PRIVACY POLICY
1. Controller
adpeak GmbH, Paderborner Str. 13, 33415 Verl, Germany. Email: privacy@adpeak.com.
2. General information
We process personal data only where a legal basis under Art. 6 GDPR applies. Personal data is any information relating to an identified or identifiable natural person.
We delete personal data once the purpose ceases to apply, unless statutory retention periods require otherwise - in particular six years under § 257 HGB and ten years under § 147 AO for commercial and tax records.
3. Hosting and server log files
Our website is built and hosted by Webflow, Inc., 398 11th Street, Floor 2, San Francisco, CA 94103, USA. When you access the site, Webflow’s servers automatically record:
This data is required to deliver the site and to ensure its stability and security. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and functional website. Webflow retains server log data containing IP addresses for up to 30 days.
We have concluded a data processing agreement with Webflow pursuant to Art. 28 GDPR.
Webflow processes site content and visitor connection data on Amazon Web Services infrastructure in the United States and distributes it through the Fastly content delivery network. Hosting the site therefore involves a transfer to a third country; see section 9.
Collecting this data and storing it in log files is technically necessary in order to operate the website. There is therefore no possibility for you to object to this processing.
4. Cookies and consent
We use technically necessary cookies on the basis of § 25 (2) TDDDG, which do not require consent. All other cookies and comparable technologies - in particular analytics and advertising - are set only after you give consent through our consent banner, on the basis of § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
You can withdraw or change your consent at any time with effect for the future through the cookie settings on this website. Withdrawal does not affect the lawfulness of processing carried out before it.
Our consent management platform is Consent Pro, a Webflow app provided by Finsweet Inc., 1001A E Harmony Rd. #15, Fort Collins, CO 80525, USA. It stores your consent decision together with a consent ID, timestamp and the scope of consent, in order to document compliance. Finsweet is based in the United States; see section 9.
5. Analytics and advertising
The services described below run only after you have given consent. The legal basis for each is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.
a) Google Analytics 4
Provider for users in the European Economic Area and Switzerland is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Scope of processing. Google Analytics uses cookies and comparable technologies to analyse how our website is used. Your behaviour is recorded as events, in particular page views, sessions, interactions with the site and the referrer URL, together with any further events enabled by the enhanced measurement settings active in our property. In addition we process technical information about your device such as browser, operating system and screen resolution, and approximate location data at region level.
Purposes. Evaluating the use of our website, producing reports on site activity, and optimising our online offering and our marketing.
Recipients. Google Ireland Limited (Ireland), Google LLC (USA), Alphabet Inc. (USA).
Third-country transfer. Data is transferred to the USA. Google is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission covers the transfer; EU standard contractual clauses under Art. 46 GDPR apply in addition.
Retention. Data collected through Google Analytics and associated with cookies is deleted automatically at the end of the retention period configured in our Google Analytics property.
b) Google Ads and Google Tag
Provider is Google Ireland Limited, at the address above.
Scope of processing. Cookies and comparable technologies record whether and how you interact with our site after clicking one of our ads, and allow us to address you again with advertising on Google services and partner sites. Processed data includes your IP address, device and browser information, the pages you view, and conversion events such as form submissions.
Purposes. Conversion measurement and remarketing.
Recipients and third-country transfer. As set out under a) above.
Retention. Conversion and remarketing data is deleted at the end of the retention period set for the respective Google Ads audience or conversion action.
c) Meta Pixel
Provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Scope of processing. The Meta Pixel lets us see how visitors behave after clicking one of our ads on Facebook or Instagram. Processed data includes information about your activity on our website such as page views, clicks and interactions, technical information including IP address, browser and device data and the referrer URL, pixel-specific data such as the pixel ID and cookie information, and the status of ad tracking. Data we collect is generally not directly attributable to a specific person by us; Meta can, however, link it to existing user profiles and use it for its own purposes.
Joint controllership. For the collection of this data on our website and its transmission to Meta Ireland, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR. Meta Ireland’s subsequent processing of the data is its own responsibility as an independent controller. The essential content of the arrangement is set out in Meta’s Controller Addendum at facebook.com/legal/controller_addendum. Under that arrangement Meta is responsible in particular for meeting data subject rights in respect of the data held by Meta. You may exercise your rights in relation to the joint processing against either of us; requests addressed to us will be forwarded to Meta Ireland where they concern its part of the processing.
Purposes. Measuring the effectiveness of our advertising, optimising our marketing, and addressing audiences.
Recipients. Meta Platforms Ireland Limited (Ireland), Meta Platforms Inc. (USA).
Third-country transfer. Data is transferred to the USA. Meta is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission covers the transfer; standard contractual clauses under Art. 46 GDPR apply in addition.
Retention. Data we collect and transmit through the pixel is deleted in accordance with the retention period set in our Meta advertising account, unless longer statutory retention obligations apply.
Withdrawing consent for these services
You can withdraw your consent to any of the above at any time with effect for the future, through the cookie settings on this website. The lawfulness of processing carried out before withdrawal is unaffected. You can also prevent cookies from being stored through your browser settings; in that case not all functions of this website may be fully available.
6. Contact, forms and booking
If you contact us by email, contact form or booking tool, we process the data you provide - typically name, company, email address, phone number and the content of your enquiry - in order to respond.
Legal basis: Art. 6 (1) (b) GDPR where the enquiry concerns a contract or its initiation, otherwise Art. 6 (1) (f) GDPR, our legitimate interest in responding to enquiries.
Calls are scheduled through Cal.com, provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Data you enter when booking a call - name, email address, the time slot and anything you add in the notes field - is processed on our behalf under an Art. 28 GDPR agreement. Cal.com processes data in the United States; see section 9.
Email sent to and from us is processed by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland as part of Google Workspace, on our behalf under an Art. 28 GDPR agreement.
Enquiry data is deleted once the matter is settled and no retention period applies.
7. Client engagements
Where you are a client or a prospective client, we process contact and contract data to perform the engagement, on the basis of Art. 6 (1) (b) GDPR. Where we process personal data on your behalf in the course of the engagement, we do so as a processor under a separate agreement pursuant to Art. 28 GDPR.
We do not operate a customer relationship management system. Engagement records are held in project management and team collaboration tools, each acting as a processor on our behalf under an Art. 28 GDPR agreement.
8. Recipients
We pass personal data to processors acting on our instructions - hosting, email, scheduling, consent management and our project tools - and to Google and Meta where you have consented. We have concluded a data processing agreement pursuant to Art. 28 GDPR with each processor acting on our behalf. Data is also disclosed to tax advisers, auditors and authorities where legally required.
9. Third-country transfers
Hosting (Webflow), consent management (Finsweet) and scheduling (Cal.com) involve processing in the United States, and the services named in section 5 transfer data to their US parent companies. These transfers rely on the EU standard contractual clauses under Art. 46 (2) (c) GDPR and, where the recipient is certified, on the EU-US Data Privacy Framework under Art. 45 GDPR. We point out that US authorities may under certain conditions access such data, and that the level of protection may not correspond in every respect to that of the EU.
10. Your rights
You have the right to:
To exercise these rights, write to privacy@adpeak.com.
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the alleged infringement. The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
11. Changes
We update this policy to reflect changes in our processing or in the legal framework. The current version applies.