3. Data Processing on the Website
3.1 Visiting the Website & Server Logs
Every time you visit our website, your browser automatically transmits information to our servers, which we store in what are known as server log files. This includes your IP address, the date and time of access, the URL accessed, the browser and operating system used, the referrer URL, and the amount of data transferred.
We have a legitimate interest in ensuring the stable and secure operation of the website. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. The data is deleted after 30 days at the latest, unless a statutory retention obligation applies.
3.2 Email Newsletter
We send newsletters and marketing emails through two separate channels:
We have a legitimate interest in ensuring the stable and secure operation of the website. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. The data is deleted after 30 days at the latest, unless a statutory retention obligation applies.
3.2 Email Newsletter
We send newsletters and marketing emails through two separate channels:
Channel
Tool / Provider
Recipient Group
Legal Basis
Nutzer-Newsletter
Brevo (Sendinblue SAS, Paris, FR)
App-Nutzerinnen und Website-Abonnentinnen
Bestandskundschaft: Art. 6 I f DSGVO (Direktwerbung, Ewgr. 47)Sonstige: Art. 6 I a DSGVO (Einwilligung)
B2B Communication & HR
HubSpot (HubSpot Inc., USA)
Company contacts, applicants, partners — not app user data
Art. 6 I f GDPR; third-country transfer: EU-US Data Privacy Framework (DPF)
Brevo processes open and click rates exclusively in aggregated form (no individual user tracking). § 25 para. 1 TDDDG applies to sending via Brevo insofar as tracking pixels are set — use is consent-based. Every email contains a simple unsubscribe link. Processing by Brevo takes place within the EU.
We use external services for hosting and fast delivery of our website. Meta/communication data (e.g. IP address, usage and content data) is transmitted in the process. The legal basis in all cases is Art. 6 para. 1 sentence 1 lit. f GDPR — we have a legitimate interest in providing sufficient storage and delivery capacity.
3.3 Hosting & Content Delivery Networks (CDN)
Service
Provider & Location
Data Processing
Third-Country Transfer
Webflow (Hosting)
Webflow, Inc., 398 11th St., San Francisco, CA 94103, US
EU servers; meta/communication data
Adequacy decision (EU-US DPF)
Vercel (CDN)
Vercel Inc., 340 S Lemon Ave Unit 4133, Walnut, CA 91789, USA
Data processed on EU servers; US company
Standard Contractual Clauses (SCCs) under Art. 46 para. 2 lit. c GDPR
Cloudflare (CDN)
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, US
EU servers; meta/communication data
Adequacy decision (EU-US DPF)
Amazon Cloud
Front (CDN) Amazon Web Services, Inc., P.O. Box 81226 Seattle, WA 98108, US
EU servers; meta/communication data
Adequacy decision (EU-US DPF)
All providers listed are contractually bound as data processors under Art. 28 GDPR.
3.4 Contact Form
When you contact us via our web form, we store the data you enter (name, email address, message content) as well as meta/communication data. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR — we have a legitimate interest in responding to inquiries directed to us. The data is deleted once the inquiry has been fully processed and no statutory retention obligation applies.
3.5 Job Postings & Applications
We publish job postings on our website as well as on third-party platforms. We process the data collected as part of the application process based on Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 BDSG for the purpose of conducting the application process. We ask applicants to refrain from including information about political opinions, religious beliefs, or other special categories of data in their resume and cover letter. If such information is provided anyway, the legal basis is consent under Art. 9 para. 2 lit. a GDPR. We only share application data with responsible employees and, where applicable, data processors in the recruiting field. Once the process is complete, we delete applicant data no later than six months after rejection, unless the applicant has consented to further storage (in which case up to one year).
3.6 Booking Appointments
Through our website, you can arrange appointments with us. In doing so, we process the data you enter (name, email address, preferred appointment) as well as meta/communication data. Appointment booking takes place via our own technical infrastructure, without integrating external booking tools. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR — we have a legitimate interest in enabling prospective clients to schedule appointments in a user-friendly way.
3.7 Third-Party Services
3.7.1 Piwik Pro (Website Analytics)
We use Piwik Pro to analyze usage behavior on our website. The provider is Piwik PRO SA, ul. Sw. Antoniego 2/4, 50-073 Wrocław, Poland. Piwik Pro processes meta/communication data (e.g. IP address, device data) exclusively on servers within the EU.
Processing takes place based on your consent. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. You can withdraw your consent at any time with future effect by contacting support@hermaid.me or adjusting the settings in the cookie banner. Withdrawal does not affect the lawfulness of processing carried out before it. More information: https://piwikpro.de/datenschutz/
3.7.2 heyData Privacy Seal
Our website includes the privacy seal of heyData GmbH. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g. IP addresses) within the EU; the data is masked immediately upon collection so that no personal reference remains. The seal serves to provide website visitors with confirmation of our data protection compliance and to ensure that only customers with an existing contract use the certificate. Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR and § 25 para. 2 no. 2 TDDDG (technically necessary access). More information: https://heydata.eu/datenschutzerklaerung
3.7.3 HubSpot (B2B Communication & HR)
We use HubSpot to manage company contacts, communicate with business partners, and support our HR processes. The provider is HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA. HubSpot processes contact data (name, email address, company) as well as communication data. App user data is not processed via HubSpot. Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in efficient B2B contact management). Third-country transfer to the USA: EU-US Data Privacy Framework (DPF). HubSpot is contractually bound as a data processor under Art. 28 GDPR.
More information: https://legal.hubspot.com/privacy-policy
.svg)
.svg)
