Privacy policy · StudyQuick

This is a translation. If they differ, the German version applies.

Privacy policy for the content and functions

of the app “Studyquick”

(hereinafter “Services”)

Last updated: August 2026

Introduction

Privacy policies are often hard to read. We understand that, and we want to do things differently. With our privacy policy we want to give you an easily understandable explanation of the way in which we process your personal data. To that end, we have structured our privacy policy clearly for you and show you, for each subject area, whether and how we process your personal data.

Table of contents

Our privacy policy is structured as follows

General - A brief introduction to the subject matter of the privacy policy, the controller and the data protection officer
General information on data processing - Information on what personal data is, on what legal basis we process it, and how we share it with third parties
Data subject rights - Information on your rights to, among other things, access, erasure or objection to our data processing
Information on the cookies and other technologies used - Information on the use of cookies and other technologies with which, or with the help of which, we process your personal data
Data processing in connection with the use of our Services - Information on our data processing within our Services themselves, on registration and on individual functionalities
Communication services - Information on communication services and the corresponding processing of your personal data
Payment processing - Information on the processing of payments through integrated payment service providers and the resulting processing of your personal data
Provision of our Services - Information on our hosting service providers and the services they use
Tracking & tools - Information on services by means of which we provide our Services to you and by means of which we analyse the use of our Services
Newsletter - Information on the integration of newsletter services by means of which we provide you with regular information about our services
Fan pages on social media - Information on our presence on social media networks and the resulting processing of your personal data
Plug-ins in our Services - Information on plug-ins from other platforms present in our Services and the resulting processing of your personal data
Share function - Information on ways to share content directly from our Services on social media networks
Affiliate marketing - Information on affiliate marketing programmes integrated into our Services by us or by third parties

1. General

The protection of your personal data and your privacy is extremely important to us. That is why we want to offer you full transparency regarding the processing of your personal data (GDPR) and regarding the storage of information on your terminal device (TDDDG – German Telecommunications Digital Services Data Protection Act). Only if the processing of personal data and information is comprehensible to you as a data subject are you sufficiently informed about the scope, purposes and benefits of the processing.

This privacy policy applies to all processing of personal data carried out by us and to the storage of information on your terminal devices. It therefore applies both to the provision of our services within our Services and within external online presences, such as our social media fan pages.

The controller within the meaning of the General Data Protection Regulation (GDPR), the BDSG (Bundesdatenschutzgesetz – German Federal Data Protection Act) and the Belgian Gegevensbeschermingswet (Data Protection Act) of 30 July 2018 is

OPTIBI BV

Wilderoosstraat 2

9000 Gent, Belgium

BE0540564865

+32 9 298 08 18

[email protected]

www.studyquick.io

Hereinafter referred to as the “Controller” or “we”.

2. General information on data processing

First of all, we would like to give you some introductory information on what the protection of your personal data means, what personal data is, how we process it and what security measures we apply in doing so.

2.1 Processing of personal data

Personal data (hereinafter also “data”) are individual details about the personal or factual circumstances of an identified or identifiable natural person.

Individual details about personal or factual circumstances include, for example:

Personal details - Name, age, marital status, date of birth
Communication data - Address, telephone number, email address
Account data - Bank account and credit card number
Geodata - IP address & location data
Health data - State of health, illnesses

“Processing” personal data includes, for example, the following measures

Collection - The collection of your data via contact forms, by email or through processes and services we use
Transmission - The transmission of your data to our service providers, integrated services or other third parties
Storage - The storage of your data in our databases or on our servers
Erasure - The erasure of your data when we are no longer entitled to process it

2.2 Legal bases for the processing of your personal data

We process personal data only within the legally permissible limits. The law alone obliges us to do so, in particular the GDPR. Under it, we are obliged always to be able to base data processing operations on a legal basis. These legal bases are set out in Art. 6(1) GDPR. Here we list the most common legal bases on which we process your personal data.

Consent - Art. 6(1)(a) GDPR: Your data is processed only if you have consented to this processing after we have first provided you with sufficient information about its scope and purposes.
For the performance of a contract - Art. 6(1)(b): Your data is processed only if this is necessary for the performance of a contract between us or for the implementation of pre-contractual measures.
Legitimate interest - Art. 6(1)(f) GDPR: Your data is processed only if this is necessary to safeguard a legitimate interest on our part and your interests or fundamental rights and freedoms concerning the protection of your data do not override it.

We process personal data only for specified purposes (Art. 5(1)(b) GDPR). As soon as the purpose of the processing ceases to apply, your personal data is erased or protected by technical and organisational measures (e.g. by pseudonymisation).

The same applies on expiry of a prescribed retention period, subject to cases in which further storage is necessary for the conclusion or performance of a contract. In addition, there may be a legal obligation to store data for longer or to disclose it to third parties (in particular to law enforcement authorities). In other cases, the storage period and the type of data collected, as well as the type of data processing, depend on which functions you use in the individual case. We will gladly provide you with information on this in the individual case, in accordance with Art. 15 GDPR.

2.3 These are the categories of data we process

Data categories include, in particular, the following data:

Master data (e.g. names, addresses, dates of birth),
Contact data (e.g. email addresses, telephone numbers, messenger services),
Content data (e.g. text entries, photographs, videos, contents of documents/files),
Contract data (e.g. subject matter of the contract, terms, customer category),
Payment data (e.g. bank details, payment history, use of other payment service providers),
Usage data (e.g. history within our Services, use of certain content, access times),
Connection data (e.g. device information, IP addresses, URL referrers).

2.4 These are the security measures we take

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the threat to your rights and freedoms, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring that your data is stored and processed confidentially, with integrity and in a manner that keeps it available at all times. The security measures we implement further include controls of physical access to your data and of access, input, disclosure, safeguarding of availability and separation from the data of other natural persons. Furthermore, we have established procedures that ensure the exercise of data subject rights (see section 5), the erasure of data and responses to threats to your data. In addition, we take the protection of personal data into account as early as the development of our software and through procedures that comply with the principle of data protection by design and by default.

2.5 How we transmit or disclose personal data to third parties

In the course of our processing of your personal data, this data may be transmitted or disclosed to other bodies, companies, legally independent organisational units or persons. These third parties may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks, or providers of services and content that we have integrated into our Services. If we transmit or disclose your personal data to third parties, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

2.6 How transfers to third countries take place

Where this privacy policy states that we transfer your personal data to a third country, i.e. a country outside the EU or outside the EEA, the following applies. A transfer to a third country takes place only in accordance with the legal requirements. We assure you that we have a contractual or statutory authorisation for the transfer and processing of your data in the third country concerned. In addition, we only have your data processed by service providers in third countries which, in our view, offer a recognised level of data protection. This means, for example, that an adequacy decision exists between the EU and the country to which we transfer your personal data. An “adequacy decision” is a decision adopted by the European Commission pursuant to Art. 45 GDPR establishing that a third country (i.e. a country not bound by the GDPR) or an international organisation offers an adequate level of protection for personal data. Alternatively, for example where there is no adequacy decision, a transfer to a third country takes place only if, for instance, contractual obligations exist between us and the service provider in the third country in the form of the so-called standard contractual clauses of the EU Commission and further technical safeguards have been taken that ensure a level of protection essentially equivalent to that in the EU, or if the service provider in the third country can demonstrate data protection certifications and your data is processed only in accordance with internal data protection rules (Art. 44 to 49 GDPR; information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Under the so-called “Data Privacy Framework” (“DPF”), the EU Commission recognised the level of data protection of certain companies from the USA as safe in its adequacy decision of 10 July 2023. A list of certified companies and further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). In this privacy policy, we inform you which of the services we use are certified under the Data Privacy Framework.

2.7 Erasure of data

The data we process is erased in accordance with the legal requirements as soon as the consents permitting its processing are withdrawn or other permissions cease to apply (e.g. if the purpose of processing this data has ceased to apply or it is not necessary for the purpose). If the data is not erased because it is required for other and legally permissible purposes, its processing is restricted to those purposes. This means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Within this privacy policy, we may provide information on the erasure and retention of data that apply specifically to the respective processing operations.

2.8 Storage of and access to data on your terminal device

Where we do not obtain your consent for this, the storage of or access to information on your terminal device takes place in accordance with Art. 129 § 2 of the Belgian Law of 13 June 2005 on electronic communications (Wet van 13 juni 2005 betreffende de elektronische communicatie), because the storage of and access to this information is strictly necessary to provide the requested functions of our Services. Where we obtain consent for this, the legal basis is Art. 129 § 1 of the Law of 13 June 2005 on electronic communications. Our Services use cookies, tokens, beacons or other technologies which may be stored on your terminal devices and without which the provision of our Services would not be possible.

Cookies, tokens, beacons or other technologies are generally text files that are stored on your terminal device and can be read by us and by third parties when you access our Services. Many of the aforementioned technologies contain their own ID. Such an ID is a unique identifier of the technology used in each case. It consists of a string of characters by which websites and servers can be assigned to the specific internet browser or the specific service or terminal device used in which the cookies, tokens, beacons or other technologies were stored. This enables the operators of websites and analytics services to identify you as a user and distinguish you from others.

2.9 Access permissions and device settings

To use our Services fully, you should make some settings on your device, for example granting access rights to our Services. When you first use our Services or a specific function, you will be asked for the corresponding permissions, which you can grant to us and to our Services. We process the data mentioned for the following purposes:

The data processing operations listed in section 2.9.1 are necessary so that we can provide you with the full functionality of our Services in the first place and thus perform our contract with you. The legal basis for data processing for the aforementioned purposes is therefore Art. 6(1)(b) GDPR.

The data processing operations mentioned in section 2.9.2 are necessary in order to be able to correctly check and apply permissions, functionalities and security settings for the use of our Services. The legal basis for data processing for the aforementioned purposes is therefore Art. 6(1)(f) GDPR, our legitimate interest. We have a legitimate interest in checking whether our Services are displayed correctly and used by you legitimately.

2.9.1 Full functionality of our Services

Camera

Access to your device’s camera is required in order to take pictures.

Microphone

Access to the microphone of your terminal device is required in particular to enable our speech recognition, transcription and matching function.

Photo/video gallery

Access to your photo/video gallery is required in order to upload a message including a photo or video directly from your terminal device’s gallery to our Services.

Location / geolocation

We need your current location in order to always display and offer up-to-date regional information and services that suit you.

2.9.2 Security requirements

Network access & network connections

Network access is required because our Services can only be used in online mode.

Device status

We need access to the status of your terminal device for some of our security checks.

2.10 Processing on behalf of the controller

If we use external service providers to process your data, they are carefully selected and commissioned by us. If the services provided by these service providers constitute processing on behalf of the controller within the meaning of Art. 28 GDPR, the service providers are bound by our instructions and are regularly monitored. Our data processing agreements comply with the strict requirements of Art. 28 GDPR and with the requirements of the Gegevensbeschermingsautoriteit (Belgian Data Protection Authority).

3. Data subject rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and, as a user, you have the following rights against the Controller:

3.1 Right of access

You can request confirmation from the Controller as to whether personal data concerning you is being processed by us.

Where such processing takes place, you can request the following information from the Controller:

the purposes for which the personal data is processed;
the categories of personal data being processed;
the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
the envisaged period for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used to determine the storage period;
the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the Controller or a right to object to such processing;
the existence of a right to lodge a complaint with a supervisory authority;
all available information about the source of the data, where the personal data is not collected from the data subject;
the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you can request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

3.2 Right to rectification

You have a right to rectification and/or completion against the Controller if the processed personal data concerning you is inaccurate or incomplete. The Controller must carry out the rectification without undue delay.

3.3 Right to restriction of processing

You can request the restriction of processing of the personal data concerning you under the following conditions:

if you contest the accuracy of the personal data concerning you, for a period enabling the Controller to verify the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
the Controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been established whether the legitimate grounds of the Controller override your grounds.
Where processing of the personal data concerning you has been restricted, such data may – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If processing has been restricted under the above conditions, you will be informed by the Controller before the restriction is lifted.

3.4 Right to erasure

3.4.1. You can request the Controller to erase the personal data concerning you without undue delay, and the Controller is obliged to erase this data without undue delay where one of the following grounds applies:

The personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing.
You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
The personal data concerning you has been unlawfully processed.
The erasure of the personal data concerning you is required for compliance with a legal obligation under Union or Member State law to which the Controller is subject.
The personal data concerning you has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

3.4.2. Where the Controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase it, the Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copies or replications of, that personal data.

3.4.3. The right to erasure does not apply to the extent that processing is necessary

for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR, in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise or defence of legal claims.

3.5 Right to notification

If you have asserted the right to rectification, erasure or restriction of processing against the Controller, the Controller is obliged to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right against the Controller to be informed about those recipients.

3.6 Right to data portability

You have the right to receive the personal data concerning you which you have provided to the Controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the Controller to which the personal data has been provided, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be adversely affected by this.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

3.7 Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.

The Controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.

In the context of the use of information society services – and notwithstanding Directive 2002/58/EC – you may exercise your right to object by automated means using technical specifications.

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Processing is lawful until your withdrawal – the withdrawal therefore only takes effect for processing after your withdrawal has been received. You can declare your withdrawal informally by post or email. Your personal data will then no longer be processed, unless permitted on another legal basis. If this is not the case, your data must be erased without undue delay after the withdrawal in accordance with Art. 17(2) GDPR. Your right to withdraw your consent, subject to the conditions set out above, is guaranteed.

Your withdrawal should be addressed to:

OPTIBI BV

Wilderoosstraat 2

9000 Gent, Belgium

BE0540564865

+32 9 298 08 18

[email protected]

www.studyquick.io

3.9 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

3.10 Automated individual decision-making, including profiling

No automated individual decision-making, including profiling, takes place.

3.11 Notification obligations of the Controller

If your personal data has been lawfully disclosed to other recipients (third parties), we will communicate to them any rectification, erasure or restriction of processing of your personal data (Art. 16, Art. 17(1) and Art. 18 GDPR). The notification obligation does not apply if it involves disproportionate effort or is impossible. We will also inform you about the recipients on request.

4. Information on the cookies and other technologies used

Our website studyquick.ai sets no cookies and does not integrate any tracking or analytics services. The technologies described in this section and in section 9 relate to our web app.

We use cookies, beacons or other technologies to provide and evaluate our Services and to carry out marketing using the evaluated data. Cookies are, for example, small text files that contain data from visited websites or domains and are stored on your device (computer, tablet or smartphone). When you access a website, the cookie stored on your device sends information to whoever placed the cookie.

4.1 How we use cookies and other technologies

We want you to be able to make an informed decision for or against the use of cookies and other technologies that are not strictly necessary for the technical features of the Services. Therefore, where we use cookies and other technologies that require your consent, we enable you to choose, by means of a voluntary decision on your first visit to our Services and permanently thereafter in the corresponding settings, which cookies and other technologies you allow. It always applies that functional cookies and other technologies are mandatory for visiting our Services and are therefore already permitted by our default settings. Statistics and marketing cookies and other technologies are optional. You can allow them by consenting to the setting of these cookies and other technologies in the consent banner. Alternatively, you can reject statistics and marketing cookies and other technologies.

4.2 Storage period of cookies and other technologies

Unless we provide you with explicit information on the storage period of cookies and other technologies (e.g. in the consent banner), you can assume that the storage period may be up to two years. Where cookies and other technologies have been set on the basis of your consent, you have the option at any time to withdraw consent given or to object to the processing of your data by cookies/technologies (collectively referred to as “opt-out”).

4.3 Types of cookies and other technologies

In terms of substance, we distinguish between

Necessary: We use these trackers to enable operations that are strictly necessary for providing and delivering a service you have requested from us, and they therefore do not require your consent.
Functionality: These are required for the basic technical functions of the Services. They enable, for example, a secure login and the saving of progress in ordering processes. They also enable us, for example, to save your login data and the contents of your shopping basket, and to display page content consistently.
User experience: These trackers enable us to offer you an improved user experience and to enable interactions with external content, networks and platforms.
Performance measurement: These enable us to analyse the Services so that we can measure and improve their performance. You can change your personal statistics settings by clicking on the corresponding opt-out link.
Marketing: We use these to present you with advertising that may be relevant to your interests. They enable, for example, the sharing of pages via social networks and the writing of comments. Offers that may match your interests are also displayed. You can change your personal marketing settings by clicking on the corresponding opt-out link.

Where we use technologies in our web app that require your consent, we obtain it before they are used. You can withdraw consent given at any time with effect for the future.

5. Data processing in connection with the use of our Services

The use of our Services with all their functions involves the processing of personal data. We explain here exactly how this happens.

App via app stores

Our Services are available via distribution platforms operated by third parties, so-called app stores (Google Play Store and Apple Store). Your download may require prior registration with the respective app store and installation of the app store software. We have no influence on the collection, processing and use of personal data in connection with your registration and the provision of downloads in the respective app store and the app store software. In this respect, the operator of the respective app store is solely responsible. If necessary, please obtain information directly from the respective app store provider.

5.1 Informational use of our Services

Purely informational access to our Services requires the processing of the following personal data and information: device type and device version, operating system used, IP address of the terminal device with which you access our Services, and the time of access to our Services. All this information is transmitted automatically by your device, unless you have configured it in such a way that the transmission of the information is suppressed.

This personal data is processed for the purpose of ensuring the functionality and optimisation of our Services and ensuring the security of our information technology systems. These purposes are at the same time legitimate interests within the meaning of Art. 6(1)(f) GDPR; the processing therefore has a legal basis.

5.2 Use by or after registration

5.2.1 Registration

Beyond the purely informational use of our Services, you have the option of registering for our Services and using our entire offering. In doing so, we process in particular master data and contact data such as your name, your email address and your password. In addition, we automatically process connection data such as the date, device information and IP address. After registration, you have the option of using our Services in the free version and of adding paid premium versions and memberships. Our Services allow you to select various services and to access the content included in each. This use of our Services may require the processing of personal data and information in the manner described in this section 5.

Some processing steps may also take place at third-party providers. Data processing by third-party providers takes place under the terms of their respective applicable privacy policies. Data processing involving third-party providers may constitute processing on behalf of the controller within the meaning of Art. 28 GDPR. This is subject to strict legal requirements, which we comply with in the course of our contractual agreements with our processors.

Use during or after registration and login and the associated data processing operations may differ from purely informational use. The collection of this data linked to your profile takes place for the purpose of verifying your status and the related performance of our contractual obligations towards you. These are legitimate purposes under Art. 6(1)(b) GDPR. Should your consent be required for a processing operation, we will obtain it at the appropriate point (e.g. via the opt-in option in a consent banner when you first use our Service). If you have any further questions, we will be happy to assist you within the scope of your right of access under Art. 15(1) GDPR.

5.2.2 Setting up and using a user account

You can create a user account (hereinafter also “profile”) in our Services in order to use our Services and their functions. If you do so, the personal data you enter there is transmitted to us by your terminal device and stored in our information technology systems. Your IP address and the time of registration are also stored. When you log in to your profile, our Service stores tokens on your terminal device so that you remain logged in – even if you need to reload our Services in the meantime. By creating the profile, you can use the functions of our Services.

The processing operations associated with creating a profile serve the purpose of being able to attribute future usage operations and to access the entire offering of our Services. When ordering any products or booking services, the processing of your data also serves the performance of the contract and is therefore purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR.

The storage of the IP address and time of registration is necessary to ensure the security of our information technology systems. This also constitutes our legitimate interest, which is why the processing is also lawful under Art. 6(1)(f) GDPR.

The personal data you enter is stored until the time this data is deleted within your profile or, at the latest, until your profile with us is deleted in full. By way of exception, we process certain personal data of yours only where we have a statutory or contractual authorisation to do so. This is the case, for example, where we are permitted to retain contract or payment data even after your profile has been deleted, for billing or other reasons necessary for the proper handling of our contractual relationship.

5.2.3 Further information in the user account

After registering and logging in to our Services, you have the option of voluntarily providing further information about yourself and your personal data. This information concerns further master data, in particular uploading a profile picture, stating your date of birth or year of birth, stating your place of residence, stating personal interests or choosing a username that differs from your real name. We process this data in the course of completing your user account and, where applicable, for our community functions. The use of these functions is an essential part of our Services; the processing of your data therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR.

In order to use some or all of our Services, you must first log in, where this is required for use. We then create a user profile to which the specific information you have provided can be assigned. Various options are available to you for logging in. You can log in with your email address, use the single sign-on or social login procedure or, where offered by us, initially use guest access.

Google Firebase Authentication

We use Google Firebase Authentication to handle the login process. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. This data processing is necessary for the initiation and performance of the contract in accordance with the login procedure you have chosen. The legal basis for the data processing is therefore Art. 6(1)(b) GDPR.

If you log in with your email address, an individual ID is first generated for your device and stored together with your IP address and, in the case of an email login, with your email address and your password.

If you use the single sign-on or social login procedure, you can conveniently log in with your Google, Facebook, Spotify or Apple account. In this procedure, an individual ID is first generated for your device and stored together with your IP address. In the next step, your login name and password are transmitted to the third-party provider you have chosen. As a result, the third-party provider learns that you use our Services and can assign this information to your user profile there. After verification, we receive, together with your login name, a token confirming that you have an account with the respective third-party provider with the stated access data. In addition, the third-party providers transmit further basic information about your user profile there. We have no influence on whether and what information is transmitted to us. Further information is available from the respective third-party providers:

Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland:

https://policies.google.com/privacy?hl=de.

Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland:

https://www.apple.com/de/privacy/.

Meta Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland:

https://www.facebook.com/privacy/policy/.

5.3 Functions of our Services

Depending on registration, the functions of our Services listed below, among others, are available to you. We provide all of the functions listed below so that you can make full use of our services, depending on the model booked, and so that we can achieve the best result for you in our cooperation. We pass on the data you enter only to authorised third parties and process it to perform the contractual relationships entered into with you, in particular to perform the user agreement you concluded by using our Services. The legal basis for processing your data is therefore Art. 6(1)(b) GDPR.

Processing and summarising of teaching material (text, video and audio recordings)
Creation of study notes, practice exams and podcasts by AI software
Your own AI tutor that answers all your questions
Upload of self-created study materials

5.4 Chat and messaging system

In our Services, we give you the option of contacting other users, exchanging information with them and, where applicable, initiating and concluding contracts via integrated chat and messaging functions. The data categories processed are master data, contact data and, where applicable, content data, contract data and payment data. We transmit this data to the person you have contacted to the extent that you yourself release the data transmission or include this data in your messages yourself. In addition, we learn the time and the parties involved in any contact made via our chat and messaging functions. Furthermore, the personal data you provide is transmitted to us by your terminal device and stored in our information technology systems. Your IP address and the time of registration are also stored.

The processing operations associated with the use of our chat and messaging systems serve the purpose of being able to attribute usage operations and enable you to access the entire offering of our Services. The use of the chat and messaging functions is an essential part of our Services; the processing of your data therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR.

The storage of the IP address and the time of use of our chat and messaging functions is necessary to ensure the security of our information technology systems. This also constitutes our legitimate interest, which is why the processing is also lawful under Art. 6(1)(f) GDPR.

The personal data you enter is stored until your profile with us is deleted and, beyond that, only for as long as the processing is necessary for the performance of any contract. No disclosure of data to other third parties is intended.

5.5 Community function

With our Services, we give you the option of viewing and commenting on other users’ publications and of making contact with others publicly in this way. The data categories processed are master data, where applicable contact data and, where applicable, content data. We publish this data in our publicly accessible areas. Furthermore, the personal data you provide is transmitted to us by your terminal device and stored in our information technology systems. Your IP address and the time of registration are also stored.

The processing operations associated with the community function serve the purpose of enabling exchanges with others about our Services and their possible uses, and enable you to access the entire offering of our Services. The use of the community function is an essential part of our services; the processing of your data therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR.

The storage of the IP address and the time of use of our community function is necessary to ensure the security of our information technology systems. This also constitutes our legitimate interest, which is why the processing is also lawful under Art. 6(1)(f) GDPR.

The personal data you enter is stored until your profile with us is deleted and, beyond that, only for as long as the processing is necessary for the performance of any contract and to the extent technically possible. No disclosure of data to other third parties is intended.

6. Communication services

6.1 Contact form / contact by email

We process the personal data you provide to us when contacting us for the purpose of answering your enquiry, your email or your callback request. The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. In individual cases, we pass this data on to affiliated companies or to third parties that are permitted, by agreement, to process this data for the handling of orders and bookings. The legal basis for the processing depends on the purpose of the contact. By submitting your enquiry via the contact form or by contacting us by email, you declare that you would like answers or information on certain topics. For this purpose, you also provide your data. We answer your enquiry as requested and process your data for this purpose. The authorisation to process your data is therefore based on Art. 6(1)(b) GDPR, since we process it to answer your enquiry and thus to perform the contract relating to it.

6.2 Feedback form

We process the personal data you provide to us when giving feedback in order to act on the feedback, for example to improve our Services. The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. In individual cases, we pass this data on to affiliated companies or to third parties that we engage to improve our Services. The legal basis for the processing depends on the purpose of your feedback. By giving feedback, you declare that you would like, for example, an improvement to functions of our Services. We take up this information and process your data for this purpose. The authorisation to process your data is therefore based on Art. 6(1)(b) GDPR for the performance of the contract.

6.3 Applicant management

We process the personal data you provide to us in the course of the application process (e.g. via the corresponding contact/application form in our Services) for the purpose of processing your application and carrying out the application procedure. At your request, we will also consider your application in future application procedures. The data categories processed are master data, contact data, content data, usage data (not for applications by post), connection data (not for applications by post) and contract data. For unsuccessful applications, we delete your data within 3 months of the rejection. For successful applications, we transfer your data into our systems, for example into the personnel file. The legal basis for processing your data in the context of applicant management is Art. 6(1)(b) GDPR. The legal basis for applications to subsidiaries and for storage for future application procedures is Art. 6(1)(a) GDPR or Art. 6(1)(f) GDPR respectively.

6.4 Calendly

We use the scheduling tool Calendly in our Services to arrange appointments with you. Using the scheduling tool Calendly with its integrated online calendar, you can request and select an appointment for a consultation. “Calendly” is an offering of Calendly, LLC, 3423 Piedmont Road NE, Atlanta, GA 30305-1754, United States.

If you click the corresponding button in our Services or wish to arrange an appointment via a link sent by us (for instance in an email), you are automatically connected to our appointment account at Calendly. After choosing your appointment, confirming it and entering your contact details and request, you will receive an email from Calendly confirming your appointment. Further information on Calendly and data protection at Calendly can be found here: https://calendly.com/pages/privacy. If Calendly transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Calendly and in accordance with standard contractual clauses agreed with Calendly and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF).

Your information from the Calendly form, including the data you provide there, is stored by us for the purpose of processing your enquiry or a corresponding contractual relationship. Once your enquiry has been answered or the purpose has ceased to apply (e.g. the contractual relationship ends), we will delete your data promptly, subject to contractual or statutory retention options. If you would like your data to be deleted earlier, you can ask us to delete it or withdraw your consent to its storage. Mandatory statutory provisions – in particular retention periods – remain unaffected. Our legal basis for using the scheduling tool Calendly is Art. 6(1)(f) GDPR (legitimate interest), since Calendly allows us to fully automate appointment scheduling and thus make the process for appointment requests and meetings more efficient. Otherwise, the legal basis for data processing by means of Calendly is Art. 6(1)(b) GDPR, to the extent that the scheduling is carried out within the framework of our contractual relationships.

6.5 Zoom

We use the online communication tool “Zoom” to hold telephone conferences, online meetings, video conferences and/or webinars (hereinafter: “online meetings”). “Zoom” is a service of Zoom Video Communications, Inc., which is based in the USA. Various types of data are processed when using “Zoom”. The scope of the data also depends on the information you provide before or during participation in an “online meeting”. The relevant data categories are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If Zoom transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Zoom and in accordance with standard contractual clauses agreed with Zoom and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). As additional safeguards, we have also configured Zoom so that only data centres in the EU, the EEA or safe third countries such as Canada or Japan are used to hold “online meetings”. Our legal basis for using Zoom for online meetings is Art. 6(1)(a) GDPR (your consent). Before using Zoom for an online meeting between us, we will ask you for your corresponding consent. With Zoom, we aim to digitalise communication between us completely. A video conferencing tool such as Zoom is intended to allow us to gain a personal impression of each other in the online meeting, which is essential, among other things, for a relationship of trust under the contract, and so that we can make the entire communication process more efficient.

6.6 Microsoft Teams

We use the online communication tool “Teams” to hold telephone conferences, online meetings, video conferences and/or webinars (hereinafter: “online meetings”). “Teams” is a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Various types of data are processed when using “Teams”. The scope of the data also depends on the information you provide before or during participation in an “online meeting”. The relevant data categories are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If Teams transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Teams and in accordance with standard contractual clauses agreed with Teams and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). As additional safeguards, we have also configured Teams so that only data centres in the EU, the EEA or safe third countries such as Canada or Japan are used to hold “online meetings”. Our legal basis for using Teams for online meetings is Art. 6(1)(a) GDPR (your consent). Before using Teams for an online meeting between us, we will ask you for your corresponding consent. With Teams, we aim to digitalise communication between us completely. A video conferencing tool such as Teams is intended to allow us to gain a personal impression of each other in the online meeting, which is essential, among other things, for a relationship of trust under the contract, and so that we can make the entire communication process more efficient.

6.7 Google Meet

We use the online communication tool “Google Meet” to hold telephone conferences, online meetings, video conferences and/or webinars (hereinafter: “online meetings”). “Google Meet” is a service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Various types of data are processed when using “Google Meet”. The scope of the data also depends on the information you provide before or during participation in an “online meeting”. The relevant data categories are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If Google transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Google and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). As additional safeguards, we have also configured Google Meet so that only data centres in the EU, the EEA or safe third countries such as Canada or Japan are used to hold “online meetings”. Our legal basis for using Google Meet for online meetings is Art. 6(1)(a) GDPR (your consent). Before using Google Meet for an online meeting between us, we will ask you for your corresponding consent. With Google Meet, we aim to digitalise communication between us completely. A video conferencing tool such as Google Meet is intended to allow us to gain a personal impression of each other in the online meeting, which is essential, among other things, for a relationship of trust under the contract, and so that we can make the entire communication process more efficient.

6.8 AI services

The use of AI services involves certain risks:

Since the AI services we integrate are US companies, a transfer of data to the USA or possibly also to unsafe third countries must be assumed. Precise information about the location of their servers is not publicly disclosed. The AI services may remove or anonymise personal data contained in requests before it is used to improve the model. This information cannot be verified. There is always a certain risk that personal data will be collected and processed by the AI services in an unintended manner that is not covered by this privacy policy.

AI service: One AI

In our Services, we use the server services and AI services of One AI Inc. The recipient of the data is One AI Inc., 1390 Market Street Suite 200, San Francisco, CA 94102, United States. The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If One AI Inc. transfers this data to a third country (e.g. the USA), this takes place on the basis of a data processing agreement concluded with One AI Inc. and in accordance with standard contractual clauses agreed with One AI Inc. and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). In this respect, One AI Inc., with its services and their integration into our Services, enables us to offer the latter at state-of-the-art quality in the first place. With One AI Inc., in the course of the data processing for the provision of our main services, we can provide you with an intelligent system that processes all interactions in those parts of our Services in which One AI Inc. is integrated in the most efficient manner and the manner most useful to you. The purpose of this data processing is therefore the provision of such an advanced system, which enables us always to provide the best possible services for you. Your personal data is processed only to a very small extent. Particularly sensitive personal data is, where possible, not required at all. The legal ground for using One AI Inc. therefore lies in our legitimate interest. The legal basis thus follows from Art. 6(1)(f) GDPR. In providing our services or parts of our services, One AI Inc. serves as an essential basis for the corresponding processing of data, without which we cannot offer our services. The processing of your data by One AI Inc. therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR. The use of personal data for One AI Inc.’s own training purposes is excluded.

AI service: Google Gemini

In our Services, we use the server services and AI services of Google Gemini. The recipient of the data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If Google transfers this data to a third country (e.g. the USA), this takes place on the basis of a data processing agreement concluded with One AI Inc. and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). In this respect, Google, with its services and their integration into our Services, enables us to offer the latter at state-of-the-art quality in the first place. With Google Gemini, in the course of the data processing for the provision of our main services, we can provide you with an intelligent system that processes all interactions in those parts of our Services in which Google Gemini is integrated in the most efficient manner and the manner most useful to you. The purpose of this data processing is therefore the provision of such an advanced system, which enables us always to provide the best possible services for you. Your personal data is processed only to a very small extent. Particularly sensitive personal data is, where possible, not required at all. The legal ground for using Google Gemini therefore lies in our legitimate interest. The legal basis thus follows from Art. 6(1)(f) GDPR. In providing our services or parts of our services, Google Gemini serves as an essential basis for the corresponding processing of data, without which we cannot offer our services. The processing of your data by Google therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR. The use of personal data for Google’s own training purposes is excluded.

AI service: OpenAI

In our Services, we use the server services and AI services of OpenAI Ireland Ltd. The recipient of the data is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If OpenAI Ireland Ltd. transfers this data to a third country (e.g. the USA), this takes place on the basis of a data processing agreement concluded with OpenAI Ireland Ltd. and in accordance with standard contractual clauses agreed with OpenAI Ireland Ltd. and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). In this respect, OpenAI Ireland Ltd., with its services and their integration into our Services, enables us to offer the latter at state-of-the-art quality in the first place. With OpenAI Ireland Ltd., in the course of the data processing for the provision of our main services, we can provide you with an intelligent system that processes all interactions in those parts of our Services in which OpenAI Ireland Ltd. is integrated in the most efficient manner and the manner most useful to you. The purpose of this data processing is therefore the provision of such an advanced system, which enables us always to provide the best possible services for you. Your personal data is processed only to a very small extent. Particularly sensitive personal data is, where possible, not required at all. The legal ground for using OpenAI Ireland Ltd. therefore lies in our legitimate interest. The legal basis thus follows from Art. 6(1)(f) GDPR. In providing our services or parts of our services, OpenAI Ireland Ltd. serves as an essential basis for the corresponding processing of data, without which we cannot offer our services. The processing of your data by OpenAI Ireland Ltd. therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR. The use of personal data for OpenAI Ireland Ltd.’s own training purposes is excluded.

AI service: Botsonic

In our Services, we use the server services and AI services of Botsonic, Inc. The recipient of the data is Botsonic, Inc., 2261 Market Street #4608 San Francisco, CA 94114 USA. The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If Botsonic, Inc. transfers this data to a third country (e.g. the USA), this takes place on the basis of a data processing agreement concluded with Botsonic, Inc. and in accordance with standard contractual clauses agreed with Botsonic, Inc. and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). In this respect, Botsonic, Inc., with its services and their integration into our Services, enables us to offer the latter at state-of-the-art quality in the first place. With Botsonic, Inc., in the course of the data processing for the provision of our main services, we can provide you with an intelligent system that processes all interactions in those parts of our Services in which Botsonic, Inc. is integrated in the most efficient manner and the manner most useful to you. The purpose of this data processing is therefore the provision of such an advanced system, which enables us always to provide the best possible services for you. Your personal data is processed only to a very small extent. Particularly sensitive personal data is, where possible, not required at all. The legal ground for using Botsonic, Inc. therefore lies in our legitimate interest. The legal basis thus follows from Art. 6(1)(f) GDPR. In providing our services or parts of our services, Botsonic, Inc. serves as an essential basis for the corresponding processing of data, without which we cannot offer our services. The processing of your data by Botsonic, Inc. therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR. The use of personal data for Botsonic, Inc.’s own training purposes is excluded.

AI service: TimelinesAI

In our Services, we use the server services and AI services of Initech Software Services Ltd. The recipient of the data is Initech Software Services Ltd., Tuval 15, Ramat Gan, 5252230, Israel. The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. If Initech Software Services Ltd. transfers this data to a third country (e.g. the USA), this takes place on the basis of a data processing agreement concluded with Initech Software Services Ltd. and in accordance with standard contractual clauses agreed with Initech Software Services Ltd. and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). In this respect, Initech Software Services Ltd., with its services and their integration into our Services, enables us to offer the latter at state-of-the-art quality in the first place. With Initech Software Services Ltd., in the course of the data processing for the provision of our main services, we can provide you with an intelligent system that processes all interactions in those parts of our Services in which Initech Software Services Ltd. is integrated in the most efficient manner and the manner most useful to you. The purpose of this data processing is therefore the provision of such an advanced system, which enables us always to provide the best possible services for you. Your personal data is processed only to a very small extent. Particularly sensitive personal data is, where possible, not required at all. The legal ground for using Initech Software Services Ltd. therefore lies in our legitimate interest. The legal basis thus follows from Art. 6(1)(f) GDPR. In providing our services or parts of our services, Initech Software Services Ltd. serves as an essential basis for the corresponding processing of data, without which we cannot offer our services. The processing of your data by Initech Software Services Ltd. therefore serves the performance of the contract and is thus purpose-bound and necessary in accordance with Art. 6(1)(b) GDPR. The use of personal data for Initech Software Services Ltd.’s own training purposes is excluded.

6.9 Other communication tools

Studyquick chatbot via WhatsApp

For communication with you via our Studyquick chatbot, we use the instant messaging service “WhatsApp” of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2. In this context, personal data such as name, telephone number, email address, postal address and customer number, i.e. master data, contact data and usage data, is processed. WhatsApp generally accesses all contacts in your individual phone book. WhatsApp may pass on all data to other companies within and outside the Meta group of companies. Further information can be found in WhatsApp’s privacy policy at: https://www.whatsapp.com/legal/privacy-policy-eea. The legal basis for using WhatsApp is Art. 6(1)(a) GDPR. If you have not given us your consent to the use of WhatsApp (no opt-in in the cookie banner or withdrawal of your consent), we will not (or will no longer) use WhatsApp in communicating with you.

Zapier

We use Zapier to integrate various databases and web tools. Zapier is a service of Zapier Inc., 548 Market St #62411, San Francisco, California 94104, USA. The data categories processed are connection data, content data, contact data and usage data. If Zapier transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Zapier and in accordance with standard contractual clauses agreed with Zapier and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). We use Zapier to automate actions between different tools and thereby to improve our Services for you and make them more time-efficient, which at the same time constitutes our legitimate interest under Art. 6(1)(f) GDPR. Further information on data protection at Zapier: https://zapier.com/privacy/.

Typeform

We use the service “Typeform” in our Services to obtain feedback and in communication with prospective customers and customers. Typeform is questionnaire software that enables direct question-and-answer communication in real time. Typeform is provided by typeform SL, Carrer Bac de Roda, 163, local, 08018 – Barcelona (Spain). The data categories processed are master data, contact data, content data, where applicable usage data, connection data and, where applicable, contract data. The legal basis for processing this data with Typeform is Art. 6(1)(f) GDPR. It is in our legitimate interest to request information from you in a particularly user-friendly way and to use it for the further development of our Service. We delete the data collected as soon as it is no longer required for our purposes. Further information on data protection at Typeform and on your data subject rights can be found here: https://www.typeform.com/help/s/gdpr-8911258784660/.

6.2 Manychat & WhatsApp

For communication with you, in particular for the preparation, performance, arrangement, clarification or billing of ordering processes, we use the instant messaging service “WhatsApp” of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2. In this context, personal data such as name, telephone number, email address, postal address and customer number, i.e. master data, contact data and usage data, is processed. WhatsApp accesses all contacts in your individual phone book. WhatsApp may pass on all data to other companies within and outside the Meta group of companies. Further information can be found in WhatsApp’s privacy policy at: https://www.whatsapp.com/legal/privacy-policy-eea.

The WhatsApp service is provided via the service “Manychat”. Manychat is a service through which various communication services can be bundled and presented uniformly and in a legally compliant manner in communication with users of services. We use the Manychat service because it allows us to simplify and centralise communication with you and, in particular, to manage communication with you via WhatsApp in compliance with the GDPR. In addition, Manychat provides us with artificial intelligence services (“AI services”). These AI services enable us to conduct communication with you not directly from person to person, but via an integrated artificial intelligence that conducts the conversation with you on the basis of your input and information. In this context, personal data such as, in particular, name, telephone number, email address, postal address and customer number, as well as master data, contact data, content data and usage data, is processed. The recipient of data on the part of Manychat is Manychat Inc., 2301 W Anderson Ln., Austin, TX 78757, United States.

The legal basis for using WhatsApp and Manychat (both are always used together and never separately, as WhatsApp is integrated into Manychat) is Art. 6(1)(a) GDPR. If you have not given us your consent to their use (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use WhatsApp and Manychat in communicating with you.

7. Payment processing

We offer various payment methods for the settlement of payment claims. For this purpose, we integrate the payment service providers described below. We do so for the purpose of providing our services properly and as required. The data processed in this context is usage data, connection data, master data, payment data, contact data or contract data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, amount- and recipient-related information. This information is required to carry out the transactions. The data entered is processed only by the payment service providers and stored by them. We do not receive any account- or credit-card-related information, but only information confirming the payment or a negative report on it. Under certain circumstances, your data may be transmitted by the payment service providers to credit reference agencies. The purpose of this transmission is to verify identity and creditworthiness. In this regard, we refer to the terms and conditions and the privacy notices of the payment service providers. The legal basis for using the payment service providers is Art. 6(1)(b) GDPR. We can only provide the services promised to you with our Services, and thus fulfil our contractual obligations, if we use third parties, such as payment service providers, to handle payment transactions. If a payment service provider transfers data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with it and in accordance with standard contractual clauses agreed with it and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF).

Payment service providers

Digistore24

We use the payment service provider “Digistore24” to process bookings of your membership for our Services and for subscription management. The provider, and thus the recipient of data, is Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany. If you choose a payment method offered via the payment service provider Digistore24, the payment is processed via the technical service provider Digistore24, with which you handle your booking, payment and subscription management operations in full. Digistore24 processes these bookings under its own responsibility in accordance with its own privacy policy. For Digistore24’s privacy policy, see here: https://www.digistore24.com/page/privacy. After you have booked your membership and in the course of the ongoing management of your membership, Digistore24 may forward to us data about your booking necessary for this purpose, such as name, address, account number, bank sort code, possibly credit card number, invoice amount, currency and transaction number, and the term of the booking made and of the membership. The legal basis for integrating Digistore24 as a payment service provider is Art. 6(1)(b) GDPR, because Digistore24’s booking-processing and subscription-management services enable us to perform our contract with you.

Stripe

If you choose a payment method of the payment service provider Stripe, the payment is processed via the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to which we pass on the information you provided during the ordering process together with the information about your order (name, address, account number, bank sort code, possibly credit card number, invoice amount, currency and transaction number) in accordance with Art. 6(1)(b) GDPR. Further information on data protection at Stripe can be found at https://stripe.com/de/privacy#translation.

Stripe reserves the right to carry out a credit check on the basis of mathematical-statistical methods in order to safeguard its legitimate interest in determining the user’s ability to pay. Stripe may transmit the personal data necessary for a credit check and obtained in the course of payment processing to selected credit reference agencies, which Stripe will disclose to users on request. The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical method. The calculation of the score values includes, among other things, but not exclusively, address data. Stripe uses the result of the credit check with regard to the statistical probability of payment default for the purpose of deciding on authorisation to use the selected payment method.

You can object to this processing of your data at any time by sending a message to Stripe or to the credit reference agencies it has engaged.

However, Stripe may remain entitled to process your personal data where this is necessary for contractual payment processing.

8. Hosting

8.1 Provision of our Services

In order to provide our Services to you, we use the services of a hosting provider. Our Services are retrieved from the servers of this hosting provider. For these purposes, we use the hosting provider’s infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed includes all data that you enter in the course of your use and communication in connection with your visit to our Services, or that is collected from you in doing so (e.g. your IP address). Our legal basis for using a hosting provider to provide our Services is Art. 6(1)(f) GDPR (legitimate interest).

Cloudflare Pages

We host our website studyquick.ai with “Cloudflare Pages”. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare delivers the pages via its global server network and, in doing so, processes the data technically necessary for retrieval, in particular your IP address, as well as access data for protection against attacks. The website sets no cookies and does not load any content from third-party providers such as Google Fonts. Where Cloudflare transfers data to a third country (e.g. the USA), this takes place on the basis of a data processing agreement, the EU standard contractual clauses and the EU-US Data Privacy Framework (DPF), under which Cloudflare is certified. Our legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable provision of our website). Further details can be found in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.

8.2 Receiving and sending emails

The hosting services we use may also include sending, receiving and storing emails. For these purposes, the addresses of the recipients of your emails and the senders, as well as further information concerning the sending of emails (e.g. the providers involved) and the contents of the respective emails, are processed. The aforementioned data is processed, among other things, for the purpose of detecting spam. Emails are generally not sent encrypted on the internet. As a rule, emails are encrypted in transit, but (unless end-to-end encryption is used) not on the servers from which they are sent and received. We therefore cannot accept any responsibility for the transmission path of emails between the sender and receipt on our server. Our legal basis for using a hosting provider to receive and send emails is Art. 6(1)(f) GDPR (legitimate interest).

8.3 Collection of access data and log files

We ourselves (or our hosting provider) collect data on every access to the server (server log files). Server log files may include the address and name of the services and files accessed, the date and time of access, the volumes of data transferred, notification of successful access, device type and version, your operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

Server log files may be used, on the one hand, for security purposes, e.g. to avoid overloading the servers (in particular in the event of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilisation of the servers and their stability. Our legal basis for using a hosting provider to collect access data and log files is Art. 6(1)(f) GDPR (legitimate interest).

9. Tracking & tools

We use the following services in our web app, not on our website studyquick.ai.

To ensure smooth technical operation and optimal, user-friendly use of our Services, we use the following services:

Google Tag Manager

We use Google Tag Manager in our Services. Google Tag Manager is a solution that allows us to manage so-called website tags via an interface and thus integrate other services into our Services. Google Tag Manager itself (which implements the tags) does not create any profiles and does not set any cookies or other technologies on your terminal device. However, activating Google Tag Manager integrates further Google services, such as Google Analytics. The data processed when Google Tag Manager is integrated includes usage data & connection data. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. If Google transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Google and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using Google Tag Manager is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, where further services are integrated via Google Tag Manager, activating Google Tag Manager may cause cookies, so-called “beacons” or similar (text) files to be stored on your terminal device and personal data to be read out as a result. If you have not given us your consent to the use of Google Tag Manager (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use Google Tag Manager during your visits to our Services. With regard to the processing of personal data by the integrated services, please refer to our explanations of the individual Google services below. The provider of Google Tag Manager is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Website: https://marketingplatform.google.com; privacy policy: https://policies.google.com/privacy.

Google Search Console

For the purpose of continuously optimising the Google ranking of our Services, we use Google Search Console, a web analytics service from Google.

Google Search Console allows us to carry out search analyses that tell us how often our Services appear in Google search results. This allows us to monitor and manage our Services in the search index.

No personal user or tracking data is processed or transmitted to Google in the course of using Google Search Console.

Google Analytics

We use Google Analytics for the purpose of statistically evaluating your use of our Services. Your IP address is collected by us before it is anonymised by Google by truncation, before being permanently stored on its servers. Google Analytics enables us to understand how you use our Services and how we can improve and further develop them accordingly. For example, Google Analytics shows which content you click on or visit repeatedly. The data processed is usage data & connection data. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (as joint controller, Art. 26 GDPR). If Google transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Google and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using Google Analytics is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of Google Analytics (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use Google Analytics during your visits to our Services.

Google Ad Manager

We use the “Google Marketing Platform” (and services such as “Google Ad Manager”) to place advertisements in the Google advertising network (e.g. in search results, in videos, on websites, etc.). The Google Marketing Platform allows advertisements to be displayed in real time based on users’ presumed interests. This allows us to display advertisements in a more targeted manner so as to present you only with advertisements that match your potential interests. The data processed is usage data & connection data. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (as joint controller, Art. 26 GDPR). If Google transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Google and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using Google Ad Manager is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of Google Ad Manager (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use Google Ad Manager during your visits to our Services.

Google Ads Conversion Tracking

We use Google Ads Conversion Tracking for the purpose of measuring the success of our Google Ads advertising campaigns. First, advertisements are placed in the Google advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who are presumed to be interested in the advertisements. We then measure the conversion of the advertisements. As feedback, we learn only the anonymous total number of users who clicked on our advertisement and were redirected to a page bearing a so-called “conversion tracking tag”. We ourselves do not receive any information with which users can be identified. The data processed is usage data & connection data. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (as joint controller, Art. 26 GDPR). If Google transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Google and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using Google Ads Conversion Tracking is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of Google Ads Conversion Tracking (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use Google Ads Conversion Tracking during your visits to our Services.

ReCaptcha

We integrate the “ReCaptcha” function into our Services to detect bots, e.g. when data is entered in online forms. ReCaptcha evaluates your behaviour (e.g. mouse movements or queries) in order to distinguish humans from bots. The data processed is usage data & connection data. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (as joint controller, Art. 26 GDPR). If Google transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Google and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using ReCaptcha is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of ReCaptcha (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use ReCaptcha during your visits to our Services, or will no longer be able to make our online forms properly available to you.

Mixpanel

We use Mixpanel for the purpose of statistically evaluating your use of our Services. Mixpanel creates pseudonymised user profiles of your usage behaviour in our Services and tracks the corresponding movements and actions you carry out in our Services. The data processed is usage data & connection data. The recipient of the data is Mixpanel Inc., 405 Howard St., Flr 2, San Francisco, CA 94105, USA (as joint controller, Art. 26 GDPR). The data is transferred to the USA on the basis of a data processing agreement concluded with Mixpanel and in accordance with standard contractual clauses agreed with Mixpanel and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using Mixpanel is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of Mixpanel (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use Mixpanel during your visits to our Services.

Meta (formerly Facebook) Facebook Custom Audiences (“Meta Pixel”)

We use Facebook Custom Audiences (“Meta Pixel”) for the purpose of displaying personalised advertisements in the Facebook advertising network (Facebook Ads) on the basis of your browsing behaviour, recorded in pseudonymised form. We use the Meta Pixel for remarketing purposes in order to be able to address you again within 180 days on the social network “Facebook” or “Instagram”. Owing to the Meta Pixel used, your terminal device automatically establishes a direct connection with Meta’s server. Through the integration of the Meta Pixel, Meta receives the information that you have accessed our Services or clicked on one of our advertisements. If you are registered with Facebook or Instagram, Meta can assign the visit to your account. In addition to the IP address and the marketing identifier, Meta also receives information about the terminal device you use and the time, and can assign this data to your Facebook and Instagram account. Meta processes this data under its own responsibility. We have no influence on the data collection and further processing by Meta. The data processed is usage data & connection data. The recipient of the data is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (as joint controller, Art. 26 GDPR). If Meta transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Meta and in accordance with standard contractual clauses agreed with Meta and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using the Meta Pixel is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of the Meta Pixel (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use the Meta Pixel during your visits to our Services.

Hotjar

We use Hotjar for the purpose of analysing your browsing and click behaviour in our Services, creating so-called “heatmaps” on the basis of this analysis, and optimising our Services and designing them to meet requirements. The data processed is usage data & connection data. The recipient of the data is Hotjar Ltd., Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta. The data is not transferred to a third country outside the EU.

The legal basis for using Hotjar is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of Hotjar (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use Hotjar during your visits to our Services.

10. Newsletters & transactional emails

With your consent (usually by subscribing), we send newsletters, emails and other electronic notifications (hereinafter “newsletters”). Our newsletters generally contain technical, commercial and promotional information about our services.

To subscribe to our newsletter, it is generally sufficient for you to provide your email address.

Subscription to our newsletter always takes place using a so-called double opt-in procedure. After subscribing to our newsletter, you will therefore receive an email in which you are asked to confirm your subscription by clicking a confirmation link. This confirmation is necessary to prevent someone else from subscribing to a newsletter with your email address. We log newsletter subscriptions in order to be able to prove the subscription process in accordance with the legal requirements. For this purpose, we store the time of subscription and confirmation as well as your IP address. Changes to your data stored with the mailing service provider are also logged.

You can unsubscribe from our newsletter at any time. To do so, simply click the “Unsubscribe” button contained in the footer of every newsletter. If you unsubscribe from our newsletter, your email address may be stored for up to three years on the basis of our legitimate interests before we delete it, so that we can prove the consent you previously gave.

Where we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure mailing system.

Our newsletters may contain a so-called “web beacon”. A web beacon is a pixel-sized file that is retrieved from our server (or, where a mailing service provider is used, from its server) when the newsletter is opened. In the course of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is first collected.

This information is used for the technical improvement of our newsletter on the basis of the technical data, or of the target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times. This analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our aim nor, where one is used, that of the mailing service provider to monitor individual users. Rather, the evaluations serve to help us recognise the reading habits of our users and to adapt our content to them or to send different content according to our users’ interests.

The evaluation of the newsletter and the measurement of its success take place, subject to the express consent of users, on the basis of our legitimate interests for the purposes of using a user-friendly and secure newsletter system that both serves our business interests and meets users’ expectations.

The legal basis for sending newsletters, and thus also for using web beacons, is your consent, where you have given it to us by subscribing to the newsletter, and therefore follows from Art. 6(1)(a) GDPR. If you have not given us your consent to the sending of newsletters, we will not (or will no longer) send you newsletters. This also automatically ends the use of web beacons.

Klaviyo

We use the services of Klaviyo to send newsletters and transactional emails. Klaviyo is a service with which, among other things, the sending of newsletters can be organised and analysed. When you enter data for the purpose of receiving the newsletter or in the course of your registration (e.g. email address), it is stored on Klaviyo’s servers in the USA. With the help of Klaviyo, we can analyse our emails. When you open an email sent with Klaviyo, a file contained in the email (a so-called web beacon) connects to Klaviyo’s servers in the USA. This makes it possible to determine whether an email has been opened and which links, if any, have been clicked. Technical information is also recorded (e.g. time of retrieval, IP address, browser type and operating system). This information cannot be assigned to the respective email recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better tailor future newsletters to the interests of recipients. If you do not want any analysis by Klaviyo in connection with receiving the newsletter, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. You can also unsubscribe from the newsletter directly in our Services. The data you have provided to us for the purpose of receiving the newsletter is stored by us until you unsubscribe from the newsletter and, after you unsubscribe, is deleted both from our servers and from Klaviyo’s servers. Data stored by us for other purposes (e.g. email addresses for the members’ area) remains unaffected. The provider of Klaviyo, and thus the recipient of the data, is Klaviyo, 125 Summer Street, Boston, MA 02110, USA. Your personal data is transferred to a third country such as the USA only in individual cases, on the basis of a data processing agreement concluded with Klaviyo, in accordance with standard contractual clauses agreed with Klaviyo and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The data processed in the course of sending the newsletter is processed on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time, for example via the “Unsubscribe” link in the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal. Your data is processed in the course of sending transactional emails on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. We have a legitimate interest in using a third-party system to structure our communication. This allows us to make our communication for contractual purposes more efficient and consistent. Further information on the protection of your data can be found in Klaviyo’s privacy policy at: https://www.klaviyo.com/legal/privacy-policy.

We maintain fan pages on the websites of social networks on the internet and, in this context, process personal data in order to communicate with the users active there or to offer information about ourselves. Please note that your data may be processed outside the territory of the European Union when you visit our fan pages. The operators of the respective social networks are responsible for this. A detailed description of the respective forms of processing and the options for objecting (e.g. opt-out) can be found in the privacy policies of the operators of the respective social networks.

Facebook

We operate a so-called Facebook fan page for our company on Facebook. When you visit the Facebook fan page, Facebook can evaluate your usage behaviour and share the information obtained from it with us (“Insights”). Page Insights are used for the purposes of the commercial optimisation of our Services and designing them to meet requirements. The data categories processed are, where applicable, master data, where applicable contact data, content data, usage data and connection data. The recipient of the data is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

Facebook is responsible for giving effect to your data subject rights. Facebook provides information about your data subject rights at: https://www.facebook.com/legal/terms/information_about_page_insights_data. You can also assert your rights against us; we will then forward your request to Facebook without delay.

Instagram

We operate a so-called Instagram fan page for our company on Instagram. When you visit the Instagram fan page, Meta can evaluate your usage behaviour and share the information obtained from it with us (“Insights”). Page Insights are used for the purposes of the commercial optimisation of our web presence/our Services and designing them to meet requirements. The data categories processed are, where applicable, master data, where applicable contact data, content data, usage data and connection data. The recipient of the data is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

Meta is responsible for giving effect to your data subject rights. Meta provides information about your data subject rights at: https://privacycenter.instagram.com/policy. You can also assert your rights against us; we will then forward your request to Meta without delay.

TikTok

We operate a so-called TikTok fan page for our company on TikTok. When you visit the TikTok fan page, TikTok can evaluate your usage behaviour and share the information obtained from it with us. The information is used for the purposes of the commercial optimisation of our web presence/our Services and designing them to meet requirements. The data categories processed are, where applicable, master data, where applicable contact data, content data, usage data and connection data. The recipient of the data is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin D02 T380, Ireland, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

TikTok is responsible for giving effect to your data subject rights. TikTok provides information about your data subject rights at: https://www.tiktok.com/legal/privacy-policy?lang=de-DE. You can also assert your rights against us; we will then forward your request to TikTok without delay.

LinkedIn

We operate a LinkedIn fan page for our company on LinkedIn. When you visit and use the LinkedIn fan page, LinkedIn can evaluate your usage behaviour and share the information obtained from it with us. This information is used for the purposes of the commercial optimisation of our web presence/our Services and designing them to meet requirements. The data categories processed are master data, contact data, content data, usage data and connection data. The recipient of the data is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

LinkedIn is responsible for giving effect to your data subject rights. LinkedIn provides information about your data subject rights at: https://de.linkedin.com/legal/privacy-policy. You can also assert your rights against us; we will then forward your request to LinkedIn without delay.

We operate an X fan page for our company on X. When you visit and use our X fan page, X can evaluate your usage behaviour and share the information obtained from it with us. This information is used for the purposes of the commercial optimisation of our web presence and designing it to meet requirements. The data categories processed are master data, contact data, content data, usage data and connection data. The recipient of the data is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

X is responsible for giving effect to your data subject rights. X provides information about your data subject rights at: www.twitter.com/de/privacy. You can also assert your rights against us; we will then forward your request to X without delay.

Xing

Xing is responsible for giving effect to your data subject rights. Xing provides information about your data subject rights at: https://privacy.xing.com/de/datenschutzerklaerung. You can also assert your rights against us; we will then forward your request to Xing without delay.

YouTube

We operate a channel for our company on YouTube. When you visit and use our YouTube channel, Google can evaluate your usage behaviour and share the information obtained from it with us. This information is used for the purposes of the commercial optimisation of our web presence and designing it to meet requirements. The data categories processed are master data, contact data, content data, usage data and connection data. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

YouTube is responsible for giving effect to your data subject rights. YouTube provides information about your data subject rights at: https://www.youtube.com/howyoutubeworks/our-commitments/protecting-user-data/#privacy-guidelines. You can also assert your rights against us; we will then forward your request to YouTube without delay.

Vimeo

We operate a channel for our company on Vimeo. When you visit and use our Vimeo channel, Vimeo can evaluate your usage behaviour and share the information obtained from it with us. This information is used for the purposes of the commercial optimisation of our web presence and designing it to meet requirements. The data categories processed are master data, contact data, content data, usage data and connection data. The recipient of the data is Vimeo.com, Inc., 555 West 18th Street, New York, New York 10011, USA, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

Vimeo is responsible for giving effect to your data subject rights. Vimeo provides information about your data subject rights at: https://vimeo.com/privacy. You can also assert your rights against us; we will then forward your request to Vimeo without delay.

Snapchat

We operate a so-called Snapchat fan page for our company on Snapchat. When you visit and use the Snapchat fan page, Snapchat can evaluate your usage behaviour and share the information obtained from it with us. This information is used for the purposes of the commercial optimisation of our web presence/our Services and designing them to meet requirements. The data categories processed are master data, contact data, content data, usage data and connection data. The recipient of the data is Snap Group Limited, 50 Cowcross Street, Floor 2, London, EC1M 6AL, United Kingdom, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

Snap Inc. is responsible for giving effect to your data subject rights. Snapchat provides information about your data subject rights at: https://values.snap.com/de-DE/privacy/privacy-policy. You can also assert your rights against us; we will then forward your request to Snapchat without delay.

Pinterest

We operate a so-called Pinterest fan page for our company on Pinterest. When you visit the Pinterest fan page, Pinterest can evaluate your usage behaviour and share the information obtained from it with us (“Insights”). Page Insights are used for the purposes of the commercial optimisation of our web presence/our Services and designing them to meet requirements. The data categories processed are, where applicable, master data, where applicable contact data, content data, usage data and connection data. The recipient of the data is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

Pinterest is responsible for giving effect to your data subject rights. Pinterest provides information about your data subject rights at: https://policy.pinterest.com/de/privacy-policy. You can also assert your rights against us; we will then forward your request to Pinterest without delay.

Discord

We operate a so-called Discord fan page for our company on Discord. When you visit the Discord fan page, Discord can evaluate your usage behaviour and share the information obtained from it with us (“Insights”). Page Insights are used for the purposes of the commercial optimisation of our Services and designing them to meet requirements. The data categories processed are, where applicable, master data, where applicable contact data, content data, usage data and connection data. The recipient of the data is Discord Netherlands B.V., Schiphol Boulevard 195, 1118BG Schiphol, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

Discord is responsible for giving effect to your data subject rights. Discord provides information about your data subject rights at: https://discord.com/privacy. You can also assert your rights against us; we will then forward your request to Discord without delay.

Jodel

We operate a so-called Jodel fan page for our company on Jodel. When you visit the Jodel fan page, Jodel can evaluate your usage behaviour and share the information obtained from it with us. The information is used for the purposes of the commercial optimisation of our web presence/our Services and designing them to meet requirements. The data categories processed are, where applicable, master data, where applicable contact data, content data, usage data and connection data. The recipient of the data is Jodel Venture GmbH, Wilhelmstraße 118, 10963 Berlin, as joint controller pursuant to Art. 26 GDPR. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR.

Jodel is responsible for giving effect to your data subject rights. Jodel provides information about your data subject rights at: https://jodel.com/de/privacy/. You can also assert your rights against us; we will then forward your request to Jodel without delay.

12. Plug-ins in our Services

In our Services, we integrate content such as videos, buttons, social media icons etc. from social networks and other websites via plug-ins. The integration always works in such a way that the social networks learn and process your IP address via these plug-ins. The IP address is required to display the content of the plug-ins, since it is needed so that the social networks whose plug-ins we have integrated can send information to your browser. Some social networks use pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic in our Services. Further information may also be stored in cookies on your device and may contain, among other things, technical information about your browser and your operating system, the time of your visit to our Services and further details on the use of our Services, and may be linked to information from other sources.

Integration of YouTube videos

We use YouTube for the purpose of embedding videos via YouTube’s video plug-in in order to personalise the design of our Services. By embedding videos via YouTube’s video plug-in, Google can analyse your usage behaviour in our Services. The data categories processed are usage data and connection data. The recipient of the data is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. If Google transfers this data to a third country (e.g. the USA), this takes place only in individual cases, on the basis of a data processing agreement concluded with Google and in accordance with standard contractual clauses agreed with Google and other safeguards permitted by the GDPR which ensure the security of the processing of your personal data with a level of protection identical to that in the EU, in particular on the basis of the EU-US Data Privacy Framework (DPF). The legal basis for using YouTube is your consent (e.g. via an opt-in in the consent banner), where you have given it to us during your visit to our Services, and therefore follows from Art. 6(1)(a) GDPR. On the basis of your consent, cookies, so-called “beacons” or similar (text) files are stored on your terminal device and personal data is read out as a result. If you have not given us your consent to the use of YouTube (no opt-in in the consent banner or withdrawal of your consent), we will not (or will no longer) use YouTube during your visits to our Services.

In our Services, we offer you the option of sharing generated images directly on your own profiles in various social networks. Sharing always works in such a way that, when you click “Share”, the social networks learn and process your IP address via the corresponding plug-ins. The social networks thus learn immediately that you were previously in our Services. Some social networks use pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic in our Services. You can give or refuse the corresponding consent to the social networks as part of the “Share” function. Further information may also be stored in cookies on your device and may contain, among other things, technical information about your browser and your operating system, the time of your visit to our Services and further details on the use of our Services, and may be linked to information from other sources. The data categories processed are master data, contact data, content data, usage data and connection data. The recipients of the data are the respective operators of the social networks. The legal basis for processing the data as described here is our legitimate interest and thus Art. 6(1)(f) GDPR. The operators of the social networks are responsible for giving effect to your data subject rights. Please inform yourself about your rights with each of them.

We have built corresponding “Share” links into our Services for the following social networks.

Facebook: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Facebook is responsible for giving effect to your data subject rights. Facebook provides information about your data subject rights at: https://www.facebook.com/legal/terms/information_about_page_insights_data.

Instagram: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Meta is responsible for giving effect to your data subject rights. Meta provides information about your data subject rights at: https://privacycenter.instagram.com/policy.

TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin D02 T380, Ireland. TikTok is responsible for giving effect to your data subject rights. TikTok provides information about your data subject rights at: https://www.tiktok.com/legal/privacy-policy?lang=de-DE.

LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is responsible for giving effect to your data subject rights. LinkedIn provides information about your data subject rights at: https://de.linkedin.com/legal/privacy-policy.

X: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland. X is responsible for giving effect to your data subject rights. X provides information about your data subject rights at: www.twitter.com/de/privacy.

Pinterest: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Pinterest is responsible for giving effect to your data subject rights. Pinterest provides information about your data subject rights at: https://policy.pinterest.com/de/privacy-policy.

YouTube: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google is responsible for giving effect to your data subject rights. Google provides information about your data subject rights at: https://www.youtube.com/howyoutubeworks/our-commitments/protecting-user-data/#privacy-guidelines.

WhatsApp: WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2. WhatsApp is responsible for giving effect to your data subject rights. WhatsApp provides information about your data subject rights at: https://www.whatsapp.com/legal/privacy-policy-eea.

Snapchat

Snap Group Limited, 50 Cowcross Street, Floor 2, London, EC1M 6AL, United Kingdom. Snap is responsible for giving effect to data subject rights. Snap provides information about your data subject rights at: https://values.snap.com/de-DE/privacy/privacy-policy.

14. Affiliate programme

To increase awareness of our Services, we use our own referral marketing (“affiliate marketing”). For this purpose, we create so-called “affiliate links” or “tracking links” for users who are already registered, which they share with their contacts, and for each user successfully referred they receive consideration from us in the form of a commission, discount, voucher or similar. When the corresponding tracking link is clicked, we can trace which user referred whom. For this purpose, we set cookies. The setting of such a cookie serves the attribution of transactions under the “data light” approach, but not the creation of user profiles in order to track users for advertising purposes. To implement our affiliate marketing, we use the platform “Affiliatefinder”. Affiliatefinder is offered by Sourced Digital Ltd., 8 High Street, Brentwood, Essex, CM14 4AB, United Kingdom. The setting and reading of cookies to operate affiliate marketing and the use of Affiliatefinder take place on the basis of a legitimate interest and are therefore lawful pursuant to Art. 6(1)(f) GDPR. The recipients of personal data processed in this way are we and Affiliatefinder. The data processed is master data, contract data, usage data and connection data. We regularly provide our users with statistical and anonymised evaluations of how many users have used our paid Services via their tracking link. This information enables us to determine whether, and in what amount, we pay a commission to users of our affiliate programme. This commission is paid on the basis of the paid use of Services by the referred user. We are responsible for the manner in which users’ personal data is processed when they click on affiliate or tracking links, so this privacy policy applies. Our authorisation to integrate affiliate and tracking links into our Services derives from Art. 6(1)(f) GDPR. Receiving a commission for referring customers is part of our business model and is therefore necessary for the performance of the contract with you.

With kind support from derstartupanwalt.de

1. General

2. General information on data processing

2.1 Processing of personal data

2.2 Legal bases for the processing of your personal data

2.3 These are the categories of data we process

2.4 These are the security measures we take

2.5 How we transmit or disclose personal data to third parties

2.6 How transfers to third countries take place

2.7 Erasure of data

2.8 Storage of and access to data on your terminal device

2.9 Access permissions and device settings

2.9.1 Full functionality of our Services

2.9.2 Security requirements

2.10 Processing on behalf of the controller

3. Data subject rights

3.1 Right of access

3.2 Right to rectification

3.3 Right to restriction of processing

3.4 Right to erasure

3.5 Right to notification

3.6 Right to data portability

3.7 Right to object

3.8 Right to withdraw consent under data protection law

3.9 Right to lodge a complaint with a supervisory authority

3.10 Automated individual decision-making, including profiling

3.11 Notification obligations of the Controller

4. Information on the cookies and other technologies used

4.1 How we use cookies and other technologies

4.2 Storage period of cookies and other technologies

4.3 Types of cookies and other technologies

4.4 Consent management

5. Data processing in connection with the use of our Services

5.1 Informational use of our Services

5.2 Use by or after registration

5.2.1 Registration

5.2.2 Setting up and using a user account

5.2.3 Further information in the user account

5.2.4 Sign-on, single sign-on and social login

5.3 Functions of our Services

5.4 Chat and messaging system

5.5 Community function

6. Communication services

6.1 Contact form / contact by email

6.2 Feedback form

6.3 Applicant management

6.4 Calendly

6.5 Zoom

6.6 Microsoft Teams

6.7 Google Meet

6.8 AI services

6.9 Other communication tools

6.2 Manychat & WhatsApp

7. Payment processing

8. Hosting

8.1 Provision of our Services

8.2 Receiving and sending emails

8.3 Collection of access data and log files

9. Tracking & tools

10. Newsletters & transactional emails

11. Fan pages on social media websites

12. Plug-ins in our Services

13. Share function in our Services

14. Affiliate programme