Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

ProxDeal GmbH, represented by its managing directors Stefan Rummer and Simon Seibold
Westenriederstr. 10, 80331 Munich, Germany
Email: datenschutz@proxdeal.com

2. Scope

This privacy policy applies to the website of ProxDeal GmbH available at proxdeal.com and to all contact options, forms and the newsletter service offered via this website. It informs you about which personal data we collect, for what purposes and on what legal basis we process it, and what rights you have.

3. General information on data processing

3.1 Legal bases

We always process personal data in compliance with the GDPR. Depending on the purpose of the processing, we rely on the following legal bases: the consent of the data subject (Art. 6(1)(a) GDPR), the performance of a contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR) or the pursuit of legitimate interests, unless these are overridden by the interests or fundamental rights of the data subject (Art. 6(1)(f) GDPR). The applicable legal basis is stated in the context of each specific processing operation.

3.2 Storage period

As a rule, we store personal data only for as long as is necessary for the respective purpose of the processing. As soon as that purpose no longer applies, the data is deleted unless statutory retention obligations prevent this. In particular, retention obligations under commercial law (up to six years under § 257 of the German Commercial Code, HGB) and tax law (up to ten years under § 147 of the German Fiscal Code, AO) may require longer storage. In such cases, processing is restricted to mere storage; the data is no longer actively used.

3.3 SSL/TLS encryption

Our website uses SSL or TLS encryption. This protects data that you transmit via the website from access by third parties. You can recognise an encrypted connection by the address bar beginning with https:// and the padlock icon in your browser.

3.4 No automated decision-making

We do not use automated decision-making, including profiling within the meaning of Art. 22 GDPR, that produces legal effects concerning you or similarly significantly affects you.

3.5 Use of analytics tools

This website uses Google Analytics as an analytics tool in order to understand how visitors use the site and to improve our services. It is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Without your consent, no such data processing takes place.

4. Your rights as a data subject

Under the GDPR, you have the following rights in relation to us:

• Right of access (Art. 15 GDPR): You may request information about the personal data we hold about you, its origin, its recipients and the purpose of the processing.
• Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate data or the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You may request the erasure of your data, provided that no statutory retention obligations or other legal grounds for the processing preclude this.
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you may request the restriction of the processing of your data.
• Right to data portability (Art. 20 GDPR): You may request that we provide you with the data concerning you in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR. Where your data is processed for direct marketing purposes, you have the right to object without having to give reasons relating to your particular situation.
• Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent you have given at any time with effect for the future. The lawfulness of the processing carried out before the withdrawal remains unaffected.

To exercise your rights, it is sufficient to send an informal message by email to datenschutz@proxdeal.com.

4.1 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht – BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

5. Hosting and server log files

5.1 Server log files

Each time you access our website, your browser automatically transmits information to our server (so-called server log files). This comprises: the page accessed (URL), the date and time of the request, the amount of data transferred, the browser type and version, the operating system, the referrer URL (the previously visited page), the IP address of the accessing computer and the requesting provider.

This data is processed exclusively to ensure the trouble-free operation of the website, to safeguard IT security, to prevent misuse and for the technical optimisation of the server infrastructure. This data is not combined with other data sources, nor is it analysed in relation to individual persons. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing and securing the website. Server log files are automatically deleted after 30 days at the latest, unless storage beyond the regular retention period is required to investigate specific cases of misuse.

The website is hosted on our own infrastructure; to that extent, no external processor is involved.

6. Externally loaded fonts (Google Fonts)

To ensure that fonts are displayed consistently, this website uses external fonts (Google Fonts) that are loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you access our website, the required fonts are loaded automatically. In the process, your IP address in particular is transmitted to Google.

Google Fonts are used in the interest of a consistent and appealing presentation of our online services. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

In the course of this use, personal data may be transferred to servers of Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework, which means that an adequate level of data protection is ensured on the basis of the European Commission’s adequacy decision of 10 July 2023.

Further information: policies.google.com/privacy

7. Cookies and consent management

A detailed overview of the cookies used, including information on their purpose, storage period and provider, can be found in the cookie declaration provided via our cookie consent tool.

7.1 Cookie consent tool (Cookiebot)

This website uses the cookie consent tool Cookiebot provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot automatically detects and categorises the cookies and tracking technologies used on the website and obtains your consent before any non-essential services are loaded. The consent data collected by Cookiebot (consent status, timestamp, anonymised identifier) is stored as proof of the consent given. Cookiebot is used on the basis of Art. 6(1)(c) GDPR (compliance with legal obligations to document consent) and Art. 6(1)(f) GDPR (legitimate interest in operating the website in compliance with the law). Cookiebot sets its own technically necessary cookie (CookieConsent) to store your consent decision. This cookie does not require separate consent pursuant to § 25(2) TDDDG. Usercentrics A/S processes data as a processor on our behalf; a data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded. Further information: cookiebot.com/en/privacy-policy.

7.2 Technically necessary cookies

The website uses technically necessary cookies that are strictly required for the proper operation of the website (e.g. session cookies, the Cookiebot consent cookie). These cookies are used on the basis of § 25(2) TDDDG and do not require separate consent.

7.3 Cookies and services requiring consent

Where cookies or services requiring consent are used, they are only activated after you have given your consent via the Cookiebot banner. Where analytics cookies are used, they are activated exclusively after you have given your consent via the cookie consent tool.

8. Contact forms (Tally)

On our website, we use forms provided by the Tally service (Tally NV, Belgium). These forms are used for contact enquiries, requests for product demonstrations and onboarding. The data submitted via the form usually comprises: name, email address, company and your message.

Once the form has been submitted, Tally transmits the data to our self-hosted automation platform n8n. n8n is operated exclusively on our own infrastructure; n8n does not transfer any data to third parties. From there, the data is automatically transferred to our CRM system Pipedrive (Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia) in order to process your enquiry and manage the business relationship.

The legal basis for the processing is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in processing enquiries). Insofar as you voluntarily provide additional information in the form that goes beyond the mandatory fields required to process your enquiry, this information is processed on the basis of your consent (Art. 6(1)(a) GDPR). Tally and Pipedrive each act as processors; corresponding DPAs pursuant to Art. 28 GDPR have been concluded. Both providers have their registered offices within the EU or the EEA. Your data will be deleted as soon as the purpose of storage no longer applies, you ask us to delete it or you withdraw any consent you have given, unless statutory retention obligations prevent this.

9. Newsletter (Brevo)

We offer a newsletter to keep you informed about our company and our services. The newsletter is sent via the Brevo service (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany).

We use a double opt-in procedure for sign-up: after you enter your email address, you will receive a confirmation email containing an activation link. You will only be added to the newsletter mailing list once you have clicked this link. When you sign up, we store your email address, the time of sign-up and your IP address. The IP address is stored solely as proof of the consent given (Art. 7(1) GDPR).

The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR). Brevo processes your data as a processor on our behalf; a DPA pursuant to Art. 28 GDPR has been concluded. Brevo has its registered office in Germany and generally processes data within the EU. Where data is transferred to third countries in individual cases, this takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR. Brevo records email opens and link clicks for statistical purposes. You can withdraw your consent at any time with effect for the future by using the unsubscribe link included in every newsletter or by sending an email to datenschutz@proxdeal.com. Once you unsubscribe, your data will be deleted from the mailing list without undue delay. Further information: brevo.com/legal/privacypolicy.

10. Web analytics (Google Analytics)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to analyse the behaviour of visitors to our website and to continuously improve our services. In particular, the following data is processed: pages visited, time spent on the site, interactions (e.g. clicks), technical information about the device used and the IP address in truncated form.

Google Analytics is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent is obtained via our cookie consent tool. Without your consent, no processing by Google Analytics takes place.

Google Analytics uses cookies that enable your use of the website to be analysed. The information generated by these cookies about your use of this website is usually transmitted to and processed on Google servers. This may also involve a transfer to servers of Google LLC in the USA.

Google is certified under the EU-U.S. Data Privacy Framework, which means that an adequate level of data protection is ensured on the basis of the European Commission’s adequacy decision. In addition, we have concluded a data processing agreement (Art. 28 GDPR) with Google.

IP anonymisation is enabled by default in Google Analytics 4, so your IP address is truncated within the European Union or the European Economic Area before it is transmitted.

We do not use the data collected by Google to personally identify individual users.

You can withdraw your consent at any time via the cookie settings on our website.

Further information: policies.google.com/privacy

11. Direct marketing by post

We process business contact data (name, company name, business address) for the purpose of direct marketing by post. The address data used is obtained exclusively from publicly accessible sources, in particular the commercial register (Handelsregister), company websites and website imprints (legal notices). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in acquiring new customers. Pursuant to Art. 21(2) GDPR, you have the right to object at any time to the processing of your data for direct marketing purposes. If you object, your data will be removed from our marketing mailing list without undue delay. You can object informally by email to datenschutz@proxdeal.com.

12. Email communication (Microsoft 365)

We use Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) for email communication and internal collaboration. If you contact us by email, your personal data (e.g. name, email address, content of your communication) is processed via Microsoft’s servers.

The legal basis is Art. 6(1)(b) GDPR insofar as the communication serves the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in an efficient and reliable communication infrastructure). A DPA pursuant to Art. 28 GDPR has been concluded with Microsoft. Microsoft is certified under the EU-U.S. Data Privacy Framework (DPF), which means that an adequate level of data protection for data transfers to the USA is ensured on the basis of the European Commission’s adequacy decision of 10 July 2023. In addition, the European Commission’s standard contractual clauses pursuant to Implementing Decision (EU) 2021/914 have been agreed. In the course of providing its services, Microsoft may also access data from third countries; such access is secured by the aforementioned safeguards.

13. Overview of processors and third-country transfers

Data processing agreements pursuant to Art. 28 GDPR have been concluded with all of the processors listed above. Website hosting and the n8n automation platform are operated exclusively on our own infrastructure and are not external processors.

14. Changes to this privacy policy

We reserve the right to amend this privacy policy where necessary, in particular to adapt it to changes in the law, to new or modified services or to changes in our data processing procedures. The current version is always available at proxdeal.com/en/legal/privacy. In the event of material changes affecting your rights, we will inform you in advance where possible.