and invoice purchase via bank transfer. If you choose one of these payment methods, the respective provider also processes your payment data under its own responsibility: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, which may also perform identity and credit checks for processing (https://www.klarna.com/international/privacy-policy/), Apple Distribution International Ltd., Ireland (https://www.apple.com/legal/privacy/), or Google Ireland Limited (https://policies.google.com/privacy). Further information: https://stripe.com/privacy.

PayPal: In addition, we offer payment via PayPal, a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When paying via PayPal, your payment data is processed directly by PayPal under its own responsibility; we do not receive complete payment data here either, but only payment confirmation or rejection. Legal basis is contract performance (Art. 6 (1) sentence 1 lit. b GDPR). PayPal's privacy notice applies additionally: https://www.paypal.com/webapps/mpp/ua/privacy-full.

Processed Data Types: Inventory data, payment data, contract data, as well as meta, communication, and procedural data. Data Subjects: Customers. Purposes of Processing: Payment processing, performance of contractual services, fraud prevention. Legal Bases: Contract performance (Art. 6 (1) sentence 1 lit. b GDPR), legal obligation (Art. 6 (1) sentence 1 lit. c GDPR in conjunction with Section 147 AO and Section 257 HGB), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

15. Contact and Inquiry Management

When contacting us, e.g. via email, contact form, telephone, or social media, as well as within existing user and business relationships, details of inquiring persons are processed to the extent necessary to respond to contact requests and requested measures.

Intercom (Support Chat): On our website and in our platform, we offer a support chat powered by Intercom. The messenger is loaded only when you actively open it or consent via cookie settings. Processed are chat messages, name, email address, customer account details, and technical data such as IP address, browser information, and cookie identifiers (e.g., “intercom-id-*” and “intercom-session-*”). Service provider is Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18–21 St. Stephen's Green, Dublin 2, Ireland (parent company: Intercom, Inc., San Francisco, USA). Legal bases are your consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG) or Section 25 (2) No. 2 TDDDG upon active activation, as well as contract performance when processing support inquiries (Art. 6 (1) sentence 1 lit. b GDPR). A data processing agreement exists with Intercom; transfer to the US is possible, Intercom is certified under the EU-US Data Privacy Framework, and standard contractual clauses are agreed additionally. Further information: https://www.intercom.com/legal/privacy.

Google Workspace (Email Communication): For business email communication, e.g. via support@linkbroker.de, we use Google Workspace provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When contacting us via email, your email address as well as content and metadata of your message are processed on Google servers. Furthermore, we use Google Workspace as a cloud service for office and administrative purposes, such as document storage and calendar management; personal data may be processed insofar as it is part of communication or business operations with us. Legal basis is contract performance (Art. 6 (1) sentence 1 lit. b GDPR) if your request relates to entering into or executing a contract, otherwise our legitimate interest in efficient communication and management (Art. 6 (1) sentence 1 lit. f GDPR). A data processing agreement exists with Google (Cloud Data Processing Addendum); transfer to the US is possible, Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally.

Processed Data Types: Contact data, content data, usage data, as well as meta, communication, and procedural data. Data Subjects: Communication partners. Purposes of Processing: Contact requests and communication, management and response to inquiries. Legal Bases: Performance of a contract and prior inquiries (Art. 6 (1) sentence 1 lit. b GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR), consent (Art. 6 (1) sentence 1 lit. a GDPR).

16. Newsletter and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter “newsletters”) only with recipient consent or based on legal permission. Our newsletters contain information about our services, products, promotions, and about us.

Product Updates to Existing Customers: Customers whose email address we received in connection with registration or purchase of our services will be informed by email about our own similar services and product updates (Section 7 (3) UWG, Art. 6 (1) sentence 1 lit. f GDPR). You can object at any time without incurring costs other than transmission costs according to basic tariffs, via the unsubscribe link in each email or by message to support@linkbroker.de; we point this out upon email collection and in every email.

Double Opt-in Registration: Insofar as you actively subscribe to a newsletter, registration takes place via a double opt-in process: After registering, you will receive an email asking you to confirm your registration. Registrations are logged (timestamp of registration and confirmation as well as IP address) to be able to prove the registration process according to legal requirements.

Measurement of Open and Click Rates: Provided your consent covers this, our newsletters contain a so-called web beacon, retrieved from our email provider's server when the newsletter is opened. Technical information such as browser, system, IP address, and retrieval time is collected, as well as whether and when the newsletter is opened and which links are clicked. We use this evaluation to adapt content to recipient interests.

Erasure and Restriction of Processing: Unsubscribed email addresses may be stored for up to three years based on our legitimate interests to prove previously granted consent; processing is restricted to potential defense against claims. For permanent compliance with objections, we reserve the right to store email addresses in a suppression list.

Klaviyo (Newsletter Dispatch): For dispatch, we use Klaviyo, a service of Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Processed are email address, name, registration data, open and click data, and synchronized customer profile data. Data is processed on servers in the US; Klaviyo is certified under the EU-US Data Privacy Framework, standard contractual clauses are agreed additionally, and a data processing agreement exists (https://www.klaviyo.com/legal/data-processing-agreement). Further information: https://www.klaviyo.com/legal/privacy-notice.

Processed Data Types: Inventory data, contact data, usage data, as well as meta, communication, and procedural data. Data Subjects: Communication partners, newsletter recipients. Purposes of Processing: Direct marketing, performance measurement. Legal Bases: Consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 7 (2) UWG); for direct marketing to existing customers, legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR in conjunction with Section 7 (3) UWG); for proof, legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR in conjunction with Art. 7 (1) GDPR). Opt-out Option: You can unsubscribe at any time via the link at the end of each newsletter or by email to support@linkbroker.de.

17. Promotional Communication via Email, Mail, or Telephone

We process personal data for promotional communication purposes, which may occur via various channels such as email, telephone, or mail in accordance with legal requirements. Recipients have the right to revoke granted consent at any time or object to promotional communication at any time.

After revocation or objection, we store data required to prove former authorization for up to three years after the end of the year of revocation or objection based on our legitimate interests; processing is restricted to potential defense against claims. For permanent compliance with objections, we also store data necessary to avoid re-contacting, such as email address, phone number, and name.

Processed Data Types: Inventory data, contact data. Data Subjects: Communication partners, prospects. Purposes of Processing: Direct marketing. Legal Bases: Consent (Art. 6 (1) sentence 1 lit. a GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

18. Web Analytics, Monitoring, and Optimization

Web analytics (also referred to as reach measurement) serves to evaluate visitor traffic to our online offer and platform usage. With analytics, we can recognize which features and content are most frequently used and which areas require optimization. Additionally, we use monitoring procedures to detect technical errors and ensure system stability.

Unless specified otherwise below, pseudonymous profiles are created for these purposes, and information is stored and read in browsers or terminal devices. Analysis profiles do not contain plain-text data such as email addresses or names, but pseudonyms. IP addresses are not stored permanently or are processed in shortened form (IP masking).

PostHog (Product and Web Analytics): On our website and in our platform, we use the analytics service PostHog with your consent, a service of PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA. We use PostHog Cloud EU; all analytics data is processed and stored on servers in Frankfurt am Main. Processed are visited pages, clicks and interactions, referrer and campaign parameters, technical details on browser, operating system, and device, approximate location (derived from IP address, which itself is not stored permanently), and usage times. For logged-in users of our platform, we link this data with a pseudonymous customer ID to evaluate feature usage.

Provided you have consented, we also record individual sessions in masked form (session recording): mouse movements, scroll and click behavior, and a representation of displayed pages are captured. Input fields are masked. Session recordings are deleted after 90 days, event data at the latest after 24 months.

Legal basis is your consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG), granted via our consent banner in the “Statistics” category and revokable at any time via cookie settings. Without your consent, we collect only aggregated, cookieless reach data: Nothing is stored or read on your terminal device; to differentiate page views, a daily changing, non-recomputable hash value is formed server-side (Art. 6 (1) sentence 1 lit. f GDPR).

Data is transmitted directly to PostHog Cloud EU in Frankfurt. A data processing agreement exists with PostHog. Insofar as access from the US cannot be ruled out in individual cases, e.g. during support, this is safeguarded by DPF certification of PostHog, Inc. and standard contractual clauses. Further information: https://posthog.com/privacy.

Google Analytics 4: On our website, we use Google Analytics 4 with your consent, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies (including “_ga”, storage duration up to two years) to analyze website usage, such as visited pages, dwell time, visitor origin, and device data. IP addresses are not stored in Google Analytics 4; evaluation occurs based on shortened IP addresses. Legal basis is your consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG), revokable at any time via cookie settings; service behavior also adapts according to consent status transmitted via Consent Mode. A data processing agreement exists with Google (Google Ads Data Processing Terms). Data may be transferred to Google LLC (USA); Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally. User-related data stored in Google Analytics is deleted after 14 months at the latest. Further information: https://policies.google.com/privacy; Browser Opt-out: https://tools.google.com/dlpage/gaoptout.

Sentry (Error Analysis): In our platform, we use Sentry, a service of Functional Software, Inc. (dba Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Sentry collects technical error reports such as error messages, browser and device data, timestamp of error, and shortened IP address, so that we can detect malfunctions and ensure application stability and security. Legal basis is our legitimate interest in error-free and secure operation (Art. 6 (1) sentence 1 lit. f GDPR; reading information on your device for this purpose is strictly necessary for secure operation, Section 25 (2) No. 2 TDDDG). Provided you have consented, we also use Sentry Session Replay, which records a small portion of sessions in masked form to trace error situations; legal basis is your consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG), revokable at any time via cookie settings. Data is deleted after 90 days. A data processing agreement exists with Sentry (https://sentry.io/legal/dpa/); Sentry is certified under the EU-US Data Privacy Framework, and standard contractual clauses are agreed additionally. Further information: https://sentry.io/privacy/.

Processed Data Types: Usage data as well as meta, communication, and procedural data. Data Subjects: Users. Purposes of Processing: Reach measurement, product improvement, error analysis, security measures. Security Measures: IP masking, client-side masking in session recordings. Legal Bases: Consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG); for cookieless aggregated measurement and error analysis, legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

19. Online Marketing

We process personal data for online marketing purposes, which includes displaying promotional content based on potential user interests and measuring its effectiveness (conversion measurement). For these purposes, pseudonymous user profiles are created and stored in cookies or similar procedures; viewed content, visited websites, technical specifications on browser and system, and usage times may be included. We generally receive access only to summarized information on the success of our ads; within conversion measurements, we check which marketing measures led to a conversion, such as registration or order.

All services described in this section are used exclusively with your consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG), granted via our consent banner in the “Marketing” category and revokable at any time via cookie settings. Additional opt-out options can be found at https://www.youronlinechoices.eu and https://optout.aboutads.info.

Google Tag Manager: To manage website tags, we use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself does not set marketing cookies; when it loads, your IP address is transmitted to Google servers. We operate it with Google Consent Mode: until you give your consent, all statistics and marketing tags remain blocked and no cookies are set for these purposes. Google LLC (USA) is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally. Further information: https://policies.google.com/privacy.

Google Ads (Conversion Tracking and Remarketing): We use Google Ads of Google Ireland Limited to measure ad success and display interest-based advertising. Cookies such as “_gcl_au” and “_gcl_aw” (storage duration 90 days each) and “IDE” (up to 13 months) are set. Data may be transferred to Google LLC (USA); Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally. Further information: https://policies.google.com/privacy; Ad Settings: https://adssettings.google.com.

OpenAI Ads Pixel: We use the measurement pixel of OpenAI (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland) to measure the success of our advertisements in ChatGPT, for example whether a registration follows a click. Event data such as visited pages, form submissions, IP address, and browser information are transmitted to OpenAI. Data may be transferred to OpenAI, L.L.C. (USA); OpenAI is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally. Further information: https://openai.com/policies/privacy-policy.

Meta Pixel (Facebook/Instagram): We use Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), for conversion measurement, target group creation (Custom Audiences), and remarketing. Event data such as visited pages, conversions, IP address, and browser information are collected and transmitted to Meta; cookies “_fbp” and “_fbc” (storage duration 90 days each) are set. For collecting and transmitting this data, we are jointly responsible with Meta (Art. 26 GDPR); key elements of the agreement are in the Controller Addendum at https://www.facebook.com/legal/controller_addendum. For subsequent processing, Meta is solely responsible; you can exercise data subject rights directly with Meta. Data may be transferred to Meta Platforms, Inc. (USA); Meta is certified under the EU-US Data Privacy Framework, and standard contractual clauses exist. Further information: https://www.facebook.com/privacy/policy/.

TikTok Pixel: We use TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, to measure conversions and build target groups. Cookies “_ttp” and “_tt_enable_cookie” (storage duration 13 months each) are set. For measurement purposes, partial joint responsibility exists (Art. 26 GDPR); details are governed by TikTok Joint Controller Terms at https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms. Notice on Third-Country Transfer: Personal data may be transferred to countries outside the EEA, in particular the US, Singapore, and, including via remote access, the People's Republic of China, for which no adequacy decision of the EU Commission exists. TikTok bases these transfers on standard contractual clauses plus supplementary measures; there is a risk that public authorities access data without effective legal remedies available to you. Your consent explicitly includes this transfer pursuant to Art. 49 (1) lit. a GDPR. Further information: https://www.tiktok.com/legal/privacy-policy.

LinkedIn Insight Tag: We use Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, for conversion measurement, retargeting, and aggregated reports on website visitors, e.g. by industry or job title. Cookies including “li_fat_id” and “UserMatchHistory” (storage duration 30 days each) are set. For collection and transmission, joint responsibility exists with LinkedIn (Art. 26 GDPR); otherwise LinkedIn processes data as independent controller. Data may be transferred to LinkedIn Corporation (USA); LinkedIn is certified under the EU-US Data Privacy Framework. LinkedIn members can object to usage in LinkedIn settings (https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out). Further information: https://www.linkedin.com/legal/privacy-policy.

Processed Data Types: Usage data as well as meta, communication, and procedural data. Data Subjects: Users. Purposes of Processing: Marketing, conversion measurement, remarketing, target group formation, profiles with user-related information (possibly cross-device by providers if logged in). Legal Bases: Consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG).

20. Google Search Console Integration

In our platform, you can optionally connect your Google Search Console account to your Linkbroker account. You actively establish the connection yourself by authenticating via the Google sign-in dialog (OAuth 2.0) and granting us read-only access to your Search Console data.

Processed Data: When connected, we fetch and store the following data of your connected website properties via the Google Search Console API: search queries, clicks, impressions, click-through rate, average position, page URLs, and associated dimensions such as date, country, and device type. To manage the connection, we also store the email address of your Google account, the list of shared properties, and access tokens issued by Google; tokens are stored exclusively encrypted and are not shared with third parties.

Purpose and Legal Basis: Processing serves to display and evaluate search performance of your websites within our platform. Legal basis is performance of the user contract for the feature actively requested by you (Art. 6 (1) sentence 1 lit. b GDPR); if you connect as an employee of a customer organization, additionally our legitimate interest in providing the feature to our customer (Art. 6 (1) sentence 1 lit. f GDPR). Insofar as we process Search Console data on your behalf, this occurs as data processing pursuant to Art. 28 GDPR.

Recipients and Third-Country Transfer: Data is retrieved from servers of Google LLC (USA); Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses exist (https://policies.google.com/privacy/frameworks).

Storage Duration and Disconnection: You can disconnect the connection at any time in platform settings or revoke access at https://myaccount.google.com/permissions. Upon disconnection, we immediately revoke access tokens with Google and delete them; retrieved raw data is deleted within 30 days, in backups at the latest after 90 days. We retain exclusively aggregated, anonymized metrics without personal reference and without association to your account or search queries; these are used solely to provide and improve platform features.

Limited Use Declaration: Linkbroker's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy including Limited Use requirements: We use this data exclusively to provide and improve visible platform features, do not transfer or sell it to third parties, and do not use it for advertising or creditworthiness checks. Human access occurs only with your consent, for security reasons, to comply with legal obligations, or on aggregated, anonymized data for internal operational purposes.

21. Customer Reviews and Rating Procedures

We participate in review and rating procedures to evaluate, optimize, and promote our services. When users rate us via participating rating platforms, terms of use and privacy notices of respective providers apply additionally.

Trustpilot: We maintain a company profile on the Trustpilot review platform of Trustpilot A/S, Pilestræde 58, 5th Floor, 1112 Copenhagen, Denmark, and display their review widget on our website. The widget loads only after consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG). Legal basis otherwise is our legitimate interest in evaluating and displaying customer reviews (Art. 6 (1) sentence 1 lit. f GDPR). Further information: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms.

ProvenExpert: We also maintain a rating profile on ProvenExpert platform of Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany. Reviews are submitted under users' own responsibility to the platform; we do not send active review invitations. Legal basis for evaluating and displaying reviews is our legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR). Further information: https://www.provenexpert.com/en-gb/privacy-policy/.

Processed Data Types: Contract data, usage data, as well as meta, communication, and procedural data. Data Subjects: Customers, users. Purposes of Processing: Feedback, marketing. Legal Bases: Consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG) for loading the widget, otherwise legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

22. Presence in Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context to communicate with active users there or offer information about us.

We point out that user data may be processed outside the European Union. Furthermore, user data within social networks is usually processed for market research and advertising purposes; for detailed presentation of respective processing forms and opt-out options, we refer to providers' privacy policies. Access requests and data subject rights can be asserted most effectively directly with providers; should you require assistance, you may contact us.

Instagram: Social network; service provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy Policy: https://privacycenter.instagram.com/policy/.

Facebook Pages: We are jointly responsible with Meta Platforms Ireland Limited for collection, but not further processing, of data from visitors to our Facebook page. This data includes information on types of content users view or interact with, as well as device info. Meta provides us with anonymized statistics (“Page Insights”). We have entered into a joint controller agreement with Meta (“Page Insights Controller Addendum”, https://www.facebook.com/legal/terms/information_about_page_insights_data) in which Meta agrees to fulfill data subject rights; you can address access or deletion requests directly to Meta. Meta Platforms, Inc. (USA) is certified under the EU-US Data Privacy Framework, and standard contractual clauses exist. Privacy Policy: https://www.facebook.com/privacy/policy/.

LinkedIn (Company Page): For statistics of our company page (“Page Insights”), joint responsibility exists under Page Insights Joint Controller Addendum (https://legal.linkedin.com/pages-joint-controller-addendum). Service provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; LinkedIn Corporation (USA) is certified under the EU-US Data Privacy Framework. Privacy Policy: https://www.linkedin.com/legal/privacy-policy.

X (formerly Twitter): Social network; service provider is X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Privacy Policy: https://x.com/en/privacy.

TikTok (Company Profile): Social network; service provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Data may be transferred to the US, Singapore, and People's Republic of China (see Section 19, TikTok Pixel). Privacy Policy: https://www.tiktok.com/legal/privacy-policy.

YouTube (Channel): Video platform; service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy Policy: https://policies.google.com/privacy.

Processed Data Types: Contact data, content data, usage data, as well as meta, communication, and procedural data. Data Subjects: Users. Purposes of Processing: Contact requests and communication, feedback, marketing. Legal Bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

23. Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offer obtained from servers of respective providers (hereinafter “third-party providers”), such as videos. Integration requires third-party providers to process user IP addresses, as they could not send content to browsers without IP addresses. We host our fonts locally; no connections to third-party providers are established when loading pages for this purpose.

YouTube Videos: On our website and platform, we embed videos, e.g. explanatory and tutorial videos. Embedded videos load only after consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG). Service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy Policy: https://policies.google.com/privacy; Opt-out: https://adssettings.google.com.

Google reCAPTCHA: To protect our platform against abuse by automated access (“bots”), in particular against automated harvesting of our marketplace catalogue, we use Google reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is used only where this is necessary for the secure provision of the function you have explicitly requested; currently, the check is displayed exclusively when browsing the marketplace search results if an unusually high number of result pages is accessed in succession. reCAPTCHA analyzes user behavior, such as mouse movements, dwell time, IP address, and device information, to distinguish between humans and automated access. Legal basis is our legitimate interest in protecting our online offer against abuse, spam, and automated attacks (Art. 6 (1) sentence 1 lit. f GDPR); storing and reading information on terminal devices required for this is strictly necessary to ensure security (Section 25 (2) No. 2 TDDDG). Data may be transferred to Google LLC (USA); Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply additionally. Further information: https://policies.google.com/privacy and https://www.google.com/recaptcha/about/.

Processed Data Types: Usage data as well as meta, communication, and procedural data. Data Subjects: Users. Purposes of Processing: Provision of our online offer and user-friendliness, security measures. Legal Bases: Consent (Art. 6 (1) sentence 1 lit. a GDPR in conjunction with Section 25 (1) TDDDG) for integrations requiring consent, otherwise legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

24. Application Process

We process applications to conduct the application process. Details from application documents are processed, such as contact info, qualifications, CV, certificates, and communication during the process. If applicants voluntarily disclose special categories of personal data, such as severe disability details, we process these pursuant to Art. 9 (2) lit. b GDPR so we and applicants can exercise rights and fulfill duties arising from labor and social security law. Application documents are deleted at the latest six months after completion of the process, unless hiring occurs or you consented to longer retention for future positions.

Personio (Applicant Management): We receive applications via our career portal, which is provided by Personio (Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany). Personio processes your application data on our behalf on servers in the EU; a data processing agreement exists with Personio. Further information: https://www.personio.com/privacy-policy/.

Processed Data Types: Applicant data, contact data, content data. Data Subjects: Applicants. Purposes of Processing: Execution of application process, establishment of employment relationship. Legal Bases: Section 26 BDSG, performance of a contract and prior inquiries (Art. 6 (1) sentence 1 lit. b GDPR).

25. Changes and Updates to the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to data processing carried out by us make it necessary. We will inform you as soon as changes require your cooperation action, such as consent, or other individual notification. Insofar as addresses and contact info of companies and organizations are provided in this privacy policy, please note that addresses may change over time and check details prior to contacting.