Privacy Policy

Last updated: 02.11.2022

When visiting https://crealytics.com (hereinafter “website”), we process your personal data (hereinafter also referred to as “data”). Therefore, we would like to provide you with an overview of the processing by means of the following information to ensure that you fully comprehend how and to what extent your personal data are processed by us. In addition, this privacy policy informs you about your rights under the General Data Protection Regulation (“GDPR”).

11 Controller and Contact

The party responsible for processing data on this website is:

Crealytics GmbH (hereinafter also „Crealytics“, „we“ and „us“)
Salzufer 12
10587 Berlin
Germany

If you have questions or suggestions regarding any data protection matter, including this privacy policy; or if you would like to contact us to exercise your data subject rights; or would like to address general questions about our website, please contact us at privacy@crealytics.com

12 Data Protection Officer

You can reach our data protection officer at dataprotection@crealytics.com

13 Automated Data Protection

Whenever you access our website, your device automatically transmits data for technical reasons:

  • the browser type and version used;
  • operating system used;
  • URL of the website you access;
  • URL of the website visited prior to access (referrer-URL);
  • date and time of access
  • IP address.

The data is stored separately from other data which you may transmit to us and is only processed for the following purposes: 

  • delivering the content of our website; 
  • ensuring the security of our IT systems, e.g., to counter specific attacks on our systems and detect attack patterns; 
  • ensuring proper operation of our website and our IT systems, e.g. if errors occur that we can only rectify by storing the IP address; 
  • enabling criminal prosecution, averting of dangers as well as legal prosecution in the event of specific indication of criminal offenses. 

The data is stored for a period of seven days your IP address is stored for a period of seven days. 

The processing takes place based on our above-mentioned legitimate interests, Art 6(1)(f) GDPR. 

14 Hosting

14.1 Hosting Service Providers
When you access our website https://crealytics.com, our so-called Domain Name System (“DNS”) hosting service provider, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google Cloud”), connects you to the corresponding server on which we operate this website.

We operate our website on servers of Microsoft Azure, a web hosting service provided by Microsoft Ireland Operations Ltd.

One Microsoft Place, South County Business Park, Leopardstown Dublin 18, D18 P521 Ireland (“Microsoft Azure”). Your data are processed in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and Microsoft entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR.

Google Cloud and Microsoft Azure process personal data on our behalf and in accordance with our instructions (within the meaning of Art 4 No 8, 28 GDPR).

15 Making Contact

15.1 Making Contact via Our Contact Form

If you contact us by using our contact form on our website, we process the information provided by you: 

  • your name; 
  • your company name;
  • company domain; 
  • your work email address; and 
  • the content of your communication. 
15.2 Making Contact by Using Our Contact Details

If you send or otherwise direct requests, comments or questions at us, we process any information you provide in your communication, including  

  • your name;  
  • the content of your communication; and depending on the method of communication you choose the contact information provided 
  • your email address; 
  • your phone number; and / or 
  • your postal address. 
15.3 Purpose and Legal Basis for the Processing

We process the aforementioned personal data to process and answer your communication. We also collect said data whenever a request is made in connection with contracts, so that we can initiate and perform each contractual relationship.  

If you yourself make a request and become a (potential) party to a contract with us, then data are processed for purposes of initiating and performing the corresponding contractual relationship (Art 6(1)(b) GDPR). 

In all other constellations, the legal basis for the processing of your personal data is Art 6(1)(f) GDPR. The processing is necessary for the purpose of our aforementioned legitimate interests. 

15.4 Storage of Your Personal Data

In the case of communications, which have potential legal relevance, we reserve the right to retain the communications for a period equal to the respective statutes of limitation, that is: three years, commencing as of the end of the year in which we have received your communication. Apart from said cases, we erase communications once we no longer need them for the purpose for which we collected them; such is the case once we have processed your communication completely. 

The storage takes place based on our legitimate interest, the proper documentation of our business operations and the securing of our legal positions, Art 6(1)(f) GDPR. 

16 Requesting an On-Demand Webinar

If you decide to request an on-demand webinar, we process the following personal data: 

  • your name; 
  • your email address; and 
  • your company name. 

Legal basis for the processing is Art 6(1)(b) GDPR. The processing is necessary to provide you with the video for the on-demand webinar you have requested.  

We will delete your personal data after.

17 Newsletter and Newsletter Tracking

17.1 Newsletter

Provided you have given your consent we will send you our newsletter by email containing news, information, opinions and events about crealytics and / or the digital advertising industry. For this purpose, we process:  

  • your name; 
  • company name and 
  • your email address. 

Once you register, we will send you a confirmation email. Only after you have confirmed your registration will you receive our newsletter (so-called double opt-in process). 

For the provision of our newsletter, we use MailChimp, an email marketing service of The Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (“MailChimp”). 

MailChimp processes your personal data and sends you our newsletter on our behalf and in accordance with our instructions (within the meaning of Art 4 No 8, 28 GDPR). Your data are processed in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and MailChimp entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

For the provision of our newsletter, we use Drip Global, Inc., an email marketing service in 123 N 3rd St #400, Minneapolis MN, 55401, USA (“Drip”). 

Drip processes your personal data and sends you our newsletter on our behalf and in accordance with our instructions (within the meaning of Art 4 No 8, 28 GDPR). Your data are processed in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and Drip entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

17.2 Newsletter Tracking

MailChimp processes further personal data to track how you interact with our newsletter, as part of its so-called performance measurement service.  

For performance measurement purposes, our newsletters contain a so-called open tracking, also called web beacon. This open tracker or web beacon is an invisible image that connects to MailChimp’s, server when you open the newsletter. Depending on the functionality of your email software, you can prevent this by disabling the download of embedded images. 

When opening or otherwise interacting with the newsletter we send to you (e.g., clicking on links in these newsletters), the open tracking allow us to capture information regarding these interactions, including whether and when you have opened the newsletter and information regarding the links, on which you clicked in these newsletters.  

We can associate these data with your email address and your name and will evaluate these personal data for the purpose of identifying your interests and preferences and to communicate with you in a more personalized and effective way, e.g., by providing information that you are likely interested in, like information on new crealytics technologies or products that are likely relevant to you. 

17.3 Legal Basis for the Processing and Storage of Your Personal Data

Your personal data for the provision of the newsletter are processed based on your consent, Art 6(1)(a) GDPR. We use web beacons for newsletter tracking based on your consent pursuant to Sec 25(1) TTDSG. You can withdraw your consent at any time with effect for the future, by clicking on the unsubscribe link contained in every newsletter or by responding to the newsletter using the word “Unsubscribe”. 

We store information that enables us to demonstrate that you have given your consent. This information includes: 

  • the date and time you provided your consent to receive our newsletter. 
  • the date and time you confirmed your registration; and  
  • your IP address. 

This processing is based on Art 6(1)(c) in conjunction with Art 7(1) GDPR. 

If you withdraw your consent, we will erase your personal data without undue delay. We will erase information, which we have stored to demonstrate that you have given your consent after 6 months. 

18 CRM Systems

This is meant to advise you of possible risks, in particular since the German and European supervisory authorities are of the opinion that Google Analytics cannot be used in compliance with data privacy law. However, we assume that removing Google Analytics from the website altogether would not be a practical approach for crealytics.  

For managing our customer relationships, we use the services of: 

  • Salesforce.com, Inc., 415 Mission Street, CA 94105, USA (“Salesforce”); 
  • Zoho Corporation, 4141 Hacienda Drive Pleasanton, CA 94588, USA (“Zoho”); and 
  • Salesloft, Inc., 1180 West Peachtree Street NW, Suite 600, GA 30309, USA (“Salesloft”), 

hereinafter also jointly referred to as “CRM systems”. 

Your data are also processed in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and Salesforce, Zoho and Salesloft entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

Salesforce, Zoho and Salesloft process personal data on our behalf and in accordance with our instructions (within the meaning of Art 4 No 8, 28 GDPR). 

Our CRM systems are used for managing customer relationships, in particular for responding to and processing your requests contemplated under the above sections. 

In particular, we use 

  • Salesforce to store your contact information in the scope of the customer relationship with the company for which you are the appointed contact person; 
  • Zoho to send you invoices and to be able to carry out payment related communications with you as the contact person on the side of our customer; and 
  • Salesloft to document interactions with you as the contact person on the side of our customer. 

Processing data in connection therewith is based on the legitimate interests we have in managing our customer relationships, Art 6(1)(f) GDPR. 

We erase these data from our CRM systems once the customer relationship has ended or you cease to be our contact person on the side of our customer. 

19 Applications

19.1 Applying for a Job via Our Application Form

If you apply for a job by using our application form, we process the information provided by you: 

  • your name; 
  • your email address; 
  • your phone number; and 
  • your resume/curriculum vitae and the information contained therein. 

In addition, you may voluntarily provide: 

  • the address to your profile on the social network LinkedIn. 

We process this data to communicate with you (e.g., invitations to job interviews, making appointments and accepting or rejecting applications) and to process your application by means of deciding whether to establish an employment relationship with you. Likewise, the data you have deposited with LinkedIn is also processed if you decide to enter your LinkedIn profile. The legal basis is Sec 26(1) of the German Federal Data Protection Act (“BDSG”).  

Further, you may voluntarily tell us 

  • how you heard about the respective job offering. 

If you decide to provide us with this information, we will process it to better evaluate and optimise the reach of our recruiting measures. Therein lies our legitimate interest, Art 6(1)(f) GDPR. 

19.2 Storage of Your Personal Data

Should we not offer you the job you applied for, we will retain your application for up to 6 months after the respective application process has been completed, so that we are able to respond to any questions you might have in connection with your application. Further storage takes place insofar it is necessary for the provision of evidence, in particular for the defense, assertion or enforcement of claims, Art 6(1)(f) respectively Art 9(2)(f) GDPR. 

Apart from the foregoing, we will only retain your data if we have offered you the option to expressly consent and you have done so, Art. 6(1)(a) GDPR in conjunction with Sec 26(2) BSDG. You have the right to withdraw your consent at any time with effect for the future. For example, by using our contact details as specified in section 1 of this privacy policy. 

We also store your consent as well as the time at which you have consented in order to be able to prove your consent for a period of one year. This processing is based on Art (6)(1)(c) in conjunction with Art 7(1) GDPR. 

19.3 Service Provider for the Processing of Applications

For the processing of your data in connection with your application, we use Greenhouse, an applicant tracking system and recruiting software provided by Greenhouse Software, Inc., 18 W 18th Street, 11th FloorNew York, NY 10011, USA  (“Greenhouse”).  

Greenhouse processes personal data on our behalf and in accordance with our instructions (within the meaning of Art 4 No 8, 28 GDPR) in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and Greenhouse entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

110 Cookies and Similar Technologies

We use so-called “cookies” and similar technologies, which allow us to offer you certain features of our website and the related services; and to make our website more user-friendly. Cookies are small files that are stored on your end device, with the aid of your browser.  

As similar technologies, we use local storage and tracking pixel. Local storage allows us to store data locally and continuously in the cache of your browser – unless you actively delete your cache – even after you close your browser; whereas tracking pixel monitor your activity for the purposes of analytics (hereinafter jointly “cookies and similar technologies”). 

The cookie consent management implemented on our website is provided by Hu-manity Rights Inc., 300 Carnegie Center, Suite 150, Princeton, NJ, New Jersey 08540, USA („Hu-manity Rights“). Hu-manity Rights qualifies as our processor within the meaning of Art 4 No 8, 28 GDPR, processing your personal data on our behalf and in accordance with our instructions in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and Hu-manity Rights entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

Hu-manity Rights processes the cookie preferences you set, including whether you have given, refused or withdrawn your consent in order to provide a legally compliant consent management. On our behalf Hu-manity Rights will store your cookie preferences, including the status of your consent, with the help of strictly necessary cookies on your device. 

110.1 Categories of Cookies and Similar Technologies
110.1.1 Strictly Necessary Cookies and Similar Technologies

These cookies and similar technologies are strictly necessary for the operation and functionality of our website and related services. They allow our website to be accessible and available; they provide essential and basic functionalities, e.g. these cookies and similar technologies ensure that your user settings and your cookie preferences are saved.

We use the below listed strictly necessary cookies and similar technologies for the purposes as follows: 

110.1.2 Analysis Cookies and Similar Technologies

These cookies and similar technologies allow us to measure online traffic and to analyse your behaviour, so that we can not only understand better your use of our website, but also make improvements. 

We use the below listed analysis cookies and similar technologies for the purposes as follows: 

110.1.3 Remarketing Cookies and Similar Technologies

Remarketing Cookies and Similar Technologies

110.1.4 Legal Basis for the Use of Cookies and Similar Technologies and the Processing of Your Personal Data

Strictly necessary cookies or similar technologies are used without your consent pursuant to Sec 25(2) No 2 German Telemdia and Telecommunication Data Protection Act (“TTDSG”). Any processing of personal data in connection with these cookies is carried out for the aforementioned purposes. To the extent the processing is necessary for our website and related services to be accessible and available, the processing is based on Art 6(1)(b) GDPR. The legal basis for the processing of your personal data necessary to correctly store your cookie preferences, including whether you have given, refused or withdrawn your consent is Art 6(1)(1)(c) GDPR, Sec 25 TTDSG. The aforementioned purposes are also our legitimate interest, Art 6(1)(f) GDPR.  

Pursuant to Sec 25(1) TTDSG all other cookies and similar technologies are used based on your consent, Art 6(1)(a) GDPR. If personal data from these cookies and similar technologies are processed, this processing is based [●].To the extent that we use analysis cookies and similar technologies based on your consent, you have the right to withdraw your consent at any time with effect for the future. You can withdraw your consent, by adjusting your cookie settings here. Alternatively, you can change your settings at any time by clicking on the link “Cookie settings.” The link is located in the footer of our website. 

In the following, we would like to explain the analysis and remarketing services we use in more detail: 

110.2 Google Services

We use the services, described below, of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).  

Please note that your personal data may be shared by Google with other Google entities as well as other third parties. That sharing entails that personal data are transferred to the United States and to other third countries, for which no adequacy decision of the EU Commission exists. In this case, Google relies on the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

More information concerning your personal data, as processed by Google, can be found here: https://policies.google.com/privacy?hl=en. 

Google also provides you with the following settings options: 

Your data are also processed by Google LLC in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and Google LLC entered into the standard contractual clauses adopted by the EU Commission in accordance with Article 46(2)(c) GDPR. Basic information concerning your personal data, as processed by Google, can be found here: https://policies.google.com/privacy?hl=en.  

110.3 Google Analytics

Provided you have given your consent, we use Google Analytics, a web analytics service.  

Google Analytics uses cookies and collects pseudonymized data from you concerning your use of our website, including your truncated IP address. The information generated by the cookies regarding your use of our website (including your truncated IP address) are transferred to, and stored on, a Google server. Google will use this information to evaluate your use of our website, to compile activity reports for us, and to generate further analyses and evaluations in conjunction with the use of our website and your general internet use. Google can also link these data with other data such as your search history, your personal account, the usage data of other devices, and additional data, which Google has stored regarding you. Where applicable, Google will also transfer this information to third parties insofar as such is required by law (such as government authorities) or to the extent that third parties process such data on behalf of Google. 

The data logged with Google Analytics are stored for a time period of 24 months. Once this time period has lapsed, only aggregated statistics will be retained by Google Analytics. 

Google Analytics is used in accordance with Sec 25(1) TTDSG based on your consent, Art 6(1)(a) GDPR. 

You can deactivate Google Analytics through your browser add-ons, if you prefer not to allow the website analysis it performs. You can download this here: https://tools.google.com/dlpage/gaoptout?hl=en. Alternatively, you can withdraw your consent at any time with effect for the future by clicking here to deactivate Google Analytics. 

You also have the option to withdraw your consent at any time with effect for the future, by adjusting your cookie settings here. Alternatively, you can change your settings at any time by clicking on the link “Cookie settings.” The link is located in the footer of our website. 

110.4 Google Ads Services

Provided you have given your consent, we use the ads service Google Ads. 

Pursuant to Sec 25(1) TTDSG Google Ads Services uses cookies and similar technologies as described below based on your consent, Art 6(1)(a) GDPR.   

You also have the option to withdraw your consent at any time with effect for the future, by adjusting your cookie settings here. Alternatively, you can change your settings at any time by clicking on the link “Cookie settings.” The link is located in the footer of our website. 

110.4.1 Google Ads Conversion Tracking

Google Ads Conversion Tracking allows us to analyse and to improve the performance and effectiveness of our advertising efforts within the Google network. For this purpose, we incorporate a Google tag into our website. If you interact with an advertisement within the Google network, a cookie will be dropped on your end device. With the help of this cookie, we know that users have clicked on our advertisements.  

From Google, we receive information regarding the number of users, who have clicked on our advertisements, and additional information regarding user interactions, after they have clicked on our advertisements. The cookie is deleted automatically 30 days after you clicked on an advertisement. 

110.4.2 Google Ads Remarketing

Google Ads Remarketing analyses your interactions on our website in order to serve you our advertisements that match your interests within the Google network (e.g. in Google Search, on YouTube or on other websites). In particular, based on the offers on within our website that you were most interested in during your visit. For this purpose, we use the so-called remarketing function within Google Ads. Google will store cookies on your end device. 

110.5 Google reCAPTCHA v2

We use reCAPTCHA v2. With the help of reCAPTCHA v2, we verify users with the so-called “I’m not a robot” checkbox and / or an “invisible reCAPTCHA badge”. This helps us to prevent spam and fraudulent queries through the forms on our website. 

Upon your interaction with a form on our website, Google collects your device-related and personal data. For this purpose, reCAPTCHA v2 analyses the traffic on our website. In addition, your IP address and information about your operating system are processed.  

Based on the aforementioned data, reCAPTCHA v2 performs a risk analysis to determine whether to prompt you to click a “I’m not a robot” checkbox indicating that you are not a robot. When Google herewith confirms to us that the form is indeed accessed by a person and not a bot, you are finally allowed to submit the form.  

To provide reCAPTCHA v2 Google drops cookies on your end-device. See sec. 9 above for further details. 

We use reCAPTCHA v2 based on our legitimate interest to protect ourselves from spam and fraudulent queries through the forms on our website, Art 6(1)(f) GDPR. 

110.6 LinkedIn Insight Tag

Provided you have given your consent; we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Gardner House, Wilton Plaza, Dublin 2, Ireland (“LinkedIn”). 

LinkedIn transfers personal data to the United States and other third countries outside the European Economic Area, for which no adequacy decision of the EU Commission exists. You can find relevant information at https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=en. According to the text linked to, LinkedIn relies on the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

We use the LinkedIn Insight Tag, a conversion tracking cookie. If you have accessed our website via LinkedIn, this will allow us to recognise that you have interacted with our ad and have been redirected to our website. For more information about how LinkedIn processes your data, please see LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy?. 

LinkedIn processes the URL, referrer, IP address, information about your device and browser (user agent), time of access and your usage behaviour on our website. We receive aggregated anonymized reports about the demographics of our target audience and the performance of our campaigns and can use this to draw conclusions for our product. We also have the ability to retarget, which allows us to display targeted advertising outside of our website. 

The legal basis for the processing for the use of LinkedIn Insight Tag is your consent (Art 6(1)(a) GDPR) pursuant to Sec 25(1) TTDSG. You also have the option to withdraw your consent at any time with effect for the future, by adjusting your cookie settings here. Alternatively, you can change your settings at any time by clicking on the link “Cookie settings.” The link is located in the footer of our website. 

Further, you have the option to prevent LinkedIn from collecting your data generated by the cookie and related to your use of websites, as well as the processing of this data by withdrawing your consent here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. If you are a LinkedIn member, you can control the use of your data for advertising purposes through your account settings here: https://www.linkedin.com/psettings/advertising/actions-that-showed-interest. 

110.7 Twitter Ads

Provided you have given your consent; we use a tag from Twitter for Business, a service provided by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (“Twitter”). 

Your data are processed in the United States. There exists no adequacy decision of the EU Commission for the United States. For this reason, we and Twitter entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

With the help of the Twitter universal tag we collect the time and date of your visit, the links you clicked, [●]. Further, we receive aggregated metric reports about user behaviour from Twitter. That data help us to analyse our conversion rate and to understand user behaviour on our website as well as tweet engagement and thus allow us increasing the performance of our website and of our Twitter activities. 

The legal basis for using the tag from Twitter is pursuant to Sec 25(1) TTDSG your consent, Art 6(1)(a) GDPR. You also have the option to withdraw your consent at any time with effect for the future, by adjusting your cookie settings here. Alternatively, you can change your settings at any time by clicking on the link “Cookie settings.” The link is located in the footer of our website. 

For more information, please see Twitter’s privacy policy at https://twitter.com/en/privacy. You can opt-out of interest-based advertising at Twitter here: https://help.twitter.com/de/safety-and-security/privacy-controls-for-tailored-ads. 

110.8 Drip
111 Integrated Third-Party Content

Provided you have given your consent, we use the ads service Google Ads. 

Pursuant to Sec 25(1) TTDSG Google Ads Services uses cookies and similar technologies as described below based on your consent, Art 6(1)(a) GDPR.   

You also have the option to withdraw your consent at any time with effect for the future, by adjusting your cookie settings here. Alternatively, you can change your settings at any time by clicking on the link “Cookie settings.” The link is located in the footer of our website. 

111.1 YouTube

We embed YouTube Videos on our website. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). 

The respective videos are loaded directly from YouTube’s servers; your end device will transmit certain technically necessary data to Google in the process. In particular, Google may be able to take note of your IP address. To the extent that this entails the processing of your personal data by Google, you will find further information in Google’s privacy policy here: https://www.google.com/policies/privacy/. 

Please note that your personal data may be shared by Google with other Google entities as well as other third parties. That sharing entails that personal data are transferred to the United States and to other third countries, for which no adequacy decision of the EU Commission exists. In this case, Google relies on the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

In Google’s privacy policy, you will find information on the settings options for your Google account. As your Google account may be in use for various different Google services (e.g., Gmail, YouTube, Google Search), Google may combine your personal data relating to each Google service you use depending on the settings of your Google account. 

We embed YouTube videos on our website in order to be able to provide you with the corresponding content and the respective functionalities. Therein lie our legitimate interests, Art 6(1)(f) GDPR. 

111.2 Google Fonts

Our website uses fonts from Google Fonts, a service of Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043, USA (“Google”). 

The fonts are loaded directly from Google’s servers; your end device will transmit certain technically necessary data to Google in the process. This includes your IP address. 

Your data are processed in the United States. There exists no adequacy decision of the EU Commis-sion for the United States. For this reason, we and Google entered into the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR.  

Google’s privacy policy is available here: https://www.google.com/policies/privacy/. You will find further information on the processing of data in connection with Google Fonts here: https://developers.google.com/fonts/faq. 

Google Fonts are integrated using the programming language called JavaScript. Using, e.g., a JavaScript blocker will prevent Google Fonts from loading. 

The legal basis for the processing of your personal data and the integration of Google Fonts is Art 6(1)(f) GDPR. We have a legitimate interest in making our website more visually appealing, in ensuring the consistency of the typeface on all end devices as well as in operating it economically. 

112 Social Media

112.1 Processing of Your Personal Data

Whenever you visit us on social media (Facebook, Twitter, LinkedIn or YouTube), we process certain personal data about you: for instance, whenever you interact with our page or our account; whenever you like, respond, or comment on a post; or whenever you provide other content. As a matter of routine, such personal data are processed based on the legitimate interest we have in providing you with relevant social media features (Art 6(1)(f) GDPR) and on the consent you have given to the respective platform operators (Art 6(1)(a) GDPR); or on your contractual relationship with the operators of the respective platforms (Art 6(1)(b) GDPR). 

We also process your personal data to receive, process and answer communication you might direct to us through social media. The legal basis for the processing of your personal data is Art 6(1)(f) GDPR. The processing is necessary for the purpose of our legitimate interests in taking into account and processing any enquiries, messages and comments you send to us through social media. 

112.2 Processing of Your Personal Data by the Operators of the Social Media Networks

The operators of the social media networks collect and process your personal data (such as your IP address and / or other unique identifiers) in their own responsibility and / or as controllers (within the meaning of Art 4 No 7 GDPR) when you visit our pages and profiles or interact with our content within the respective social network. In particular, in the case that you are registered or logged in to the respective social network at that time.  

Please be aware that the operators of the respective social media networks use cookies and similar technologies, e.g., to determine whether you are already logged in or registered as a user on the respective network or in other products, apps, and platforms of the operator. In addition, the operators of the respective platforms also use these technologies, in particular, to track your behaviour for the purpose of profiling for analysis and advertising purposes. Your behaviour can also be tracked when you visit other websites and apps that integrate products of said operators. 

112.3 Our Social Media Accounts
112.3.1 Facebook

You will find us on Facebook at https://www.facebook.com/crealytics. 

For users outside the United States and Canada, Facebook is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta Platforms Ireland”). For users inside the United States and Canada, Facebook is operated by Meta Platforms, Inc., 1601 Willow Road Menlo Park, CA 94025, USA (“Meta Platforms, Inc.”), hereinafter also jointly referred to as “Meta”. 

You can find information concerning your personal data, as processed by Meta, at https://www.facebook.com/privacy/policy and at https://www.facebook.com/legal/terms/information_about_page_insights_data. The privacy policy also contains information regarding settings options for your Facebook account. 

Meta uses cookies and similar technologies; you can find further information about this Meta’s cookie policy at https://www.facebook.com/policies/cookies/. For information on how to manage your information with Meta, visit https://www.facebook.com/about/basics. 

It is possible that Meta Platforms Ireland will share your data within the Meta group and with other third parties. That sharing can entail that personal data are transferred to the United States and to other third countries, for which no adequacy decision of the EU Commission exists. In this case, Meta Platforms Ireland relies on the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. You can find additional information in Meta Platforms Ireland Limited’s privacy policy as well. 

In addition, we and Meta Platforms Ireland are joint controllers for so-called insights data, within the scope of the Page Insights functionality. which are generated whenever you visit our Facebook page. Insights data help Meta Platforms Ireland to analyse user behaviour on our Facebook page, and Meta Platforms Ireland Limited provides these data to us in anonymised form. Further, these insights data allow us anonymous evaluation of reach and popularity of our content on our Facebook page, page views, time spent with our content such as videos and posts, actions such as likes, comments and / or sharing of our posts. We can also set parameters such as filtering the evaluations by time period, by specific posts as well as choose additional characteristics, such as demographic criteria (e.g. by age and gender). 

Meta provides further information at https://www.facebook.com/help/pages/insights. With Page Insights, we can analyse and optimise the effectiveness of our Facebook activities. Therein lie our legitimate interests, Art 6(1)(f) GDPR. 

For this purpose, we have entered into a joint controller addendum with Meta Platforms Ireland Limited, which you can review here: https://facebook.com/legal/terms/page_controller_addendum. In this addendum, Meta Platforms Ireland agrees to assume primary responsibility under the GDPR for the processing of insights data and to comply with all applicable obligations under the GDPR with respect to its processing of insights data. 

112.3.2 Twitter

We maintain a Twitter profile at https://twitter.com/crealytics 

For users outside the United States, Twitter is operated by Twitter International Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07, Ireland (“Twitter International”). For users inside the USA, Twitter is operated by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (“Twitter, Inc.”), hereinafter also jointly referred to as “Twitter”.  

You can find Twitter’s privacy policy at https://twitter.com/en/privacy. Twitter uses cookies and similar technologies; you can find further information about this in Twitter International’s cookie policy at https://help.twitter.com/de/rules-and-policies/twitter-cookies#. For information on how to manage your Twitter account and your information, visit https://help.twitter.com/de/managing-your-account and https://help.twitter.com/de/safety-and-security as well as https://twitter.com/settings/account/personalization 

We use Twitter Analytics and therewith receive from Twitter International non-personal information about your interactions and use of our Twitter page. 

Please note that your data may be shared by Twitter International with other Twitter entities as well as other third parties. That sharing entails that personal data are transferred to the United States and to other third countries, for which no adequacy decision of the EU Commission exists. In this case, Twitter relies on the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

With Twitter Analytics, we can carry out anonymised evaluations of the reach and actions (likes, comments, retweets) as well as, e.g., according to certain characteristics, such as location information provided by Twitter user in their profiles and / or tweets. For this, we can also set parameters such as filtering the evaluations by time period, by specific tweets as well as choose the weighting of certain characteristics, such as the location and / or interest of our followers. With this information, we can analyse and optimise the effectiveness of our Twitter activities. Therein lie our legitimate interests, Art 6(1)(f) GDPR. 

112.3.3 LinkedIn

We also have a LinkedIn profile, located at https://www.linkedin.com/company/crealytics-gmbh 

For users residing within the EEA and in Switzerland, LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn Ireland”). For all other users, LinkedIn is operated by LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085, USA (“LinkedIn Corporation”), hereinafter also jointly referred to as “LinkedIn”.  

LinkedIn’s privacy policy can be found at https://www.linkedin.com/legal/privacy-policy. This privacy policy also contains information regarding settings options for your LinkedIn profile. LinkedIn uses cookies and similar technologies; you can find further information about this in LinkedIn ’s cookie policy at https://www.linkedin.com/legal/cookie-policy and in the privacy policy at https://www.linkedin.com/legal/privacy-policy. 

Please note that your data may be shared by LinkedIn Ireland with other LinkedIn entities as well as other third parties. That sharing entails that personal data are transferred to the United States and to other third countries, for which no adequacy decision of the EU Commission exists. In this case, LinkedIn relies on the standard contractual clauses adopted by the EU Commission in accordance with Art 46(2)(c) GDPR. 

In addition, we and LinkedIn are joint controllers for so-called page insights data, which are generated whenever you visit our LinkedIn page. For this purpose, we have entered into a joint controller addendum with LinkedIn, which you can review at https://legal.linkedin.com/pages-joint-controller-addendum. In this addendum, LinkedIn agrees to assume primary responsibility under the GDPR for the processing of page insights data and to comply with all applicable obligations under the GDPR with respect to its processing of page insights data. 

From LinkedIn, we receive non-personal information and analyses regarding the use of our account and interactions with our posts in connection with page insights. With this information, we are able to analyse and to optimise the effectivity of our LinkedIn activities.  

For this purpose, LinkedIn processes data including, but not limited to, the data you have provided to LinkedIn through the information in your profile. That information includes, for instance, your job title, country, industry, company size and employment status. LinkedIn also processes information regarding how you interact with our LinkedIn page: for example, whether you follow us on LinkedIn. We may filter this information according to the above-mentioned demographic criteria. 

The processing of data in connection therewith is based on the legitimate interests we have in optimising our LinkedIn activities, Art 6(1)(f) GDPR. 

112.3.4 YouTube

We have a YouTube channel, located at https://www.youtube.com/c/crealytics 

YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). 

Google’s privacy policy can be found at https://policies.google.com/privacy. This privacy policy also contains information regarding settings options for your Google account. Google uses cookies and similar technologies; Google provides further information about this at https://policies.google.com/technologies/cookies?hl=de. 

As your Google account may be in use for various different Google services (e.g., Gmail, YouTube, Google Search), Google may combine your personal data relating to each Google service you use depending on the settings of your Google account. 

We use YouTube Analytics. As part of this, we receive non-personal and aggregated information from Google about user interactions with the content we make available on YouTube as well as about the use of our YouTube channel 

Further, YouTube Analytics allows us anonymous evaluation of reach and popularity of our YouTube videos among subscribers and non-subscribers as well as view count, playback times, community posts and audience engagement based on likes and dislikes as well as click-through rates. YouTube Analytics enables us to carry out the above-mentioned evaluations according to target groups (e.g. age and gender, regions and languages) and to compare this data with online activities outside our YouTube channel.  

With this information we can analyse and optimise the effectiveness of our YouTube activities. Therein lie our legitimate interests, Art 6(1)(f) GDPR. 

113 Sharing Personal Data

In addition to the constellations described above, we will only share or otherwise disclose your personal data in the cases specified below: 

113.1

If necessary, for purposes of investigating the unlawful use of our website or products and services or for purposes of establishing our rights, personal data will be shared with law enforcement agencies and, where applicable, with injured third parties. Personal data will be shared, however, only if specific evidence exists, which is indicative of illicit or abusive conduct. Personal data can also be shared, when sharing that data serves to enforce terms of use or other agreements. Furthermore, we are required by law to provide information to certain public agencies. These include law enforcement agencies, government authorities that prosecute misdemeanours subject to fines, and fiscal authorities. 

Your personal data may also be shared if we are subject to further claims by third parties that include disclosure your data. These may include, in particular, claims by data subjects in the context of exercising their rights under Chapter III of the GDPR. 

Personal data will be shared not only on the basis of the legitimate interest we have in combatting abuse; in prosecuting crimes; and in securing, establishing, and enforcing claims, Art 6(1)(f) GDPR, but also on the basis of a statutory obligation, as contemplated by Art 6(1)(c) GDPR. 

113.2

We disclose personal data to auditors, accounting service providers, lawyers, banks, tax consultants and similar bodies insofar as this is necessary for the provision of our services (Art6(1)(b) GDPR) or the proper operation of our business and establishment, exercise or defence, (Art6(1)(f) GDPR) or we are obliged to do so (Art6(1)(c) GDPR). 

113.3

In providing our website and related functionalities as well as our services, we rely on third-party undertakings and third party service providers (“processors” within the meaning of Art 4 No 8, 28 GDPR). In these cases, personal data are shared with these processors for further processing. These processors process personal data on our behalf and in accordance with our instructions. 

Beyond the processers already specified in this privacy policy, we engage the following categories of processers: 

  • IT service provider 
  • Cloud service provider 
  • Hosting service provider 
  • Software service provider 
113.4

In the course of developing our business, it is possible that the structure of our undertaking will be changed, by changing its legal form; by establishing, selling, or buying subsidiaries or business divisions. In the event of such transactions, personal data will be transferred, together with any portion of the business to be transferred. In the event personal data are shared with third parties within the scope de-scribed above, we shall ensure that those data are shared in accordance with applicable data protection law. 

Sharing personal data is justified on the grounds that we have a legitimate interest in changing the form of our undertaking to align, whenever necessary, with the economic and legal particularities on the ground, Art 6(1)(f) GDPR. 

114 Third Country Transfers

We also process data in countries outside the European Economic Area (“EEA”), in so-called third countries, and/or transfer data to recipients in these third countries. The foregoing also includes the United States. Please note that, at present, there exists no adequacy decision of the EU Commission; that, in general, these third countries have an adequate level of data protection. In particular, there exists, at present, no adequacy decision of the EU Commission for the United States. Where we transfer personal data outside of the EEA, we will ensure one of the following requirements is fulfilled: 

  • the transfer is to a third country which has an adequacy decision by the EU Commission, Art 45 GDPR; 
  • the transfer is covered by a contractual agreement, which covers the GDPR requirements relating to transfers to third countries, in particular standard contractual clauses (or also called standard data protection clauses) pursuant to Art 46(2)(c) GDPR adopted by the EU Commission extended by additional safeguards according to the European Court of Justice findings in Schrems-II; 
  • the transfer is to an organization which has binding corporate rules approved by an EU data protection authority, Art 46(2)(b), 47 GDPR;  
  • the transfer is covered by other approved safeguards pursuant to Art 46 GDPR in order to protect your personal data in a degree that equals the level of data protection in the European Union; or 
  • the transfer is subject to a specific derogation in the GDPR pursuant to Art 49 GDPR, e.g. where you have provided your explicit consent for the transfer or your personal data or the transfer is necessary for the establishment, exercise or defence of legal claims 

You can request further details about the safeguards that we have implemented, including, where applicable a copy of the standard contractual clauses by contacting us using our contact details provided in sec 1 above.

115 Providing Your Personal Data

Although, your data is, in part, automatically transmitted when you access our website, you are neither by law nor by contract required to provide your personal data in connection with the use of our website.  

To some extent, however, it is necessary that you provide personal data, so that we can provide you with our services and the features available on our website. In particular, it is necessary that you provide your personal data, so that we can  

  • take into receipt and process any requests, comments or questions you send to us;  
  • provide you with an on-demand webinar you have requested; 
  • accept and process your job application;  
  • otherwise allow for contract initiations and performances; and  
  • provide you with our newsletter. 

Wherever it is necessary for you to provide certain data, we have identified that data by making it a required field. Providing further data is voluntary. The consequence of not providing required data is that we will be unable to provide the relevant services and features mentioned above. 

Where voluntary information is concerned, the consequence of your not providing it will be that we will be unable to provide the aforementioned relevant features and services or that we will be unable to provide them as they are intended to be provided.

116 Automated Individual Decision-Making, including Profiling

We do not use automated individual decision-making processes or profiling. 

117 Erasure of Your Personal Data

As a general rule, we store your data for the duration of usage or the contractual relationship. Otherwise, we erase your personal data once they are no longer needed for the purposes for which we have collected or processed them in accordance with this privacy policy. 

Further storage of your personal data only occurs to the extent: 

  • that we are bound by law to retain your data, Art 6(1)(c) GDPR. In particular, statutory rules and regulations governing storage of data can arise from the retention periods contemplated by the Handelsgesetzbuch (Commercial Code) or by the Abgabenordnung (German Fiscal Code). The retention periods contemplated by these statutes are usually between 6 and 10 years. 
  • to the extent the data is required for criminal prosecution or for the establishment, exercise or defence of legal claims. Therein also lies our legitimate interest, Art 6(1)(f) GDPR. In these constellations, we will store your personal data until the corresponding process has been completed, plus the statutory period of limitation.  

In these cases, the processing of your data is restricted. The data is then no longer available for further use.  

118 Your Rights

Unless otherwise specified in this privacy policy, please use the contact address specified in Sec 1 to exercise your right, as set out below. 

118.1 Right of Access

Within the scope of Art 15 GDPR and Sec 34 BDSG, you have the right to obtain from us, access to the personal data concerning you. 

118.2 Right to Rectify Inaccurate Data

You have the right to obtain from us without undue delay the rectification of any inaccurate personal data concerning you.  

118.3 Right to Erasure

Given the prerequisites described in Art 17 GDPR and Sec35 BDSG, you have the right to obtain from us the erasure of personal data concerning you.  

118.4 Right to Restriction of Processing

Under Art 18 GDPR, you have the right to obtain from us the restriction of processing. 

118.5 Right to Data Portability

Under Art 20 GDPR, you have the right to receive from us the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. 

118.6 Right to Withdraw Your Consent

Where the processing is based on your consent (Art6(1)(a) GDPR), you have the right to withdraw your consent at any time with effect for the future.

118.7 Right to object

Under Art 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which, inter alia, is based on point (e) or (f) of Art 6(1). We shall no longer process your personal data, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims. 

To the extent we process personal data concerning you for direct marketing purposes, including profiling, you have the right to object to such processing. Once you object, we will stop such processing. 

118.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority of your choice. 

119 Data Processed When You Exercise Your Rights

Finally, we advise that we process the personal data transmitted by you, when you exercise your rights under Art 7(3)(1) as well as Art 15 through 22 GDPR, not only for the purpose of complying with these rights, but also so that we can demonstrate such compliance. Further, we will process your personal data to defend our legal position. 

Personal data will be stored for a period equal to the respective statutes of limitation, that is: three years, commencing as of the end of the year in which your data subject right request was fully processed. 

This processing for the purpose of complying with your data subject rights request and demonstration of such compliance is based upon the legal basis of Art 6(1)(c) GDPR in conjunction with Art 7(3)(1) and Art 15 through 22 GDPR and Sec 34(2) BDSG. To the extent that we process your personal data in connection with your data subject rights request to defend our legal position, therein also lies our legitimate interest, Art 6(1)(f) GDPR. 

Neither by law nor by contract are you required to provide your personal data, however, we may refuse to act on your request to exercise your data subject rights pursuant to Art 12(2)(2) and (6) GDPR, if you do not provide us, after being requested to do so, with the data required for your identification.

120 Changes to this Privacy Policy

You can access the current version of this privacy policy at any time at https://crealytics.com/privacy-policy/