data privacy.

Privacy policy according to art. 13 and 21 DSGVO for circuly GmbH

1. general information
The protection of your personal data is important to us, circuly GmbH. Therefore we would like to offer you comprehensive transparency regarding the processing of your data. Because only if the processing is comprehensible for you as a data subject, you will be sufficiently informed about the scope, the purposes and the benefits of the processing.
The person responsible in terms of the Basic Data Protection Regulation (DSGVO), the Federal Data Protection Act (BDSG) and other data protection regulations is

Circuly GmbH
Obernstraße 50
33602 Bielefeld
+491729484913
info@circuly.io
www.circuly.io
Hereinafter referred to as "responsible party" or "we".

2. general information on data processing
We process personal data within the legally permissible limits. This means that data processing operations are based on a legal basis. These are standardized in Art. 6 para. 1 DSGVO. Most data processing operations are based on a legitimate interest on our part (Art. 6 para. 1 lit. f DSGVO), on processing operations necessary for the performance of the contract (Art. 6 para. 1 lit. b DSGVO) or on the basis of a consent granted by you (Art. 6 para. 1 lit. a DSGVO). In the latter case, you will be informed separately (e.g. via a cookie banner) of the consent procedure. Personal data will only be passed on in the cases described below (see no. 4.) Personal data is only processed by us for clear purposes (Art. 5 para. 1 lit. b DSGVO). As soon as the purpose of the processing ceases to apply, your personal data will be deleted or protected by technical and organizational measures (e.g. by pseudonymization). The same applies to the expiry of a prescribed storage period, subject to the cases in which further storage is necessary for the conclusion or fulfillment of a contract. In addition, a legal obligation to store the data for a longer period or to pass it on to third parties (in particular to law enforcement agencies) may arise. In other cases, the storage period and the type of data collected as well as the type of data processing depends on which Circuly functions you use in each individual case. We will be happy to provide you with information on this in individual cases, in accordance with Art. 15 DSGVO.

3. data processing in connection with the use of circuly software
The use of the circuly software with all its functions requires the processing of certain personal data.

3.1 Informational use of the circuly services
The purely informative calling of circuly requires the processing of the following personal data and information: Browser type and browser version, operating system used, address of previously visited websites, address of the terminal device with which you access circuly (IP address) as well as the time circuly is called up. All this information is automatically transmitted by your browser, unless you have configured your browser to suppress transmission of the information. This personal data is processed for the purpose of the functionality and optimization of circuly, as well as to ensure the security of our information technology systems. These purposes are at the same time legitimate interests according to art. 6 paragraph 1 letter f. DSGVO, the processing is therefore carried out with legal grounds. The storage period of your personal data is a maximum of 14 days. This personal data will not be merged with other data sources. Data will only be passed on to third parties in necessary cases. Subject to further provisions of this privacy policy, data will not be transferred to third countries or international organizations.

3.3 Contact form / Contact by e-mail / Application
We process the data you provide us with when contacting us for the purpose of answering your inquiry, your e-mail or your request for a callback. Processed data categories are master data, contact data, content data, possibly usage data, connection data and possibly contract data. In individual cases, we forward this data to companies affiliated with us, i.e. only within our company/group. The legal basis of the processing depends on the purpose: Basically, it is based on our legitimate interest and thus on Art. 6 para. 1 lit. f DSGVO; if the aim is to conclude a contract, the authorization is based on Art. 6 para. 1 lit. b DSGVO If the contact is made for the purpose of application, our authorization is based on Art. 88 para. 1 DSGVO in conjunction with Art. 88 para. 1 DSGVO. § Article 26 paragraph 1 BDSG

3.5 Payment processing
For the processing of payment claims, we integrate the Payment Service Provider described below into circuly via the profiles of our customers. We do this for the purpose of proper and demand-oriented provision of the services offered with circuly. Processed data in this context are usage data, connection data, master data, payment data, contact data or contract data. The legal basis for the use of payment service providers results from Art. 6 para. 1 lit. b DSGVO. We can only provide the services promised to you with our services and thus fulfil our contractual obligations if we use third parties, such as payment service providers, to process payment transactions. We process this data for you anonymously, thus releasing us from the obligation to conclude an order processing contract with the individual payment service providers. We have signed a contract with each of the payment service providers so that the security of the processing of your data is guaranteed at all times. The Payment Service Providers are in detail:
Braintree is a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal"). As part of the payment process, Braintree will receive your email address, shipping address and details of the price and scope of the items & services you purchased from us. Information provided to Braintree is not under our control and is subject to PayPal's Privacy Policy. This can be found here: https://www.paypal.com/de/webapps/mpp/ua/privacy-prev?locale.x=de_DE https://www.braintreepayments.com/en-de/legal/braintree-privacy-policy. The legal basis for the use of Payment Service Providers results from Art. 6 para. 1 lit. b DSGVO.

3.6 Tracking & Tools
To ensure a smooth technical process and an optimal user-friendly use of circuly we use the following tools:
Google Fonts We use Google Fonts for the purpose of making our website/our services more personal through the fonts loaded from Google servers. Processed data are usage data & connection data. The recipient of the data is Google Ireland Ltd, Gordon House, Barrow Street Dublin 4 Ireland. Should Google transfer this data to a third country (e.g. the USA), this will only happen in individual cases and in accordance with Resolution (EU) 2016/1250 - "EU-US Privacy Shield". We do not store any personal data on your device and do not read out any such data. Our legal basis for the use of Google Fonts results from Art. 6 para. 1 lit. f DSGVO (legitimate interest).
Google Maps We use Google Maps for the purpose of integrating interactive maps and map function of Google Maps. Processed data are usage data, location data & connection data. The recipient of the data is Google Ireland Ltd, Gordon House, Barrow Street Dublin 4 Ireland. Should Google transfer this data to a third country (e.g. the USA), this will only happen in individual cases and in accordance with Resolution (EU) 2016/1250 - "EU-US Data Protection Shield". We do not store any personal data on your device and do not read out any such data. Our legal basis for the use of Google Maps results from Art. 6 para. 1 lit. f DSGVO (legitimate interest).
Google Analytics We use Google Analytics for the purpose of statistical evaluation of your use of our website/our services. Your IP address will be collected by us before it is anonymized by Google by shortening it before it is permanently stored on their servers. Processed data are usage data & connection data. The recipient of the data is Google Ireland Ltd, Gordon House, Barrow Street Dublin 4 Ireland (as jointly responsible, Art. 26 DSGVO). Should Google transfer this data to a third country (e.g. the USA), this will only happen in individual cases and in accordance with Resolution (EU) 2016/1250 - "EU-US Data Protection Shield". The legal basis for the use of Google Analytics is your consent (opt-in in the cookie banner), if you have given us this consent during your first visit to our website/our services. The legal basis for the integration of Google Analytics therefore results from Art. 6 para. 1 lit. a DSGVO. On the basis of your consent, we use cookies to store personal data on your end device and read them out. If you have not given us your consent to use Google Analytics (no opt-in in the cookie banner), we will not use Google Analytics within the scope of your visits to our website/our services.
Google Ads Conversion Tracking We use Google Ads Conversion Tracking to measure the success of our Google Ads advertising campaigns. Processed data is usage data & connection data. The recipient of the data is Google Ireland Ltd, Gordon House, Barrow Street Dublin 4 Ireland (as jointly responsible, Art. 26 DSGVO). Should Google transfer this data to a third country (e.g. the USA), this will only happen in individual cases and in accordance with Resolution (EU) 2016/1250 - "EU-US Data Protection Shield". The legal basis for the use of Google Ads Conversion Tracking is your consent (opt-in in the cookie banner), if you have given us this consent during your first visit to our website/our services. The legal basis for the integration of Google Ads Conversion Tracking therefore results from Art. 6 para. 1 lit. a DSGVO. On the basis of your consent, we store personal data on your end device by means of cookies and read them out. If you have not given us your consent to use Google Ads Conversion Tracking (no opt-in in the cookie banner), we do not use Google Ads Conversion Tracking during your visits to our website/our services.
Hotjar
We use Hotjar for the purpose of analyzing your surfing and clicking behavior on our website/our services, for the creation of so-called "heat maps" based on this analysis and for the optimization and needs-based design of our website/our services. Processed data are usage data & connection data. The recipient of the data is Hotjar Ltd, Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta. The data will not be transferred to a third country outside the EU. The legal basis for the use of Hotjar is your consent (opt-in in the cookie banner), provided that you have given it to us during your first visit to our website/our services. The legal basis for the integration of Hotjar therefore results from Art. 6 para. 1 lit. a DSGVO. Based on your consent, we use cookies to store personal data on your end device and read it out. If you have not given us your consent to use Hotjar (no opt-in in the cookie banner), we will not use Hotjar during your visits to our website/our services.
HubSpot
We use HubSpot for the purpose of e-mail & newsletter marketing, to evaluate your click and usage behavior, to optimize and customize our website/our services and for advertising purposes. Processed data are master data, contact data, content data, usage data and connection data. The recipient of the data is HubSpot European Office, Ground Floor, Two Dockland Central Guild Street, Dublin 1, Ireland / HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA (as jointly responsible, Art. 26 DSGVO). Should HubSpot transfer this data to a third country (e.g. the USA), this will only happen in individual cases and in accordance with resolution (EU) 2016/1250 - "EU-US Data Protection Shield". The legal basis for the use of HubSpot is your consent (opt-in in the cookie banner), if you have given us this consent during your first visit to our website/our services. The legal basis for the integration of Hotjar therefore results from Art. 6 para. 1 lit. a DSGVO. Based on your consent, we use cookies to store personal data on your end device and read it out. If you have not given us your consent to use HubSpot (no opt-in in the cookie banner), we will not use HubSpot in the context of your visits to our website/our services.
Request of Material & OffersIf you request material (advertising or marketing material) or offers from us, we will process your data for the purpose of sending you the materials you requested and to prepare and send you the offers you requested. Processed data categories are master data, contact data, connection data, contract data, if applicable. If necessary, we will forward your inquiry to our group companies. A transfer to a third country does not occur. The legal basis for the processing measures results from: Art. 6 para. 1 lit. f DSGVO in the processing to ensure the security of our information technology systemsArt. Art. 6 Para. 1 lit. b DSGVO in the case of processing for the purpose of requesting an offer or initiating and concluding a contract.

E-mail Newsletter Using our newsletter function, we process your data for the purpose of managing our distribution list and sending the requested newsletters as well as for the personal design of our newsletter based on your usage behavior and proof of your consent to the newsletter dispatch. Processed data categories are contact data, master data, usage data, connection data. We will not forward your data to third parties or to a third country. The legal basis for the use of the newsletter function is your consent (opt-in in the cookie banner), provided that you have given it to us during your first visit to our website/our services. The legal basis for the newsletter function therefore results from Art. 6 para. 1 lit. a DSGVO.
Our profiles on Social Media Websites
LinkedIn We operate a LinkedIn fan page on LinkedIn about our company. When you visit and use LinkedIn Fanpage, LinkedIn can evaluate your usage behavior and provide us with information obtained from this. This information is used for the purpose of economic optimization and demand-oriented design of our Internet presence/services. Processed data categories are master data, contact data, content data, usage data, connection data. The recipient of the data is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, as jointly responsible in accordance with Art. 26 DSGVO. A transfer to a third country does not take place. The legal basis for processing the data in accordance with the provisions stated here results from our legitimate interest and thus from Art. 6 Par. 1 lit. f DSGVO.
Details of the Cookies. Cookies used are small files that are stored on your device (computer, tablet or smartphone). When a website is accessed, the cookie stored on a device sends information to the party that placed the cookie.
First-party and third-party cookiesOur website/our services may set third-party cookies and allow third parties to place cookies on your device. The difference between a first-party cookie and a third-party cookie is control over the placement of the cookie. First party cookies are cookies that are specific to the website/service that created them. Their use enables us to provide an efficient service and to evaluate user behavior on the website/service. Third party cookies are placed on your device by third parties (i.e. not by us). Although we may allow third parties to access the Website/The Service in order to place these cookies on end users' devices, we have no control over the information provided by the cookies nor access to this data. This information is entirely controlled by that third party in accordance with their respective privacy policies.
How we use cookies We want you to be able to make an informed decision for or against the use of cookies that are not essential for the technical features of the website/service. Please note that if you choose to decline the use of cookies for promotional purposes, you will still receive advertisements, but they will be less likely to be relevant to your interests. However, you can still use all the functionality of the Website/Service.
We distinguish between Required Cookies, which are absolutely necessary for the technical functions of the Website/Service, Functional Cookies, which enable us to analyze the use of the Website/Service, and Marketing Cookies, which are placed by advertising companies to display advertisements relevant to your interests. We offer you the opportunity to choose your preferences regarding functional and marketing cookies during your first visit to our website/services and at any time thereafter.
Required CookiesThese cookies are required for the basic functions of the website/service. These cookies enable a secure login and storage of the progress of order processes.
Functional CookiesThese cookies allow us to analyze the website/service usage so that we can measure and improve its performance. These cookies allow us to store your login information, shopping cart content and to display page content in a consistent manner. You can change your personal settings for functional cookies by clicking on the Cookie Settings link in the footer of the website/service.
Marketing CookiesThese cookies are used by advertising agencies to provide you with advertising that is relevant to your interests. These cookies allow you to share social networking sites and write comments. Offers that match your interests are also displayed. You can change your personal settings for marketing cookies by clicking on the Cookie Settings link in the footer of the website/service.

4. order processing
Sometimes we use external service providers such as Google Analytics, Google Serach Console, HubSpot, Hotjar and Google Ads to process your data. These service providers were carefully selected and commissioned by us. They are bound by our instructions and are regularly checked. Our contract processing contracts comply with the strict requirements of Art. 28 DSGVO and the specifications of the German data protection authorities.

5. rights of data subjects
If your personal data is processed, you are the data subject within the meaning of the DSGVO and as a user you have the following rights vis-à-vis the person responsible:

5.1 Right to information
You may request confirmation from the person responsible as to whether personal data concerning you is being processed by us.
If such processing has taken place, you can request information from the data controller about the following:
the purposes for which the personal data are processed;the categories of personal data which are processed;the recipients or the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed; the planned duration of storage of the personal data concerning you or, if it is not possible to give specific details, criteria for determining the duration of storage; the existence of a right of rectification or erasure of personal data concerning you, a right to have the processing limited by the controller or a right to object to such processing;the existence of a right of appeal to a supervisory authority;all available information on the origin of the data when the personal data are not collected from the data subject;the existence of automated decision making, including profiling, in accordance with Art. You have the right to obtain information as to whether the personal data concerning you are being transferred to a third country or to an international organization, as well as the right to be informed about the logic involved and the scope and intended effects of such processing on the data subject. In this context, you may request to be informed of the appropriate guarantees pursuant to art. 46 of the DPA in connection with the transfer.

5.2 Right of rectification
You have the right to ask the data controller to correct and/or complete the data if the personal data processed concerning you is incorrect or incomplete. The data controller must make the correction without delay.

5.3 Right to limit processing
Under the following conditions, you may request the restriction of the processing of personal data concerning you:
if you dispute the accuracy of the personal data concerning you for a period of time that allows the controller to verify the accuracy of the personal data;if the processing is unlawful and you object to the deletion of the personal data and request instead the restriction of the use of the personal data;if the controller no longer needs the personal data for the purposes of the processing, but you need them for the purpose of asserting, exercising or defending legal claims; orif you object to the processing pursuant to Art. If the processing of personal data relating to you has been restricted, such data may be processed - apart from its storage - only with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.
If the restriction on processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

5.4 Right of deletion
5.4.1 You may request the Controller to delete immediately the personal data concerning you and the Controller is obliged to delete such data immediately if one of the following reasons applies:
The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed; you revoke your consent on which the processing was based in accordance with Art. 6 para. 1 letter a or Art. 9 para. 2 letter a DPA and there is no other legal basis for the processing; you object to the processing in accordance with Art. 21 para. 1 DPA and there are no legitimate reasons for the processing; or you submit a request for the processing to be cancelled in accordance with Art. 21 para. 1 DPA. The personal data concerning you have been processed unlawfully.The deletion of the personal data concerning you is necessary to comply with a legal obligation under European Union law or the law of the Member States to which the controller is subject.The personal data concerning you have been collected in relation to information society services offered in accordance with Article 8 paragraph 1 of the DPA.
5.4.2 If the data controller has made the personal data concerning you public and is obliged to delete them in accordance with Art. 17 para. 1 DPA, he shall take reasonable measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that you, as the data subject, have requested them to delete all links to this personal data or copies or replications of this personal data.
5.4.3 The right of cancellation does not apply where processing is necessary
for the exercise of the right to freedom of expression and information;to comply with a legal obligation requiring processing under the law of the Union or of the Member States to which the controller is subject, or to carry out a task carried out in the public interest or in the exercise of official authority vested in the controller;for reasons of public interest relating to public health pursuant to Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 DPA;for archiving, scientific or historical research purposes in the public interest or for statistical purposes pursuant to Art. 89 para. 1 DPA, insofar as the right referred to in para. 1 is likely to make it impossible or seriously prejudicial to the achievement of the objectives of such processing, or for the assertion, exercise or defence of legal claims.

5.5 Right to information
If you have asserted the right to rectification, erasure or limitation of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification, erasure or limitation of processing, unless this proves impossible or involves a disproportionate effort.
You have the right, vis-à-vis the data controller, to be informed of these recipients.

5.6 Right to data transferability
You have the right to receive the personal data concerning you, which you have provided to the person in charge, in a structured, common and machine-readable format. You also have the right to have this data communicated to another person in charge without interference from the person in charge to whom the personal data has been communicated, provided that
the processing is based on a consent pursuant to Art. 6, paragraph 1, letter a of the DPA or Art. 9, paragraph 2, letter a of the DPA, or on a contract pursuant to Art. 6, paragraph 1, letter b of the DPA, andthe processing is carried out with the aid of automated procedures; in exercising this right, you also have the right to obtain that the personal data concerning you be transmitted directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons may not be affected by this.
The right to data transferability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

5.7 Right of objection
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you that is carried out pursuant to art. 6, paragraph 1, letter e or f of the DPA; this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you unless he can demonstrate compelling reasons for processing which are worthy of protection and which outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.
If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing, including profiling, insofar as it is related to such direct marketing.
If you object to processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for those purposes.
You have the possibility to exercise your right of objection in relation to the use of information society services, without prejudice to Directive 2002/58/EC, by means of automated procedures involving technical specifications.

5.8 Right to withdraw the declaration of consent under data protection law
You have the right to revoke your data protection declaration of consent at any time. The revocation of your consent does not affect the lawfulness of the processing of your personal data which has been carried out on the basis of your consent up to the revocation. processing is lawful up to your revocation - the revocation therefore only affects the processing after receipt of your revocation. You can informally revoke your consent by mail or e-mail. Your personal data will then no longer be processed, subject to the permission of another legal basis. If this is not the case, your data must be deleted immediately after the revocation in accordance with Art. 17 para. 2 DSGVO. Your right to revoke your consent subject to the above mentioned conditions is guaranteed:  

circuly GmbH
Obernstraße 50
33602 Bielefeld
+491729484913
info@circuly.io
www.circuly.io

5.10 Right to appeal to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are resident, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you is in breach of the DPA.
The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and the results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 DSGVO.

6. automated decisions in individual cases including profiling
Automated decisions in individual cases, including profiling, are not made.

7. notification obligations of the responsible person
If your personal data have been disclosed to other recipients (third parties) for legal reasons, we will inform them of any correction, deletion or limitation of the processing of your personal data (Art. 16, Art. 17 para. 1 and Art. 18 DSGVO). The obligation to notify is not applicable if it involves a disproportionate effort or is impossible. We will also inform you of the recipients upon request.