Privacy Policy

1. Introduction

In the following, we inform you about the processing of personal data when using

• our websites https://www.dealcode.ai/ and https://app.dealcode.ai/
• our social media profiles.

Personal data means any information relating to an identified or identifiable natural person, such as name, email address, or IP address.

1.1. Controller and Contact Information

The Controller within the meaning of Art. 4 No. 7 EU General Data Protection Regulation (GDPR) is Dealcode GmbH, Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany, email: datenschutz@dealcode.ai. We are legally represented by Alexander Weltzsch (CEO) and Dennis Hilger (COO).

Our designated Data Protection Officer is heyData GmbH, Kantstr. 99, 10627 Berlin, Germany, www.heydata.eu, email: datenschutz@heydata.eu.

1.2. Scope of Processing, Purposes, and Legal Bases

We explain the scope of data processing, purposes, and legal bases in detail below. The legal grounds for our data processing activities are generally:

• Art. 6(1) sentence 1 lit. a GDPR: Serves as the legal basis for processing operations for which we obtain consent.
• Art. 6(1) sentence 1 lit. b GDPR: Serves as the legal basis where processing is necessary for the performance of a contract or prior to entering into a contract, e.g., when a visitor purchases a product or requests an offer.
• Art. 6(1) sentence 1 lit. c GDPR: Applies where processing personal data is necessary for compliance with a legal obligation, such as statutory tax and accounting retention requirements.
• Art. 6(1) sentence 1 lit. f GDPR: Serves as the legal basis where processing is necessary to pursue our legitimate business interests, e.g., technical cookies required for website operation and IT security.

1.3. Data Transfers Outside the EEA

Where we transfer data to service providers or third parties located outside the European Economic Area (EEA), we ensure data protection safeguards through adequacy decisions of the European Commission pursuant to Art. 45(3) GDPR (e.g., for the United Kingdom, Canada, and Israel).

Where no adequacy decision exists (e.g., for the USA), the legal basis for data transfers is generally the Standard Contractual Clauses (SCCs) issued by the EU Commission pursuant to Art. 46(2) lit. c GDPR. In addition to SCCs, many of our service providers have implemented supplementary technical and contractual guarantees, such as end-to-end data encryption and commitments to notify data subjects in case of government access requests.

1.4. Retention Period

Unless explicitly specified otherwise in this Privacy Policy, personal data stored with us will be deleted as soon as it is no longer required for its intended purpose and statutory retention periods have expired. If data cannot be deleted due to legal retention obligations (e.g., commercial or tax law retention requirements), its processing is restricted and segregated from active use.

1.5. Rights of Data Subjects

As a data subject, you have the following rights under the GDPR regarding your personal data:

• Right of access (Art. 15 GDPR),
• Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to object to processing (Art. 21 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to withdraw granted consent at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a supervisory authority concerning the processing of your personal data. A list of data protection supervisory authorities can be accessed at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6. Obligation to Provide Data

In business relationships, customers and prospective clients must only provide personal data that is strictly required to establish, execute, and terminate the contractual relationship, or that we are legally required to collect. Without this data, we are generally unable to conclude a contract or perform services.

1.7. Automated Decision-Making

We do not utilize fully automated decision-making processes or profiling pursuant to Art. 22 GDPR to establish or implement business relationships.

1.8. Contacting Us

When you contact us (e.g., via email, contact form, or phone), the information you provide (such as your name and email address) is stored to answer your inquiries. The legal basis for processing is our legitimate interest in handling inquiries (Art. 6(1) sentence 1 lit. f GDPR). We delete the resulting data once storage is no longer required or restrict processing where statutory retention applies.

1.9. Customer Surveys

From time to time, we conduct voluntary customer surveys to optimize our services. The legal basis is our legitimate interest pursuant to Art. 6(1) sentence 1 lit. f GDPR in enhancing customer satisfaction. Survey data is deleted once evaluations are finalized.

2. Newsletter & Direct Marketing

We reserve the right to inform existing customers who have utilized our services from time to time via email regarding our offerings, provided they have not objected. The legal basis is our legitimate interest in direct marketing pursuant to Art. 6(1) sentence 1 lit. f GDPR (Recital 47 GDPR). You may object to the use of your email address for advertising purposes at any time without incurring costs (e.g., via the unsubscribe link at the bottom of each email).

Prospective clients may subscribe to a free newsletter. Data provided upon registration is used exclusively for dispatching the newsletter. The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. Consent may be revoked at any time.

Based on recipient consent, we also evaluate opening and click rates to optimize content relevancy.

Woodpecker: Woodpecker.co S.A., 29D Krakowska STR, 50-424, Wrocław, Poland (Privacy Policy: https://woodpecker.co/privacy-policy/). The provider processes content, usage, and communication data within the EU.

HubSpot: HubSpot, Inc., 25 1st Street, Cambridge, MA 02141, USA (Privacy Policy: https://legal.hubspot.com/privacy-policy). The provider processes usage, communication, and contact data within the EU.

Intercom: R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 St. Stephen's Green, Dublin 2, Ireland (Privacy Policy: https://www.intercom.com/legal/privacy). The provider processes communication and user data in the USA based on SCCs.

3. Data Processing on Our Website

3.1. Informational Website Visits

When you visit our website for informational purposes without submitting data, we collect technical data transmitted by your browser to ensure website stability and security. This constitutes our legitimate interest (Art. 6(1) sentence 1 lit. f GDPR).

Data collected includes: IP address, date and time of request, time zone difference to GMT, requested page/URI, HTTP status code, transferred data volume, referrer URL, browser type, operating system, and language settings. Log files are deleted within 14 days.

3.2. Web Hosting

Our website is hosted with GoDaddy (GoDaddy.com LLC, 2155 E. GoDaddy Way, Tempe, AZ 85284, USA). The provider processes website traffic data within the EU. The legal basis is our legitimate interest in providing a reliable, secure website (Art. 6(1) sentence 1 lit. f GDPR). Further information is available in the provider's privacy policy at https://www.godaddy.com/legal/agreements/privacy-policy.

3.3. Contact Form

When submitting inquiries via our website contact form, submitted data and message content are processed to respond to your request (Art. 6(1) sentence 1 lit. f GDPR).

3.4. Job Applications

We process applicant data strictly for carrying out application procedures. The legal basis under German law is Art. 88(1) GDPR in conjunction with Section 26(1) BDSG. Unsuccessful applicant data is deleted after six months, unless consent for extended talent pool retention is granted (Art. 6(1) sentence 1 lit. a GDPR).

3.5. Appointment Booking

Visitors may schedule meetings with our team online. The legal basis is our legitimate interest in providing seamless scheduling (Art. 6(1) sentence 1 lit. f GDPR).

3.6. Technically Necessary Cookies

We employ essential cookies strictly required for website operation and security (Art. 6(1) sentence 1 lit. f GDPR), such as language preference cookies and session authentication tokens.

3.7. Third-Party Tools & Analytics

3.7.1. HubSpot

We utilize HubSpot for customer relationship management and inbound marketing. Provider: HubSpot, Inc., 25 1st Street, Cambridge, MA 02141, USA. Data is processed within the EU. Legal basis: Art. 6(1) sentence 1 lit. f GDPR. Privacy policy: https://legal.hubspot.com/privacy-policy.

3.7.2. Weglot

We use Weglot for website localization and translation. Provider: Weglot, 138 rue Pierre Joigneaux, 92270 Bois-Colombes, France. Data is processed within the EU. Legal basis: Art. 6(1) sentence 1 lit. f GDPR. Privacy policy: https://weglot.com/privacy/.

3.7.3. Zapier

We utilize Zapier for automated workflow integrations between internal tools. Provider: Zapier, Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, USA. Data transfer to the US is safeguarded by EU Standard Contractual Clauses. Legal basis: Art. 6(1) sentence 1 lit. f GDPR. Privacy policy: https://zapier.com/privacy.

3.7.4. Webflow

We use Webflow for web page design and content rendering. Provider: Webflow, Inc., 398 11th St., Floor 2, San Francisco, CA 94103, USA. Data transfers are secured by Standard Contractual Clauses. Legal basis: Art. 6(1) sentence 1 lit. f GDPR. Privacy policy: https://webflow.com/legal/eu-privacy-policy.

3.7.5. Facebook Pixel

We deploy Facebook Pixel for analytics and campaign performance tracking. Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Legal basis: Your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. Transfers to the USA are safeguarded by Standard Contractual Clauses. You may withdraw consent at any time via the cookie settings. Privacy policy: https://www.facebook.com/policy.php.

3.7.6. Google Analytics

We utilize Google Analytics for website traffic measurement. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. Data transfers to the USA are based on Standard Contractual Clauses. You can revoke consent at any time via our cookie banner. Privacy policy: https://policies.google.com/privacy.

3.7.7. Typeform

We use Typeform to gather feedback and online submissions. Provider: Typeform S.L., 163 Carrer de Bac de Roda, Barcelona, Spain. Legal basis: Art. 6(1) sentence 1 lit. f GDPR. US transfers are protected by Standard Contractual Clauses. Privacy policy: https://admin.typeform.com/to/dwk6gt.

3.7.8. SalesViewer

Use of SalesViewer: This website uses SalesViewer technology by SalesViewer GmbH to collect and store company-related data of website visitors (such as company name, industry, turnover, key personnel).

Purpose and Legal Basis: Data is processed for marketing, sales optimization, and B2B lead generation purposes. The legal basis for using SalesViewer is your consent granted pursuant to Art. 6(1) lit. a GDPR and § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future.

Retention Period: Collected data is erased as soon as it is no longer required for its collection purpose and no statutory retention obligations prevent deletion.

Opt-Out / Revocation: You can object to the collection and storage of your data at any time with effect for the future by preventing the service from running (e.g., by revoking consent in the cookie settings).

4. Data Processing on Social Media Platforms

We maintain corporate profiles on social media networks to present our company and communicate with prospects and clients. When visiting these pages, network operators process user data for advertising and profiling purposes.

4.1. Facebook

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy Policy: https://www.facebook.com/policy.php. Ad Settings: https://www.facebook.com/settings?tab=ads.

4.2. Instagram

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy Policy: https://help.instagram.com/519522125107875.

4.3. Twitter / X

Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Privacy Policy: https://twitter.com/privacy.

4.4. LinkedIn

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy Policy: https://www.linkedin.com/legal/privacy-policy. Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

4.5. Xing

New Work SE, Dammtorstraße 29-32, 20354 Hamburg, Germany. Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

5. Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy to ensure continuous compliance with legal requirements or to reflect changes in our service offerings.

6. Inquiries and Contact

If you have questions or inquiries regarding this Privacy Policy, please contact us at datenschutz@dealcode.ai.