AI assistant
Automated replies
You're writing with an AI assistant, not with Kevin. The replies are generated automatically. Kevin doesn't read along here. Reach Kevin directly
Information on the processing of personal data under the GDPR.
This privacy policy is from the IT law firm Munich (one of Germany's leading law firms for online law) creates and regularly updates. Text based on the template from IT-Recht-Kanzlei, supplemented with the services actually in use.
1.1 We're glad you're visiting our website and thank you for your interest. Below we inform you about how your personal data is handled when you use our website. Personal data here means any data by which you can be personally identified.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Kevin Stumpf, DreiHundertSechzig, c/o flexdienst – #20924, Kurt-Schumacher-Straße 74, 67663 Kaiserslautern, Germany, Tel.: +491734018320, Email: [email protected]. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
1.3 Data protection officer: Under § 38 BDSG in conjunction with Art. 37 GDPR, we are not required to appoint a data protection officer, as we are a sole proprietorship that employs neither more than 20 people on a permanent basis in the automated processing of personal data, nor carry out processing subject to a data protection impact assessment, nor process personal data commercially for the purpose of transfer. For data protection questions, please contact the controller directly (section 1.2).
2.1 When you use our website purely for information, i.e. without registering or otherwise sending us information, we only collect the data your browser transmits to the web server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:
The processing takes place under Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. However, we reserve the right to review the server log files retrospectively should specific indications point to unlawful use.
2.2 For security reasons, and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to us), this website uses SSL or TLS encryption. You can recognise an encrypted connection by "https://" in the address bar and the padlock symbol in your browser.
3.1 We use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, to host our website. The server locations are exclusively within the European Union (Nuremberg, Falkenstein). The provider is ISO/IEC 27001 certified and is subject to German data protection law.
All data collected on our website is processed on these servers.
We have concluded a data processing agreement under Art. 28 GDPR with Hetzner Online GmbH, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.
3.2 Bunny
We use a content delivery network from the following provider: BUNNYWAY d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia
This service lets us deliver large media files such as graphics, page content or scripts faster across a network of regionally distributed servers. Processing takes place to protect our legitimate interest in improving the stability and functionality of our website under Art. 6 (1) (f) GDPR.
We have signed a data processing agreement with the provider that protects the data of our website visitors and prohibits unauthorised disclosure to third parties.
3.3 Cloudflare
We use a content delivery network from the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA
This service allows us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework. Based on an adequacy decision by the European Commission, it ensures compliance with the European level of data protection.
3.4 Cloudflare Web Analytics (audience measurement)
To measure reach, we use Cloudflare Web Analytics from the provider Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA. The service shows us how often our pages are viewed, which pages are read most, and which sources visitors come from.
Cloudflare Web Analytics sets no cookies, does not store any information on your device, and creates no fingerprint your browser. No cross-device profiles are created and no data is passed on to third parties for advertising purposes. Only aggregated values such as page views, referrer, device type and country are analysed; individual visitors cannot be recognised from them. Because no access to information on your device takes place, no consent under § 25 TDDDG is required for this.
Processing by Cloudflare Web Analytics takes place to protect our legitimate interest in a statistical evaluation of the use of our website under Art. 6 (1) (f) GDPR. We have a data processing agreement with the provider; for data transfers to the USA, the EU-US Data Privacy Framework mentioned above applies.
3.5 Consent-based website monitoring in the CRM
If you consent to the 'Analytics' category, we also collect technical usage events, such as the page viewed, product clicks, steps and drop-offs in the inquiry form, device and browser category, aggregated loading quality values (Core Web Vitals), interactions with 3D elements, and technically cleaned error types. No names, email addresses, phone numbers, form texts, IP addresses or full URLs are included in this telemetry. A random identifier applies only to the current browser session, is stored in session storage and is not used across devices. Raw events are deleted after 35 days at the latest. The legal basis is your consent under Art. 6(1)(a) GDPR; you can withdraw it at any time via the cookie settings.
To make your visit to our website appealing and to enable certain functions, we use cookies, i.e. small text files stored on your device. Some of these cookies are deleted automatically when you close your browser (so-called “session cookies”). Others remain on your device for longer and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage period in the overview of cookie settings in your web browser.
Where cookies we use also process personal data, the processing is carried out under Art. 6(1)(b) GDPR to perform the contract, under Art. 6(1)(a) GDPR where consent has been given, or under Art. 6(1)(f) GDPR to safeguard our legitimate interest in the best possible functionality of the website and a customer-friendly, effective design of the visit.
You can set your browser to notify you when cookies are set, decide case by case whether to accept them, or block cookies for specific cases or altogether.
Please note that if you do not accept cookies, the functionality of our website may be restricted.
5.1 Contact form
DHS NEXUS and ProfiSuite: product preview and test access request. The product screenshots show synthetic sample data only. The interactive preview of the agent office runs locally in your browser; it does not send any input to AI providers and does not trigger any real CRM actions. The general notes on hosting and technical access data of this website continue to apply.
Trial access to ProfiSuite Handwerk or ProfiSuite Projekt. For a test-access request, we process your name, email address, company, the product you selected, a request ID and the origin of the request, as well as the notice shown when you submit (version and timestamp), in our CRM. The purpose is to process your request and send you the test access by email. The legal basis is the same as described for contact requests under 5.1 below (Art. 6(1)(b) or (f) GDPR).
Providing a phone number is optional; if you do, we store it with your enquiry. You will only be called if you tick the box in the form separately you select that we may contact you by phone about this specific test access request. This selection is not preselected and is not a requirement for the request. It is based on your consent pursuant to Art. 6(1)(a) GDPR. The wording, version, time and selection are documented with the request. You may withdraw your consent at any time with effect for the future (e.g. by message to the controller named in section 1.2), without affecting the lawfulness of processing carried out before the withdrawal.
If you reached the website via a link marked accordingly, we additionally store campaign parameters (source, campaign and content) in order to assign the enquiry and measure the success of our campaigns. The legal basis for this is also the one stated under 5.1; we do not obtain additional consent for it.
Test access to DHS NEXUS. For a personal request for test access to DHS NEXUS, we process your name, email address, optionally your company, the confirmed request to be contacted, the request ID and the origin of the request in our CRM.
For both requests the following applies: processing and deletion take place as described below for contact requests. These requests do not result in a newsletter or marketing sign-up; there is a separate, voluntary sign-up for that. Only identifiers of confirmed requests are stored in the browser's session storage, to avoid repeated submissions; no form entries are stored. Please do not enter real customer data or sensitive data in a personal test version.
On our website, we offer you a contact form for enquiries. When you use the form, we process the data you provide (name, email address, optionally phone number, and your request). In addition, the selected service or product ID, a unique request ID and, provided you reached the website via a correspondingly marked link, campaign parameters (source, campaign and content) are stored. This information is used to clearly assign, process and measure the success of your request in our CRM.
The legal basis is Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering enquiries effectively.
The data you submit through the form is stored in our CRM on our servers in Germany. If you provide an email address, a one-time confirmation email is also triggered via our mail queue, and the sending status is linked to your request. We delete the data as soon as it is no longer required to process your request and no statutory retention obligations apply.
5.2 WhatsApp Business
We offer you the option of getting in touch with us via the messaging service WhatsApp, operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this we use WhatsApp's so-called "Business version".
If you contact us via WhatsApp in connection with a specific transaction (for example a placed order), we store and use the mobile phone number you use on WhatsApp and, if provided, your first and last name in accordance with Art. 6(1)(b) GDPR in order to process and respond to your enquiry. On the same legal basis, we may ask you via WhatsApp to provide further details (order number, customer number, address or email address) so that we can assign your enquiry to a specific transaction.
If you use our WhatsApp contact for general enquiries (for example about our services, availability or our website), we store and use the mobile number you use on WhatsApp and — if provided — your first and last name pursuant to Art. 6(1)(f) GDPR, based on our legitimate interest in providing the information you request efficiently and promptly.
Your data is only ever used to answer your enquiry via WhatsApp. It is not passed on to third parties.
Please note that WhatsApp Business gains access to the address book of the mobile device we use for this and automatically transmits phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a mobile device whose address book contains only the WhatsApp contact details of users who have also contacted us via WhatsApp.
This ensures that every person whose WhatsApp contact details are saved in our address book has already consented, under Art. 6(1)(a) GDPR, to the transmission of their WhatsApp phone number from the address books of their chat contacts when first using the app on their device, by accepting the WhatsApp Terms of Service. Transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is thereby excluded.
For the purpose and scope of data collection, and the further processing and use of the data by WhatsApp, as well as your related rights and setting options to protect your privacy, please refer to WhatsApp's privacy notice: https://www.whatsapp.com
Within the scope of the processing described above, data may be transferred to servers of Meta Platforms Inc. in the USA.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework. Based on an adequacy decision by the European Commission, it ensures compliance with the European level of data protection.
5.3 When you contact us (for example via the contact form or email), personal data is processed, solely for the purpose of handling and answering your request and only to the extent required for that.
The legal basis for processing this data is our legitimate interest in responding to your request under Art. 6(1)(f) GDPR. If your contact aims at entering into a contract, Art. 6(1)(b) GDPR is an additional legal basis for the processing. Your data will be deleted once the circumstances indicate that the matter in question has been finally resolved and no statutory retention obligations apply.
5.4 Entering prize draws
If we run prize draws (e.g. the "WM-Gewinnspiel 2026") and you take part, we process the data you enter in the entry form (name, email address, optionally phone number, and your industry). We use this data exclusively to run and administer the prize draw, in particular to determine and notify the winners and to send the respective participation bonus.
The legal basis is Art. 6(1)(b) GDPR (performance of the participation relationship arising from your entry) and Art. 6(1)(f) GDPR, based on our legitimate interest in the smooth administration of the prize draw. Entry data is deleted once the prize draw has ended and any applicable retention periods have expired. If you win, we store the data required to process the prize for as long as necessary to deliver the prize and to meet statutory obligations (in particular under tax and commercial law).
In the entry form, you can voluntary and separate agree (a) to receive information and offers from us by email in future and/or (b) to be contacted as a prospect for our product ProfiSuite Immo. These optional consents are not a condition of participation and are processed on the basis of Art. 6(1)(a) GDPR. You may withdraw them at any time with effect for the future (e.g. via the unsubscribe link in every email or by message to the controller named in section 1.2), without affecting the lawfulness of processing carried out before the withdrawal.
The form data is processed through our CRM system and stored on servers in Germany. It is not passed on to uninvolved third parties. The prize draw has no connection to Meta/Facebook, Instagram or any other platform, and is neither sponsored nor endorsed by them.
6.1 Sign up for our email newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. Your email address is the only mandatory field required to send you the newsletter. Providing further details is optional and will be used to address you personally. We use the so-called double opt-in procedure to send the newsletter. This means we will only send you an email newsletter once you have expressly confirmed that you consent to receiving newsletters. We will then send you a confirmation email asking you to click a link to confirm that you want to receive the newsletter in future.
When you sign up via our Instagram landing page, you may voluntarily provide a phone number and areas of interest in AI, automation and content. We use the topic selection to better categorise enquiries and to select newsletter content by topic. If you also enter a phone number and activate the separate contact permission, we may contact you once about the selected AI topics. To measure success, we also store the technical link to the triggering Instagram post, the campaign and the comment keyword used. Consent to the newsletter is independent of receiving any guide offered beforehand. Phone number, contact permission and topic selection are not a requirement for newsletter sign-up.
When you sign up via our general newsletter page, we store, in addition to the proof of consent, a random identifier for the respective sign-up process, the path of the sign-up page and, if the sign-up was made via a correspondingly marked link, the campaign and content identifier. This data is used solely to avoid duplicate submissions and to evaluate the origin of sign-ups in summary form. It contains no other form entries and is not passed on to advertising networks.
By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR. When you sign up for the newsletter, we store the IP address assigned by your internet service provider (ISP), along with the date and time of your registration, so that we can trace any possible misuse of your email address at a later point in time. The data we collect when you sign up for the newsletter is used exclusively for promotional communication by way of the newsletter. You can unsubscribe from the newsletter at any time using the link provided in the newsletter, or by sending a corresponding message to the controller named above. Once you have unsubscribed, your email address will be promptly deleted from our newsletter distribution list, unless you have expressly consented to further use of your data, or we reserve the right to use your data beyond this in a manner permitted by law and about which we inform you in this declaration.
6.2 Strato
Our email newsletters are sent via this provider: STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin
Based on our legitimate interest in effective and user-friendly newsletter marketing, we pass the data you provide when signing up for the newsletter to this provider under Art. 6(1)(f) GDPR, so that it handles the newsletter dispatch on our behalf.
Subject to your explicit consent under Art. 6(1)(a) GDPR, the provider also carries out a statistical performance analysis of newsletter campaigns using web beacons or tracking pixels in the emails sent. These can measure open rates and specific interactions with the newsletter content. Device information (e.g. time of access, IP address, browser type, and operating system) is also collected and analyzed, but it is not combined with other data sets.
You can withdraw your consent to newsletter tracking at any time, with effect for the future.
We have concluded a data processing agreement with the provider, which protects the data of our site visitors and prohibits passing it on to third parties.
Right of withdrawal for distance contracts
Consumers who conclude contracts on this website where a statutory right of withdrawal applies may send their withdrawal by email to [email protected] or by post to the one in Legal notice declare your withdrawal to the address given. A printable sample withdrawal form is available at dreihundertsechzig.com/widerruf ready.
To process the withdrawal, we collect the details required to identify the contract (e.g. first and last name, email address, contract date). This data is collected and processed under Art. 6 (1) (b) GDPR, and only to the extent necessary to process the withdrawal properly.
Lexware Office
For handling our bookkeeping we use the cloud-based accounting software Lexware Office from Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany.
The provider processes our incoming and outgoing invoices and, where applicable, bank transactions in order to record invoices, assign them to business transactions and prepare our financial accounting. Insofar as personal data is processed in this context, this is done in accordance with Art. 6(1)(b) GDPR for contract performance and in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in an efficient organization and documentation of our business transactions. Statutory retention obligations remain unaffected.
Google Ads conversion tracking
This website uses the online advertising programme "Google Ads" and, as part of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to draw attention to our attractive offers on external websites with the help of advertising media (so-called Google Adwords). We can use the data from the advertising campaigns to determine how successful the individual advertising measures are. Our aim is to show you advertising that is of interest to you, to make our website more interesting for you and to achieve a fair calculation of the advertising costs incurred.
The cookie for conversion tracking is set when a user clicks on an ad displayed by Google. Cookies are small text files that are stored on your device. These cookies generally expire after 30 days and are not used for personal identification. If the user visits certain pages of this website while the cookie has not yet expired, Google and we can recognise that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page carrying a conversion tracking tag. However, they do not receive any information that would allow users to be personally identified. As part of using Google Ads, personal data may also be transferred to the servers of Google LLC. in the USA.
You'll find details on the processing triggered by Google Ads Conversion Tracking, and on how Google handles data from websites, here: https://policies.google.com
All processing described above, in particular setting cookies to read information from your device, will only take place if you have given us your express consent under Art. 6 (1) (a) GDPR. You can withdraw this consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.
You can also permanently opt out of cookies set by Google Ads conversion tracking by downloading and installing the browser plug-in from Google available at the following link: https://support.google.com
Please note that certain functions of this website may not be available, or may only be available in a limited way, if you have disabled cookies. Google's privacy policy can be viewed here: https://business.safety.google
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework. Based on an adequacy decision by the European Commission, it ensures compliance with the European level of data protection.
Google Analytics 4
This website uses — solely with your consent — Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Analytics is used to measure reach and to statistically analyse use of this website (e.g. pages viewed, time spent, interactions such as clicks and scroll depth), so that we can improve our offering.
Technical usage data may be processed in the process, such as a shortened IP address, device and browser information, an approximate location, and event and interaction data. Content you enter into forms (name, email address, phone number, message text) is not transmitted to Google Analytics by our tracking layer — only technical event identifiers are recorded (e.g. "form submitted"), no input content.
When you use this service, personal data may be transferred to Google LLC in the USA. For these transfers to the USA, the provider has joined the EU-US Data Privacy Framework.
The legal basis for processing is your consent under Art. 6(1)(a) GDPR. Google Analytics is neither loaded nor activated without your consent. You can withdraw your consent at any time with effect for the future by deactivating the "Google Analytics" service in the "Cookie consent tool" (Usercentrics) provided on the website. The retention period for usage and event data follows the retention period configured in Google Analytics.
You can find more information on how Google handles your data here: https://policies.google.com
Protection against automated requests and Cloudflare Turnstile
Our forms contain a hidden input field that is invisible to you and is normally filled in only by automated programs, plus a simple plausibility check in the browser. If the hidden field is filled in, we discard the request.
In addition, for forms that are protected accordingly, we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The service checks whether an input is made by a natural person or through abusive automated means. In particular, the IP address of the device used, browser and operating system identification data, and the date and duration of the visit may be transmitted to Cloudflare.
The legal basis is our legitimate interest in preventing abuse, spam and automated malicious access under Art. 6(1)(f) GDPR. We have a data processing agreement with Cloudflare. For data transfers to the US, the provider has joined the EU-US Data Privacy Framework.
Cookie consent tool
To obtain effective user consent for cookies and cookie-based applications that require consent, this website uses a so-called "cookie consent tool". When you open the page, the "cookie consent tool" is shown to you as an interactive user interface, on which you can give consent for certain cookies and/or cookie-based applications by ticking boxes. The tool ensures that all cookies and services that require consent are only loaded if you give the corresponding consent by ticking the boxes. This ensures that such cookies are only set on your respective device if consent has been given.
The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed here.
If, in individual cases, personal data (such as the IP address) is nevertheless processed to store, assign or log cookie settings, this takes place under Art. 6(1)(f) GDPR, based on our legitimate interest in lawful, user-specific and user-friendly consent management for cookies, and therefore in a lawful setup of our online presence.
A further legal basis for the processing is Art. 6 para. 1 lit. c GDPR. As the controller, we are under a legal obligation to make the use of cookies that are not technically necessary dependent on the respective user's consent.
Where required, we have signed a data processing agreement with the provider. It protects the data of our website visitors and prohibits unauthorized disclosure to third parties.
You'll find more information about the operator and the settings of the cookie consent tool directly in the corresponding user interface on our website.
Links to social media profiles (Instagram & Facebook)
On our website, we link to our Instagram and Facebook profiles in a few places (for example in the menu bar, the footer and the "About me" page) using so-called "link buttons" (each operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). These are plain HTML links without any social media plugin. When you visit our website, no personal data at all is transmitted to Instagram, Facebook or Meta. Only when you actively click the link button and open the respective profile does your browser connect to Instagram's or Facebook's servers. Personal data (including IP address, browser information and, where applicable, cookie IDs) may then be processed by Meta — this processing is carried out exclusively by Meta under its own privacy policies.
The legal basis for the mere link is Art. 6(1)(f) GDPR. Our legitimate interest lies in allowing visitors to understand our content and background also via social networks. Data is transferred to the USA only after you actively click, and the processing by Meta takes place on the basis of the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. You can find further information in Instagram's privacy policy at privacycenter.instagram.com/policy as well as in Facebook's privacy policy at facebook.com/privacy/policy.
11.1 Applicable data protection law grants you the following rights as a data subject with respect to us as the controller regarding the processing of your personal data (rights of access and intervention); for the respective conditions of exercise, please refer to the legal basis cited:
11.2 RIGHT OF OBJECTION
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST WITHIN THE SCOPE OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE AFFECTED DATA. HOWEVER, FURTHER PROCESSING REMAINS POSSIBLE IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING. YOU CAN EXERCISE THIS OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE AFFECTED DATA FOR DIRECT MARKETING PURPOSES.
How long personal data is stored depends on the respective legal basis, the processing purpose and — where applicable — the relevant statutory retention period (e.g. commercial and tax retention periods).
When personal data is processed on the basis of your explicit consent under Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.
Where statutory retention periods apply to data processed under Art. 6 (1) (b) GDPR for contractual or pre-contractual obligations, that data is routinely deleted once the retention periods have expired, provided it is no longer required for performing or initiating the contract and/or we have no legitimate interest in keeping it.
When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
When personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.
Unless the other information in this notice on specific processing situations indicates otherwise, stored personal data will otherwise be deleted once it is no longer necessary for the purposes for which it was collected or otherwise processed.
13.1 For selling and processing payments for our paid products (in particular "ProfiSuite Immo") we use the online sales platform Digistore24. The service provider is the German company Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany.
13.2 Digistore24 does not act as a processor in this context but as a reseller and is therefore the contracting party and seller of the order in this respect. When you start a purchase, you are redirected to the order form of Digistore24 (checkout-ds24.com). There you enter the data required for the purchase (including name, email address, postal address and the payment data associated with the selected payment method). The payment data is processed by Digistore24 and the payment service providers integrated by Digistore24; we ourselves receive no full payment details (e.g. no credit card numbers).
13.3 After a successful purchase, Digistore24 transmits the order data required to perform the contract (in particular name, email address, product and order number), so that we can activate your licence and send you access by email. The legal basis for this processing is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).
13.4 As Digistore24 acts as reseller and seller, Digistore24 also handles invoicing, the remittance of VAT and the processing of any withdrawal. Digistore24 is a German company; data processing takes place primarily within the European Union. Depending on the payment method you choose, further payment service providers may be involved, and their respective privacy notices apply to their processing.
13.5 Further information on how Digistore24 processes data can be found in Digistore24's privacy policy at https://www.digistore24.com/page/privacy.
14.1 On the home page (in the tablet, section "AI you can use straight away") and on the page "Personnel service providers" we provide freely usable AI tools: quote generator, review responder, website X-ray, CV matching and CV generator. Use is voluntary and requires no registration. The E-invoice check and the Digital Score calculate exclusively in your browser; no data is sent to us or to third parties in the process.
14.2 When you start such a tool, the text you enter is sent to our server (Hetzner Online GmbH, data centre in Nuremberg, Germany) to generate the response, and from there it is passed on for processing to Anthropic PBC's AI interface (USA, "Claude"). Your inputs are stored on our server not stored; they are processed solely to generate the answer once. To prevent misuse, we temporarily process your IP address for a daily usage limit; it is not permanently stored linked to the inputs.
14.3 In CV matching you can drag a file (PDF or text) into the tool. The file is exclusively local in your browser read out and never uploaded at any point; only the text visible in the text field is transmitted, and only when you actively start the matching. Please do not enter personal data of third parties (e.g. real applicant data) into the demo tools.
14.4 Transfers to Anthropic PBC are based on EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR) together with a data processing agreement. Under Anthropic's terms, content transmitted via the API is not used to train AI models. Further information: https://www.anthropic.com/legal/privacy.
14.5 The legal basis for processing is Art. 6(1)(f) GDPR (legitimate interest in providing functional demo tools and preventing misuse). The tools are only used, and therefore the processing only takes place, at your active request.
15.1 On this website, bottom right, you'll find a AI chat assistant ready. It is labelled as AI: the answers are generated automatically by an AI model — you are not writing with Kevin Stumpf personally. Use is voluntary and requires no registration. Processing only takes place once you actively open the chat and send a message.
15.2 When you send a message, your message text and — as context for the reply — the last up to sixteen Messages in the ongoing conversation are sent to our server (Hetzner Online GmbH, data centre in Nuremberg, Germany) and from there passed on to the AI interface of Anthropic PBC (USA, “Claude”) for processing. The conversation history is held only in your browser’s memory and is lost at the latest when you reload the page. It is neither stored permanently in your browser nor saved on our server. The only exception applies if you make an express request via the assistant and consent to it (see 15.7). In that case, what is stored is not the history but the summary described there.
15.3 If the AI interface is unreachable, the assistant replies with a fixed set of prepared answers. In that case, your input never leaves your browser.
15.4 Please type into the chat no personal data of third parties and no sensitive data (e.g. health or payment data). For a binding enquiry, use the contact form, write to me directly, or submit it via the assistant (15.7).
15.5 Transfers to Anthropic PBC are based on EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR) together with a data processing agreement. Under Anthropic's terms, content transmitted via the API is not used to train AI models. Further information: https://www.anthropic.com/legal/privacy.
15.6 The legal basis for processing is Art. 6(1)(f) GDPR (legitimate interest in answering visitor questions directly and with low barriers); processing takes place solely at your active request.
15.7 Consultations and inquiries via the assistant. The assistant can advise you on suitable offers. To do so, your messages are processed as described in 15.2; our server assigns the response exclusively to our own published products and recommends at most two of them. If you would like to make an enquiry at the end, the assistant asks for your contact details (name, email and/or phone), your callback preference and how urgent it is. Only once you actively tick the checkbox provided for this (consent under Art. 6(1)(a) GDPR, not pre-selected), this information is stored together with a factual summary of your request from the conversation (industry, company size, problem, goal, timeframe, requested products) in our inquiry system (our own system on our server, Hetzner, Nuremberg), so that Kevin Stumpf can get back to you. We also store the wording of your consent and the time as proof. The rest of the conversation is not stored in this process. You can withdraw your consent at any time with effect for the future (contact details in section 1); the data will then be deleted, unless statutory retention obligations apply. Without consent, no inquiry is created. Instead, you can use the contact form, email or phone at any time.
16.1 On the homepage and on the "AI phone assistant" page you can start a Voice assistants try it. It will only loaded after you have expressly consented. Without your consent, no connection is established, no microphone is requested and nothing is transmitted. The assistant is an AI system and not a human; we explicitly point this out to you before the start (Art. 50 of Regulation (EU) 2024/1689).
16.2 Provider: ElevenLabs, Inc., 169 Madison Avenue, Suite 2438, New York, NY 10016, USA. Data processed your voice input, the text version generated from it in real time, and the assistant's replies. Purpose is solely so you can test the assistant.
16.3 Nothing is stored at ElevenLabs. For this assistant, the no-storage operating mode is activated there. Your conversation is processed only for the duration of the call — neither audio recordings nor conversation texts are stored at ElevenLabs.
16.4 If you leave an enquiry, we receive these details. If you give your name, a callback number, an email address or your request during the call, exactly those details are sent to us after the call so we can get back to you. The rest of the conversation is not transmitted.
16.5 For this transmission we use the automation service Make (Celonis SE or Make s.r.o., servers in the European Union). Make forwards your details to us as an enquiry and sends you a confirmation by email, provided you gave an email address. A data processing agreement under Art. 28 GDPR is in place with the provider. Your details are then processed like any other enquiry we receive (see the section "Contacting us").
16.6 No use for AI training. In our ElevenLabs account, we have objected to the use of data from our workspace for training AI models.
16.7 The legal basis is your consent under Art. 6(1)(a) GDPR. The processing takes place in the USA. ElevenLabs has joined the EU-US Data Privacy Framework; the European Commission has determined an adequate level of data protection for certified US companies (Art. 45 GDPR). Further information: https://elevenlabs.io/privacy.
16.8 Technically necessary additional requests: To start the assistant, your browser downloads program files from the content delivery networks unpkg.com and cdn.jsdelivr.net. In the process, your IP address is transmitted to these providers. The call to cdn.jsdelivr.net is hard-coded in the assistant and cannot be redirected to another server by us.
16.9 Withdraw consent: Below the assistant you'll find the "withdraw" link at any time. Proof of your consent is stored exclusively locally in your browser (key dhs-consent-elevenlabs, content: service, text version, time) and deleted upon withdrawal. We do not transfer this record to our server.
17.1 As part of the "Content Engine", we process photos that customers actively submit to us in order to create draft texts for social media posts. The processing takes place exclusively on behalf of the respective customer; details are governed by the data processing agreement concluded with the customer (Art. 28 GDPR), the conclusion of which forms part of onboarding.
17.2 Image analysis: To analyze the photos you submit, we use a multimodal AI model from OpenAI fed in via the API; processing may take place in the USA. Under OpenAI's API terms, content submitted via the API is not used to train models. Further information: https://openai.com/policies/privacy-policy.
17.3 Storage and automation: Submitted photos and drafts created are stored in a DreiHundertSechzig working account at Google (Google Drive/Google Sheets; Google Ireland Limited, with a third-country transfer to Google LLC, USA, possible) stored. The workflows run via Make (Celonis group, EU processing zone) controlled.
17.4 Storage period and deletion: Photos and drafts remain stored until the pilot customer requests deletion; on request, we delete all of the customer's material.
17.5 People shown: Photos showing people are generally held back and are only further processed after the customer has explicitly confirmed that the people shown agree. No automatic facial recognition takes place. Responsibility for the rights to the material provided lies with the customer.
17.6 AI transparency: The Content Engine produces drafts, not unchecked publications. Kevin Stumpf or the respective client is responsible for editorial review and approval. Realistic-looking artificially generated or substantially AI-edited images, videos and audio will be clearly labelled as AI-generated or AI-assisted when published, in accordance with Art. 50 of Regulation (EU) 2024/1689. Interactive AI systems indicate, before or at the first interaction, that no human is responding.