Privacy Policy
Last updated: August 20th, 2026
Name and Address of the Controller
The controller is the entity that, alone or jointly with others, determines the purposes and means of the processing of personal data. The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States, as well as other data protection provisions, is:
Tatajuba Solutions GmbH
Represented by: Stefan Hauser
Strascheg Center for Entrepreneurship
Heßstr. 89 | 80797 Munich | Germany
Tel.: +49 162 777 5238 | Email: info@simply-solve.com | Website: www.simply-solve.com
Contact Details of the Data Protection Officer
We have appointed an external Data Protection Officer:
BerIsDa GmbH | Website: www.berisda.de
You can contact the Data Protection Officer by post at Tatajuba Solutions GmbH, for the attention of the Data Protection Officer, Heßstr. 89, 80797 Munich, Germany, or by email at datenschutz@berisda.de.
Table of Contents
I. GENERAL INFORMATION ON DATA PROCESSING
II. RIGHTS OF THE DATA SUBJECT
III. SSL/TLS ENCRYPTION
IV. EXTERNAL HOSTING
V. PROVISION OF THE WEBSITE AND CREATION OF LOG FILES
VI. USE OF COOKIES
VII. COOKIE CONSENT VIA USERCENTRICS
VIII. CONTACT BY EMAIL AND/OR TELEPHONE
IX. CONTACT FORM
X. NEWSLETTER: REGISTRATION AND DISTRIBUTION
XI. MARKETING INITIATIVES BY EMAIL WITH ADVERTISING CONSENT (DIRECT MARKETING) – SECTION 7(2) NO. 2 OF THE GERMAN ACT AGAINST UNFAIR COMPETITION (‘UWG’)
XII. AWS CLOUDFRONT (CONTENT DELIVERY NETWORK)
XIII. HUBSPOT (CRM, CONTENT DELIVERY NETWORK AND TRACKING)
I. General Information on Data Processing
1. Scope of the Processing of Personal Data
As a general rule, the controller only collects and uses the personal data of its users (hereinafter also referred to as the ‘data subject’ or ‘visitor’) to the extent necessary to provide a functioning website and to present its content and services. The collection and processing of users’ personal data for other purposes generally takes place only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons, where the processing is carried out on the basis of pre-contractual or contractual measures, where the processing of the data is permitted by law, and/or where the controller has a legitimate interest in the processing.
2. Legal Basis for the Processing of Personal Data
Where the controller obtains the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (‘GDPR’) serves as the legal basis for the processing of personal data. Where special categories of data within the meaning of Article 9(1) GDPR are processed, Article 9(2)(a) GDPR serves as the legal basis. For any transfer to a non-secure third country carried out on the basis of consent, the processing is based on Article 49(1)(a) GDPR. Where you have consented to the storage of cookies, or to access to information stored on your terminal equipment, the data processing additionally takes place on the basis of Section 25(1) of the German Telecommunications-Digital Services-Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – ‘TDDDG’).
Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures. Where the individual concerned is the contact person of a (prospective) business partner (customer, supplier or partner), the legal basis for such (pre-)contractual measures is Article 6(1)(f) GDPR.
Where the processing of personal data is necessary for compliance with a legal obligation to which the controller is subject, Article 6(1)(c) GDPR serves as the legal basis.
Where the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Article 6(1)(d) GDPR serves as the legal basis.
Where the processing is necessary to safeguard a legitimate interest of the controller or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Article 6(1)(f) GDPR serves as the legal basis for the processing.
3. Erasure of Data and Duration of Processing
Where this privacy policy does not specify a precise storage period, the personal data of our website visitors remains with us until the purpose of the data processing no longer applies. The personal data of the data subject is erased or restricted as soon as the purpose of the storage no longer applies, or once consent given by the data subject is withdrawn, or once the processing is objected to. Storage may also continue where this is provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. The data is likewise restricted or erased once a storage period prescribed by the aforementioned provisions expires, unless there is a need for continued storage of the data for the conclusion or performance of a contract.
4. Transfer of Data to a Third Country or an International Organisation
The General Data Protection Regulation (‘GDPR’) requires that the transfer of personal data that is already being processed, or that is to be processed following its transfer to a third country or an international organisation, is only permissible where a level of data protection comparable to the requirements of the GDPR is guaranteed. This may, for example, be ensured through the existence of an adequacy decision of the EU Commission within the meaning of Article 45(1) and (3) GDPR, or through the implementation of internal company data protection rules approved by a supervisory authority (so-called ‘appropriate safeguards’, Article 46(2) and (3) GDPR). Where no level of data protection comparable to the requirements of the GDPR exists, risks may arise from processing in a third country.
Risks of a Transfer to a Non-Secure Third Country: Personal data could potentially be passed on by the provider to other third parties beyond the actual purpose of performing the contract, for example for the third parties’ own advertising purposes. In addition, effective enforcement of any data subject rights against the provider is unlikely to be possible. There may also be a higher probability of incorrect data processing occurring, as the provider’s technical and organisational measures for the protection of personal data may not fully meet the quantitative and qualitative requirements of the GDPR. It is also possible that government authorities may access the personal data provided without the data subject being aware of this. This is, in principle, also consistent with European statutory provisions, for example for the purpose of averting danger. However, the threshold for permissibility of such data processing is higher in the European Union than in the recipient’s country. In summary, non-secure third countries do not offer a level of data protection comparable to the requirements of the GDPR.
We use, among other things, tools on our website provided by providers whose registered office, or the registered office of their parent company (or affiliated companies), is located in a third country from a data protection perspective. We also transfer data to the USA. A transfer of data to the USA is permissible where the recipient holds a certification under the ‘EU-US Data Privacy Framework’ (‘DPF’) or has appropriate additional safeguards in place. The DPF is an arrangement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing carried out in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. The list of certified companies is available at: https://www.dataprivacyframework.gov/list. There, you can search for the provider’s name and view its certification directly. Where data is transferred to a provider certified under the DPF, a separate notice is provided under the relevant service provider.
Where a transfer of data to a third country or an international organisation takes place, we will inform you of this by way of a separate notice under the relevant processing activity in this privacy policy.
5. Recipients of Personal Data
Within our organisation, access to your personal data is, as a general rule, granted only to those departments and areas that require it in order to carry out our activities and for the purposes described, and that are authorised to process such data.
In providing our services, we engage data processors who assist in fulfilling our contractual obligations. We work together with service providers, such as providers of IT maintenance services, video conferencing tools or newsletter dispatch services (so-called ‘processors’). These service providers act only on our instructions and are contractually bound to comply with applicable data protection requirements. To this end, we enter into written data processing agreements with these service providers. Where specific processors are engaged to process personal data, we will inform you of this by way of a separate notice under the relevant processing activity in this privacy policy.
Where applicable, we transfer personal data to courts, supervisory authorities or law firms, insofar as there is a legal obligation to do so under Article 6(1)(c) GDPR, or where this is necessary under Article 6(1)(f) GDPR for the assertion, exercise or defence of legal claims, and there is no reason to assume that the data subjects concerned have an overriding interest worthy of protection in the data not being disclosed.
6. Requirement to Provide Personal Data
The provision of your personal data is, as a general rule, neither required by law nor by contract. There is no obligation to provide it. However, not providing it may mean that you are unable to make use of functions, services, forms and other processing activities on our website. We recommend that you only provide such personal data as is necessary, for example, to process your enquiry, to carry out the service you have requested, and to use the functions we offer. Where the provision of your personal data is required by law or by contract, we will inform you of this by way of a separate notice under the relevant processing activity in this privacy policy.
The collection of technical data (including, where applicable, the collection of your IP address as personal data) to provide the website, and the storage of data in log files, is strictly necessary for the operation of the website and takes place automatically when you access this website. If you do not wish this to happen, you must leave this website.
II. Rights of the Data Subject
Where we process personal data relating to you, you have the following rights as a data subject vis-à-vis us as the controller:
1. Right of Access, Article 15 GDPR
Within the scope of applicable statutory provisions, you have the right, at any time, to (free of charge) access the personal data collected and stored about you. This includes, among other things, information on the purposes of processing, the origin and recipients of the data, the storage period, and the existence of various rights.
2. Right to Rectification, Article 16 GDPR
You have the right, vis-à-vis the controller, to rectification (including completion) of your data, insofar as the personal data processed concerning you is inaccurate or incomplete for the purpose of the processing. The controller must carry out the rectification promptly.
3. Right to Erasure, Article 17 GDPR
You may, under the conditions set out in Article 17 GDPR, request the erasure of your personal data at any time, unless circumstances exist that entitle or oblige the controller to continue processing your personal data (such as statutory retention obligations).
4. Right to Restriction of Processing, Article 18 GDPR
Where the statutory requirements are met, you may request a restriction of the processing of your personal data within the scope of Article 18 GDPR.
5. Right to Notification, Article 19 GDPR
Where your personal data has been processed by recipients to whom the controller has disclosed the data, the controller is obliged to inform such recipients of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. You may request that the controller inform you about these recipients.
6. Right to Data Portability, Article 20 GDPR
Where you have provided us with personal data and an automated processing takes place on the basis of your consent or on the basis of a contract, you have, within the scope of Article 20 GDPR, a right to receive the data you have provided, as long as this does not adversely affect the rights and freedoms of others. The data will be provided in a commonly used, machine-readable format. Where you request the direct transfer of the data to another controller, this will only be done where technically feasible.
7. Right to Object, Article 21 GDPR
You have the right to object, at any time, to the processing of your data where the processing is based on a balancing of interests. This is the case where the controller relies on the public interest or its legitimate interest as the basis for processing (see Article 6(1)(e) and (f)). This requires you to state grounds arising from your particular situation that outweigh the controller’s interest. The controller will then no longer process the personal data concerning you, unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where the processing serves the assertion, exercise or defence of legal claims.
Article 21(2) GDPR contains a special, derogating provision applicable where the personal data concerning you are used for direct marketing purposes. In such cases, you have the right, at any time and without any further conditions, to object to the processing of your personal data for such purposes. The personal data concerning you will then no longer be processed for the purpose of direct marketing. Insofar as direct marketing is associated with profiling, you also have the right to object to such profiling.
In connection with the use of information society services, you may exercise your right to object by automated means using technical specifications.
8. Automated Individual Decision-Making, Article 22 GDPR
You have the right, pursuant to Article 22 GDPR, not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. Exceptions may apply where suitable measures are in place to safeguard your rights, where the decision is necessary for entering into or performing a contract, where authorised by law, or where you have given your explicit consent.
9. Right to Withdraw Your Consent, Article 7(3) GDPR
You have the right to withdraw your data protection consent declaration at any time. The lawfulness of the processing carried out on the basis of the consent up until the withdrawal remains unaffected by the withdrawal. You may communicate your withdrawal to the controller by email or by post.
10. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, where you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht – ‘BayLDA’). If you are located in a different federal state, or outside Germany, you may also contact the data protection authority there.
III. SSL/TLS Encryption
For security reasons, and to protect the transmission of confidential content, such as enquiries that you, as a data subject, send to us as the website operator, this website uses SSL/TLS encryption. An encrypted connection can be recognised by the fact that the browser’s address bar changes from ‘http://’ to ‘https://’, and by the padlock symbol displayed in the browser bar. Where SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.
IV. External Hosting
1. Nature and Scope of the Data Processing
This website is hosted by an external service provider (the ‘hosting provider’). The personal data collected on this website is stored on the hosting provider’s servers. This may include, in particular, IP addresses, contact enquiries, meta and communication data, contract data, contact details, names, page views, and other data generated via a website.
2. Legal Basis for the Data Processing
The legal basis for the data processing is Article 6(1)(f) GDPR, for the purpose of providing the website.
3. Purpose of the Data Processing
The hosting provider is engaged for the purpose of a secure, fast and efficient provision of our online offering, as well as the reliable presentation and delivery of our website by a professional provider. Our legitimate interest lies in these purposes.
4. Duration of Storage, Right to Object and Erasure
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case once the relevant session has ended.
The collection of data to provide the website, and the storage of data in log files, is strictly necessary for the operation of the website. Consequently, users have no right to object in this respect.
5. Conclusion of a Data Processing Agreement
In connection with the data processing described above, the data is disclosed to and processed by our external hosting provider: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. We have entered into a data processing agreement with our hosting provider. This is an agreement required under data protection law, which ensures that our hosting provider processes the personal data of our website visitors only on our instructions and in compliance with applicable data protection provisions (the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz – ‘BDSG’), etc.).
V. Provision of the Website and Creation of Log Files
1. Nature and Scope of the Data Processing
Each time our website is accessed, our system automatically collects data and information from the system of the terminal equipment.
The following data is collected in this process:
(1) Information on the browser type and version used
(2) The user’s operating system
(3) The user’s IP address
(4) Date and time of access
(5) The website from which the user’s system accessed our website
(6) The websites accessed by the user’s system via our website
The data is also stored in the log files of our system. This data is not stored together with any other personal data of the user.
2. Legal Basis for the Data Processing
The legal basis for the temporary storage of the data and of the log files is Article 6(1)(f) GDPR.
3. Purpose of the Data Processing
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s terminal equipment. For this purpose, the user’s IP address must remain stored for the duration of the session.
Our legitimate interest in the data processing under Article 6(1)(f) GDPR also lies in these purposes.
4. Duration of Storage, Right to Object and Erasure
The collection of data to provide the website, and the storage of data in log files, is strictly necessary for the operation of the website. Consequently, users have no right to object in this respect.
VI. Use of Cookies
1. Nature and Scope of the Data Processing
Our website uses cookies. Cookies are text files that are stored in, or by, the internet browser on the user’s system. When a user accesses our website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.
When you access our website, you, as the user, are informed about the use of cookies through a consent management tool provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, and are referred to this privacy policy. Further information on the consent management tool used can be found under point VII of this privacy policy.
The following data is stored and transmitted via these cookies: User ID (cookie consent).
We also use cookies on our website that enable an analysis of users’ browsing behaviour.
In this way, the following data may be transmitted: search terms entered, frequency of website visits, and use of website functions.
Transfer to a Third Country: The data collected via the aforementioned cookies for analysis purposes may be transferred to a service provider established in a third country. Further information can be found in this privacy policy under the relevant service provider. Further information on the transfer to a third country can be found in this privacy policy under ‘I. General Information on Data Processing – 4. Transfer of Data to a Third Country or an International Organisation’.
You may generally prevent or block the storage of cookies on your terminal equipment in your browser settings. To do so, you must access the relevant settings in your browser. In addition, you can delete stored cookie data in your browser settings.
2. Legal Basis for the Data Processing
The legal basis for the processing of personal data using cookies for analysis purposes is the existence of your consent pursuant to Article 6(1)(a) GDPR; for any transfer to a third country, additionally on the basis of Article 49(1)(a) GDPR. The storage of the cookie on your terminal equipment takes place on the basis of Section 25(1) sentence 1 TDDDG. The storage of your consent for evidential purposes and to defend against liability claims (for example, storage of your withdrawal) takes place on the basis of Article 6(1)(f) GDPR. Your consent and any withdrawal of it are stored so that any (previously) given consent can be evidenced, even after withdrawal, and so that any liability claims can be defended against. Our legitimate interest lies in these purposes.
3. Purpose of the Data Processing
We require cookies for the following applications:
(1) Consent management
Our legitimate interest in processing personal data under Article 6(1)(f) GDPR also lies in these purposes. User data collected through technically necessary cookies is not used to create user profiles.
4. Duration of Storage, Right to Object, Right to Withdraw Consent and Erasure
Cookies are stored on the user’s computer and transmitted from it to our website. You therefore, as a user, have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the website to their full extent.
The cookies we use are stored, individually, for the following durations:
cloudfront.net (Essential) – storage period: for the duration of the session
Usercentrics Consent Management Platform (Essential) – storage period: for the duration of the session
Webflow (Essential) – storage period: for the duration of the session
Hotjar (Marketing) – storage period: 365 days
HubSpot (Marketing) – storage period: 396 days
HubSpot Forms (Functional) – storage period: for the duration of the session
As a user, you have the right to withdraw your data protection consent declaration for technically unnecessary cookies at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up until the withdrawal. You may withdraw any consent you have given at any time via the (blue-green) ‘fingerprint’ button at the bottom right of the page. Your consent is stored for evidential purposes and to defend against liability claims, following withdrawal or once the purpose no longer applies, for three years (Sections 195 and 199 of the German Civil Code (Bürgerliches Gesetzbuch – ‘BGB’)).
VII. Cookie Consent via Usercentrics
1. Nature and Scope of the Data Processing
This website uses the cookie consent technology of Usercentrics in order to obtain consent for the storage of certain cookies on the terminal equipment of data subjects, or for the use of certain technologies, and to document this consent in accordance with data protection law. The provider of this technology is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich.
When you access our website, the following personal data is transmitted to the provider:
- Your consent(s) or the withdrawal of your consent(s)
- IP address
- Information about the browser used
- Information about the device used
- Time of the visit to the website
In addition, Usercentrics stores a cookie in your browser in order to be able to match your given consents, or their withdrawal, to you.
2. Legal Basis for the Data Processing
Usercentrics is used in order to obtain the consents required by law for the use of certain technologies. The legal basis for this is Article 6(1)(c) GDPR; the storage of the cookie on your terminal equipment takes place on the basis of Section 25(2) No. 2 TDDDG.
3. Purpose of the Data Processing
The processing of personal data serves to comply with the statutory requirements of the GDPR and the TDDDG for obtaining and documenting consents.
4. Duration of Storage, Right to Object, Right to Withdraw Consent and Erasure
The data collected via Usercentrics is stored until you request that we delete it, until you delete the Usercentrics cookie yourself, or until the purpose of the data storage no longer applies. Mandatory statutory retention obligations remain unaffected.
As a user, you have the right to withdraw your data protection consent declaration at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up until the withdrawal. You may withdraw any consent you have given at any time via the (blue-green) ‘fingerprint’ button at the bottom right of the page.
5. Conclusion of a Data Processing Agreement
In connection with the data processing described above, the data is disclosed to and processed by our service provider Usercentrics. We have entered into a data processing agreement with Usercentrics GmbH. This is an agreement required under data protection law, which ensures that Usercentrics GmbH processes the personal data of our website visitors only on our instructions and in compliance with applicable data protection provisions (the GDPR, the BDSG, etc.).
VIII. Contact by Email and/or Telephone
1. Nature and Scope of the Data Processing
Email addresses and telephone numbers are provided on our website and in our signatures, through which electronic and/or telephone contact is possible. In such cases, the personal data of the data subject transmitted with the email is stored. In the case of telephone contact, personal data may likewise be stored in order to process your enquiry.
In this context, the data is not passed on to third parties. The data is used exclusively for making contact and conducting the conversation.
2. Legal Basis for the Data Processing
The legal basis for the processing of data transmitted in the course of sending an email or in the course of a telephone call is Article 6(1)(f) GDPR. Where the contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Article 6(1)(b) GDPR; where the contact person is the contact person of a (prospective) business partner (customer, supplier or partner), the legal basis for such (pre-)contractual measures is Article 6(1)(f) GDPR.
3. Purpose of the Data Processing
The processing of personal data serves solely to enable us to process the enquiry made through contacting us. This also constitutes the legitimate interest required for the processing of the data.
4. Duration of Storage, Right to Object and Erasure
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For personal data transmitted by email or by telephone, this is the case once the respective conversation with the data subject has ended. A conversation is deemed to have ended where the circumstances indicate that the matter concerned has been conclusively resolved. Where a contract results from the contact, the corresponding (statutory) retention obligations and rules apply.
Where a data subject contacts us by email or by telephone, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of the contact will, in that case, be erased.
IX. Contact Form
1. Nature and Scope of the Data Processing
Various contact forms are available on our website, which you may use to contact us electronically. Where a user makes use of this option, the data entered in the input screen is transmitted to us and stored.
Form: Appointment Booking
Mandatory fields: appointment selection (date, duration, time), first name, last name, email address
In addition, the following data is stored when the forms are used:
(1) The user’s IP address
(2) Date and time of contact
For the processing of the data, reference is made to this privacy policy as part of the submission process. The data is used exclusively for the processing of the conversation.
Use of a Provider Established in a Third Country
The data is used exclusively for the transmission of your data from the contact form. To provide the contact form and for the purposes stated above, the data is passed on to our service provider HubSpot, Inc., a provider of a CRM platform established at 25 First Street, Cambridge, MA 02141, USA. Further information on HubSpot can be found in this privacy policy under ‘XIII. HubSpot (CRM, Content Delivery Network and Tracking)’. Further information on the transfer to a third country can be found in this privacy policy under ‘I. General Information on Data Processing – 4. Transfer of Data to a Third Country or an International Organisation’.
2. Legal Basis for the Data Processing
The legal basis for the processing of data transmitted via the contact form is Article 6(1)(f) GDPR. Where the contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Article 6(1)(b) GDPR; where the user is the contact person of a (prospective) business partner (customer, supplier or partner), the legal basis for such (pre-)contractual measures is Article 6(1)(f) GDPR.
The legal basis for the processing of all other personal data processed during the submission process, which is transmitted via the contact form, is Article 6(1)(f) GDPR.
Where the user’s consent has been obtained, the legal basis for the processing of the data is Article 6(1)(a) and Article 49(1)(a) GDPR. The storage of your consent for evidential purposes and to defend against liability claims (for example, storage of your withdrawal) takes place on the basis of Article 6(1)(f) GDPR. Your consent and any withdrawal of it are stored so that any (previously) given consent can be evidenced, even after withdrawal, and so that any liability claims can be defended against. Our legitimate interest lies in these purposes.
3. Purpose of the Data Processing
The processing of the personal data entered in the input screen serves solely to enable us to process the enquiry made through contacting us. The other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our information technology systems. Our legitimate interest also lies in these purposes.
4. Duration of Storage, Right to Object, Right to Withdraw Consent and Erasure
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data entered in the input screen of the contact form, this is the case once the respective conversation with the user has ended. A conversation is deemed to have ended where the circumstances indicate that the matter concerned has been conclusively resolved.
Where a user contacts us via the form, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of the contact will, in that case, be erased.
As a user, you have the right to withdraw your data protection consent declaration at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up until the withdrawal. You may withdraw any consent you have given at any time via the (blue-green) ‘fingerprint’ button at the bottom right of the page. Your consent is stored for evidential purposes and to defend against liability claims, following withdrawal or once the purpose no longer applies, for three years (Sections 195 and 199 BGB).
X. Newsletter: Registration and Distribution
1. Nature and Scope of the Data Processing
Our website offers the option of subscribing to a free newsletter. When registering for the newsletter, the following data entered in the input screen is transmitted to us:
(1) Email address
In addition, the following data is collected upon registration:
(1) The IP address of the accessing computer
(2) Date and time of registration
For the processing of the data, your consent is obtained as part of the registration process, and reference is made to this privacy policy.
Our newsletter includes the delivery of product information that we believe may be of interest to you, contact with you to inform you about our products and services and to share current developments and useful information with you, and invitations to events of interest to you, such as webinars or trade fairs. The distribution of the newsletter is currently being developed and is expected to take place no more than once a month.
The data is used exclusively for the dispatch of the newsletter.
Measurement of Open and Click-Through Rates
On the basis of your consent, we also evaluate your user behaviour within the information we send and associate this information with your email address within our newsletter system. Every newsletter sent to you contains pixel-sized files that enable us to evaluate delivery and read receipts, as well as information on the links you have clicked within our newsletter. We also record which areas you have visited within our website. The information collected is used to improve our information both technically and in terms of content. By creating a personal user profile, we aim to tailor our promotional communications to your interests and to optimise our offerings on our website for you. The measurement of open rates and click-through rates, together with the storage of the measurement results in user profiles and their further processing, take place on the basis of users’ consent.
Double Opt-In Procedure
Registration for our newsletter generally takes place using a double opt-in procedure. After registering on our website, you will receive an email asking you to confirm your registration for our newsletter. This confirmation serves as evidence that you registered for our newsletter with your email address.
Storage of Your Withdrawal
We may also store unsubscribed email addresses on the basis of our legitimate interest, in order to be able to evidence consent previously given even after you have unsubscribed from our newsletter.
Use of a Provider Established in a Third Country
The data is used exclusively for the delivery of the requested information and its evaluation. For the dispatch of the information and for the purposes stated above, the data is passed on to our service provider HubSpot, Inc., a provider of a CRM platform established at 25 First Street, Cambridge, MA 02141, USA. Further information on HubSpot can be found in this privacy policy under ‘XIII. HubSpot (CRM, Content Delivery Network and Tracking)’.
This means that personal data is also processed in a third country. Further information on the transfer to a third country can be found in this privacy policy under ‘I. General Information on Data Processing – 4. Transfer of Data to a Third Country or an International Organisation’.
2. Legal Basis for the Data Processing
The legal basis for the processing of data upon registration for our newsletter, and for the evaluation of our newsletter (newsletter tracking), is the existence of the user’s consent (with double opt-in) pursuant to Article 6(1)(a) GDPR, and, for any transfer to a third country, Article 49(1)(a) GDPR. The legal basis for carrying out the double opt-in procedure is Article 6(1)(f) GDPR, for the purpose of evidencing and verifying your consent. The legal basis for storage for evidential purposes and to defend against liability claims (storage of a withdrawal) is Article 6(1)(f) GDPR. Your consent and any withdrawal of it are stored so that any (previously) given consent can be evidenced, even after withdrawal, and so that any liability claims can be defended against. Our legitimate interest lies in these purposes.
The legal basis for the processing of all other personal data processed during the registration process, which is transmitted when registering for our newsletter, is Article 6(1)(f) GDPR.
3. Purpose of the Data Processing
The collection of the user’s email address serves to enable delivery of the newsletter. The collection of other personal data as part of the registration process serves to prevent misuse of the services or of the email address used. The collection of analytical data from the delivery of the newsletter serves to improve and optimise our offerings.
The double opt-in procedure is carried out for the purpose of evidencing and verifying your consent. Your withdrawal is stored in order to be able to evidence consent previously given, even after withdrawal, and thereby to defend against any liability claims.
The other personal data processed during the submission process serves to prevent misuse of the newsletter registration and to ensure the security of our information technology systems. Our legitimate interest also lies in these purposes.
4. Duration of Storage, Right to Object, Right to Withdraw Consent and Erasure
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. The user’s email address is accordingly stored for as long as the newsletter subscription remains active.
You have the right to withdraw your data protection consent declaration at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up until the withdrawal. You may communicate your withdrawal either by post or by email to the controller.
We may also store unsubscribed email addresses, on the basis of our legitimate interest, for up to three years, in order to be able to evidence consent previously given even after unsubscription.
The newsletter subscription may be cancelled by the data subject at any time. A corresponding link is provided in every newsletter for this purpose. This also enables withdrawal of consent to the storage of the personal data collected during the registration process.
A separate withdrawal of newsletter tracking is not possible; in this case, the entire subscription must be cancelled.
XI. Marketing Initiatives by Email with Advertising Consent (Direct Marketing) – Section 7(2) No. 2 of the German Act Against Unfair Competition (‘UWG’)
1. Nature and Scope of the Data Processing
Our website offers the option of downloading various pieces of information, such as whitepapers, checklists and eBooks, and of registering for our general marketing initiatives. For the download, the data entered in the input screen is transmitted to us. The following data must be provided:
(1) Email address
In addition, the following data is collected upon registration:
(1) Date and time of registration
(2) The IP address of the accessing computer
As part of the download process, your consent is obtained, and reference is made to this privacy policy. The data is used for the delivery of the requested information and for the marketing initiatives of Tatajuba Solutions GmbH. Based on the information you provide, our sales team identifies which products and services of Tatajuba Solutions GmbH may be of interest to you and informs you, at irregular intervals, by email about the development of our products and services.
Measurement of Open and Click-Through Rates
On the basis of your consent, we also evaluate your user behaviour within the information we send and associate this information with your email address within our newsletter system. Every newsletter sent to you contains pixel-sized files that enable us to evaluate delivery and read receipts, as well as information on the links you have clicked within our newsletter. We also record which areas you have visited within our website. The information collected is used to improve our information both technically and in terms of content. By creating a personal user profile, we aim to tailor our promotional communications to your interests and to optimise our offerings on our website for you. The measurement of open rates and click-through rates, together with the storage of the measurement results in user profiles and their further processing, take place on the basis of users’ consent.
Double Opt-In Procedure
Where we obtain your consent electronically, this generally takes place using a double opt-in procedure. After registering on our website, you will receive an email asking you to confirm your registration for our marketing initiatives. This confirmation serves as evidence that you registered for our marketing initiatives with your email address.
Storage of Your Withdrawal
We may also store unsubscribed email addresses on the basis of our legitimate interest, in order to be able to evidence consent previously given even after unsubscription.
Use of a Provider Established in a Third Country
The data is used exclusively for the delivery of the requested information and its evaluation. For the dispatch of the information and for the purposes stated above, the data is passed on to our service provider HubSpot, Inc., a provider of a CRM platform established at 25 First Street, Cambridge, MA 02141, USA. Further information on HubSpot can be found in this privacy policy under ‘XIII. HubSpot (CRM, Content Delivery Network and Tracking)’.
This means that personal data is also processed in a third country. Further information on the transfer to a third country can be found in this privacy policy under ‘I. General Information on Data Processing – 4. Transfer of Data to a Third Country or an International Organisation’.
2. Legal Basis for the Data Processing
The legal basis for the data processing for the delivery of downloadable information and the conduct of marketing initiatives is Article 6(1)(a) GDPR; any transfer to a third country is based on Article 49(1)(a) GDPR. The legal basis for carrying out the double opt-in procedure is Article 6(1)(f) GDPR, for the purpose of evidencing and verifying your consent. The legal basis for storage for evidential purposes and to defend against liability claims (storage of a withdrawal) is Article 6(1)(f) GDPR. Your consent and any withdrawal of it are stored so that any (previously) given consent can be evidenced, even after withdrawal, and so that any liability claims can be defended against. Our legitimate interest lies in these purposes.
3. Purpose of the Data Processing
The collection of the data is necessary for the download of the requested information.
The processing of your data also takes place for the purpose of carrying out one-off and recurring marketing initiatives, for example for:
· The delivery of emails and product information that we believe may be of interest to you.
· Electronic contact to inform you about the products and services of Tatajuba Solutions GmbH and to share current developments and useful information with you.
· Invitations to events, such as webinars or trade fairs, that may be of interest to you.
· The evaluation of our marketing initiatives, in order to determine how we can design our website and our information to be attractive and appropriate for our target audience.
The collection of other personal data as part of the registration process serves to prevent misuse of the services or of the email address used.
The double opt-in procedure is carried out for the purpose of evidencing and verifying your consent. Your withdrawal is stored in order to be able to evidence consent previously given, even after withdrawal, and thereby to defend against any liability claims.
4. Duration of Storage
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected, or once you have withdrawn your consent. Other personal data collected as part of the registration process is generally erased after a period of seven days.
5. Right to Object, Right to Withdraw Consent and Erasure
In addition to delivering the requested information (download), we use your email address to inform you by email about similar products and services.
You have the right to withdraw your data protection consent declaration at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up until the withdrawal. You may communicate your withdrawal either by post or by email to the controller. In addition, where electronic communication takes place via our CRM system, you may withdraw your consent within the email sent, via a corresponding link (‘unsubscribe’). We may also store unsubscribed email addresses, on the basis of our legitimate interest, for up to three years, in order to be able to evidence consent previously given even after unsubscription. A separate withdrawal of the tracking described above is not possible; in this case, consent must be withdrawn in its entirety.
XII. AWS CloudFront (Content Delivery Network)
1. Nature and Scope of the Data Processing
We use AWS CloudFront for the proper delivery of the content of our website. AWS CloudFront is a service provided by Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg (‘AWS’), which functions as a content delivery network (‘CDN’) on our website.
A CDN helps to deliver the content of our online offering, in particular files such as graphics or scripts, more quickly by means of regionally or internationally distributed servers. When you access this content, you also establish a connection to servers of Amazon Web Services, Inc., during which your IP address and, where applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of AWS CloudFront.
Use of a Provider Established in a Third Country
Data collected via AWS CloudFront may therefore also be transferred to servers in the USA. AWS has implemented compliance measures for international data transfers. These apply to all of AWS’s global activities involving the processing of personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (‘SCCs’). Further information is available at: https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
Amazon holds a certification under the ‘EU-US Data Privacy Framework’ (‘DPF’). Further information on the DPF can be found in this privacy policy under ‘I. General Information on Data Processing – 4. Transfer of Data to a Third Country or an International Organisation’.
2. Legal Basis for the Data Processing
The use of this service is based on our legitimate interest in the most error-free and secure provision of our web offering possible (Article 6(1)(f) GDPR).
3. Purpose of the Data Processing
We use the AWS service to increase the security and delivery speed of our website. The data processing thus serves the secure and efficient provision, as well as the optimisation, of our website. Our legitimate interest also lies in these purposes.
4. Duration of Storage, Right to Object, Right to Withdraw Consent and Erasure
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected.
The specific storage period for the data processed is not within our control, but is determined by Amazon Web Services, Inc. Further information can be found in the privacy policy for AWS CloudFront: https://aws.amazon.com/privacy/.
Further information on options to object and to have data removed with respect to AWS can be found at: https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice__German_Translation.pdf
5. Conclusion of a Data Processing Agreement
In connection with the data processing described above, the data is disclosed to and processed by our service provider Amazon Web Services. We have entered into a data processing agreement with Amazon Web Services. This is an agreement required under data protection law, which ensures that Amazon Web Services processes the personal data of our website visitors only on our instructions and in compliance with applicable data protection provisions (the GDPR, the BDSG, etc.).
XIII. HubSpot (CRM, Content Delivery Network and Tracking)
1. Nature, Scope and Purpose of the Data Processing
We use HubSpot on this website. The provider is HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA (hereinafter ‘HubSpot’).
HubSpot enables us, among other things, to embed contact forms, to offer appointment booking, and to manage existing and prospective customers as well as customer contacts. With the help of HubSpot, we are able to record, sort and analyse customer interactions by email, social media or telephone across various channels. The personal data collected in this way may be evaluated and used for communication with the prospective customer or for marketing measures (for example, newsletter mailings).
HubSpot also enables us to record and analyse the user behaviour of our contacts on our website.
Further details can be found in HubSpot’s privacy policy: https://legal.HubSpot.com/privacy-policy
Use of a Provider Established in a Third Country
The transfer of data to the USA is based on the European Commission’s Standard Contractual Clauses. The company holds a certification under the ‘EU-US Data Privacy Framework’ (‘DPF’). Further information on the DPF can be found in this privacy policy under ‘I. General Information on Data Processing – 4. Transfer of Data to a Third Country or an International Organisation’.
2. Legal Basis for the Data Processing
The use of HubSpot CRM is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in the most efficient possible customer management and customer communication.
Where corresponding consent has been requested, the processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (for example, device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.
3. Duration of Storage, Right to Object, Right to Withdraw Consent and Erasure
The data is erased as soon as it is no longer required to achieve the purpose for which it was collected.
You have the right to withdraw your data protection consent declaration at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up until the withdrawal. You may withdraw any consent you have given via the consent management tool.
4. Conclusion of a Data Processing Agreement
In connection with the data processing described above, the data is disclosed to and processed by our service provider HubSpot. We have entered into a data processing agreement with HubSpot. This is an agreement required under data protection law, which ensures that HubSpot processes the personal data of our website visitors only on our instructions and in compliance with applicable data protection provisions (the GDPR, the BDSG, etc.).