We are a Data Controller of your information. Our legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Information we collect and the specific context in which we collect the information:

• We need to perform a contract with you
• You have given us permission to do so
• Processing your personal information is in our legitimate interests
• We need to comply with the law

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. If you wish to be informed what Personal Information we hold about you and if you want it to be removed from our systems, please contact us.

• The right to access, update or delete your information
• The right of rectification
• The right to object
• The right of restriction
• The right to data portability
• The right to withdraw consent

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When we no longer need your personal information, we will delete or anonymize it in a secure manner.

Specifically:

• Account information: Retained for the duration of your account plus 3 years after account closure
• Transaction records: Retained for 10 years as required by German tax law
• Log files: Retained for 30 days for security and performance monitoring
• Marketing communications: Until you unsubscribe or request deletion

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response procedures

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

Your personal information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country.

When we transfer personal information from the European Economic Area (EEA) to other countries, we ensure appropriate safeguards are in place, such as:

• European Commission adequacy decisions
• Standard contractual clauses approved by the European Commission
• Certification schemes and codes of conduct

If you have additional questions or require information about our Privacy Policy, please contact us at:

For data protection matters specifically, you can also contact your local data protection authority.