Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Buzz­matic GmbH & Co. KG
Schönhauser Allee 149
10435 Berlin
Germany

Phone: +49 30 440 45433
Email: info@buzzmatic.net

Commercial register: Amtsgericht Charlottenburg (Berlin), HRA 56401 B

General partner: Buzz­matic Verwaltungs GmbH, registered office Berlin, Amtsgericht Charlottenburg (Berlin), HRB 209563, represented by its managing directors Raoul Schreck and Oguzhan Kalkan.

Data protection contact: Raoul Schreck, datenschutz@buzzmatic.net, or at the postal address above marked “Datenschutz”.

We only process personal data where this is necessary to provide a functional website, our content and our services, or where you have given your consent. We rely on the following legal bases:

• Consent (Art. 6(1)(a) GDPR; where information is stored on or accessed from your device, additionally Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG)
• Contract and pre-contractual measures (Art. 6(1)(b) GDPR), for example when you send us an enquiry about our services
• Legal obligation (Art. 6(1)(c) GDPR), for example statutory retention obligations under commercial and tax law
• Legitimate interests (Art. 6(1)(f) GDPR), for example in the secure and stable operation of the website or in protection against spam and abuse. In these cases, access to your device is only permitted where it is strictly necessary (Section 25(2) no. 2 TDDDG).

For each processing activity below, we state the applicable legal basis.

3.1 Hosting with Vercel

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The servers running our website are located in Frankfurt am Main, Germany. When you access the website, Vercel processes technically necessary data, in particular:

• IP address
• date and time of access
• requested URL and referrer URL
• browser type and version, operating system
• amount of data transferred and HTTP status code

This data is required to deliver the website to you, to ensure its stability and security, and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Vercel stores these log data only for a short period and then deletes them.

We have concluded a data processing agreement with Vercel. Vercel is certified under the EU-US Data Privacy Framework. The EU Standard Contractual Clauses apply in addition.

3.2 Database and media storage

We store website content and the data you submit through forms in a database operated by Neon, Inc. (a Databricks, Inc. company), USA. The database runs in an Amazon Web Services data centre in Frankfurt am Main. Images and files of the website are stored in Vercel Blob, a storage service of Vercel Inc. Data processing agreements are in place with both providers. Any transfer to the USA is covered by the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

3.3 Fonts

We serve the Montserrat font locally from our own servers. No connection to Google servers is established for this.

3.4 SSL/TLS encryption

For security reasons, our website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

4.1 General

We and the services we use store information on your device or read it from your device, for example in the form of cookies or in your browser’s local storage (localStorage). We use technically necessary storage on the basis of Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. All other storage, in particular for analytics and marketing purposes, only takes place with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

4.2 Our cookie banner

On your first visit, our cookie banner asks whether you consent to the categories “Analytics” and “Marketing”. Without your consent, we do not load any analytics or marketing services. We store your choice on your device so that we do not have to ask you again on every visit.

You can withdraw or change your consent at any time with effect for the future by clicking “Cookie settings” in the footer of the website. The lawfulness of processing carried out before the withdrawal remains unaffected.

4.3 Google Consent Mode

We use Google’s Consent Mode. It ensures that Google services do not set analytics or advertising cookies before you consent and that they respect the choice you have made.

4.4 Storage set by our website

These entries are required for the feature you are using and are not transmitted to us. You can delete them at any time in your browser settings. Cookies and storage used by third-party providers are described in the following sections.

We only use the following services if you have consented to the respective category. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time via “Cookie settings” in the footer of the website.

5.1 Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Tag Manager controls which analytics and marketing services are loaded on our website. Tag Manager itself does not create user profiles, but it processes your IP address in order to deliver the scripts. We only load it after you have consented to at least one category.

5.2 Google Analytics 4 (category “Analytics”)

We use Google Analytics 4, a web analytics service provided by Google. It helps us understand how visitors use our website so that we can improve content and usability. Google Analytics sets cookies (e.g. _ga, _ga_*) and processes in particular:

• pages viewed, time on page, scroll depth, clicks on outbound links, file downloads, video interactions, form interactions and site search terms
• approximate location (country, region, city), derived from the IP address
• technical information about device, browser and operating system
• source of the visit (e.g. search engine, referring website)

Google Analytics 4 does not store IP addresses. Google Signals is disabled, so no cross-device linking with Google accounts takes place.

Analytics data is deleted automatically after 14 months. We have concluded a data processing agreement with Google. Google may also transfer data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy

5.3 Microsoft Clarity (category “Analytics”)

We use Microsoft Clarity, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how you move around our website (mouse movements, clicks, scrolling) and produces heatmaps and session recordings from this. This helps us identify usability problems and improve the website. Input in form fields is masked and not captured. Clarity sets cookies (e.g. _clck, _clsk, CLID) and processes your IP address, device and browser information and interaction data.

Microsoft may also transfer data to the USA; Microsoft is certified under the EU-US Data Privacy Framework. More information: https://privacy.microsoft.com/en-gb/privacystatement

5.4 Albacross (category “Marketing”)

We use Albacross, a service provided by Albacross Nordic AB, Sweden. Based on the IP address, Albacross identifies which companies visit our website and shows us which pages were viewed. This allows us to assess which companies are interested in our services and to tailor our offering to business customers. For this purpose, Albacross sets cookies and processes your IP address, information about the pages viewed, the time and duration of the visit, and technical information about browser and device. The aim is to identify companies, not individual persons. However, as the IP address is personal data, we only use Albacross with your consent.

Processing takes place within the EU. We have concluded a data processing agreement with Albacross. More information: https://albacross.com/privacy-policy/

5.5 LinkedIn Insight Tag (category “Marketing”)

We use the LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It allows us to measure the success of our LinkedIn ads (conversion tracking), to receive statistical reports on the professional profile of our visitors, and to show relevant ads on LinkedIn to people who have visited our website (retargeting). The Insight Tag sets cookies and processes your IP address, device and browser information, the pages viewed and the time of the visit. If you are logged in to LinkedIn, LinkedIn may associate the visit with your account. We only receive aggregated reports that do not allow conclusions about individual persons.

We and LinkedIn are joint controllers for the collection of data on our website and its transmission to LinkedIn (Art. 26 GDPR). LinkedIn is solely responsible for any further processing. LinkedIn may transfer data to LinkedIn Corporation in the USA; LinkedIn is certified under the EU-US Data Privacy Framework. More information: https://www.linkedin.com/legal/privacy-policy

5.6 Meta Pixel (category “Marketing”)

We use the Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). It allows us to measure the effectiveness of our ads on Facebook and Instagram and to show relevant ads there to people who have visited our website. The pixel sets cookies and processes your IP address, browser and device information, the pages viewed and actions taken. If you are logged in to Facebook or Instagram, Meta may associate the visit with your account.

We and Meta are joint controllers for the collection of data on our website and its transmission to Meta (Art. 26 GDPR). The corresponding agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Meta may transfer data to Meta Platforms, Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework. More information: https://www.facebook.com/privacy/policy/

5.7 Google Ads: conversion tracking and remarketing (category “Marketing”)

We use Google Ads, provided by Google. Conversion tracking lets us measure whether you perform certain actions on our website after clicking one of our ads, such as sending an enquiry. Remarketing allows us to show you ads on other websites and in Google Search that relate to your visit to our website. For this purpose, Google sets cookies and processes your IP address, browser and device information, the pages viewed and the ad click. We only receive aggregated reports that do not allow conclusions about individual persons.

Google may transfer data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy and https://adssettings.google.com

To protect our forms (contact form and blog comments) against automated submissions and abuse, we use Google reCAPTCHA Enterprise, provided by Google. reCAPTCHA uses technical characteristics and usage behaviour to check whether an entry was made by a human or by an automated program. For this purpose, data including your IP address, browser and device information, mouse movements and time spent on the page is transmitted to Google. reCAPTCHA is only loaded when you scroll to the contact form or submit a comment.

The legal basis is our legitimate interest in protecting our website and forms against spam and abuse (Art. 6(1)(f) GDPR); access to your device is strictly necessary for this purpose (Section 25(2) no. 2 TDDDG). Google may transfer data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy

7.1 Contact form

When you use our contact form, we process the information you provide: name, email address and message (required) and, optionally, company and phone number. To prevent abuse, we also store an irreversible hash of your IP address together with the date and time of the enquiry. Your enquiry is stored in our database and forwarded to our team by email.

The purpose is to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion of a contract or to pre-contractual measures, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). Abuse prevention is based on Art. 6(1)(f) GDPR.

7.2 Email and phone

If you contact us by email or phone, we process your information to handle your request on the same legal bases.

7.3 Sending emails via Resend

For the technical delivery of emails sent from our website (e.g. notifications to our team about new enquiries), we use Resend, a service of Plus Five Five, Inc., USA. Resend processes the content of the respective email. We have concluded a data processing agreement with Resend; transfers to the USA are covered by the EU Standard Contractual Clauses.

7.4 Retention

We delete your enquiry once it has been fully dealt with, unless statutory retention obligations apply. If your enquiry leads to a contract, we retain business correspondence in accordance with the retention periods under commercial and tax law of up to six or eight years.

In our knowledge area, you can request a certificate and additional materials after completing a learning path. For this, we process your name, email address, the completed learning path and level, language, the time of your consent, and an irreversible hash of your IP address. Our team is notified of the request by email. The certificate is generated with your name but is not stored by us.

The legal basis is the consent you give in the form (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by emailing datenschutz@buzzmatic.net. We delete the data after you withdraw your consent, and no later than 24 months after the request.

When you comment on a blog post, we process your name, your comment, optionally your email address, and an irreversible hash of your IP address. We review comments before publication. Once approved, your name and comment are displayed publicly below the post. Your email address is not published; we only use it to contact you if we have questions about your comment.

The legal basis is Art. 6(1)(b) GDPR (provision of the comment feature) and our legitimate interest in open discussion and in preventing abuse (Art. 6(1)(f) GDPR). Comments remain stored as long as the post is online or until you request deletion.

Below articles in our knowledge area, you can indicate whether the article was helpful and optionally leave a comment. We store your rating, the comment, the language and an irreversible hash of your IP address. Feedback is not public and is used solely to improve our content. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Please do not enter personal data in the comment field.

Our website offers free tools, for example for analysing Google AI Overviews, SERP overlap, fetching web pages or measuring page speed. The terms, URLs, language and location settings you enter are sent via our servers to the following service providers to calculate the result:

• OpenAI Ireland Limited, Dublin, Ireland (AI analysis)
• DataForSEO OÜ, Tallinn, Estonia (search engine and keyword data)
• ScrapeNinja (fetching web pages)
• Google (PageSpeed Insights API)

Your IP address is not passed on to these providers; we only use it briefly to limit the number of requests per user. Your input is not stored. The legal basis is Art. 6(1)(b) GDPR (provision of the tool you requested). Please do not enter personal data into the tools.

On some pages we embed videos from YouTube (Google) and Vimeo (Vimeo.com, Inc., USA). The videos are only loaded when you click on them. Before that, no connection to YouTube or Vimeo is established. By clicking, you consent to a connection being established and to your IP address, browser and device information and the page viewed being transmitted to the respective provider (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com) and Vimeo videos with the “Do Not Track” setting enabled.

Both providers may transfer data to the USA; Google and Vimeo are certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy and https://vimeo.com/privacy

We publish our vacancies on our careers portal careers.buzzmatic.net, which is operated with Zoho Recruit, provided by Zoho Corporation B.V., Utrecht, Netherlands. You can apply there or by email to jobs@buzzmatic.net. We process your application documents in order to carry out the application process (Art. 6(1)(b) GDPR). If no employment relationship results, we delete your documents six months after the process has ended, unless you have consented to longer storage. We have concluded a data processing agreement with Zoho.

Our website links to our company profiles on social networks. These are simple links; visiting our website does not transmit any data to these networks. Only when you click a link do the privacy policies of the respective network apply. For the processing of data on our company profiles, we are in some cases joint controllers with the respective operator (Art. 26 GDPR).

We only pass your data on to the service providers named in this policy, and only where this is necessary for the respective purpose. Processors process the data exclusively on our instructions.

Some service providers are based in the USA or may transfer data there. For companies certified under the EU-US Data Privacy Framework, an adequacy decision of the European Commission applies (Art. 45 GDPR). Where no certification exists, we transfer data on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Unless a specific period is stated in this policy, we only store personal data for as long as necessary for the respective purpose or as required by statutory retention periods. The data is then deleted.

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons.

To exercise your rights, simply send a message to datenschutz@buzzmatic.net.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61
10555 Berlin, Germany
https://www.datenschutz-berlin.de

You are under no legal or contractual obligation to provide us with personal data. Without the information marked as required, however, we cannot process your enquiry or request. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.