Privacy Policy

Controller and contact details

The controller responsible for processing personal data on this website is:

heureka e-Business GmbH
Eichwiesenring 4F
70567 Stuttgart
Germany
Email: heureka@heureka.com

You can contact our data protection officer at:

heureka e-Business GmbH
Data Protection Officer
Eichwiesenring 4F
70567 Stuttgart
Germany
Email: datenschutz@heureka.com

Purposes and legal bases

We process personal data to provide and secure this website, respond to your inquiries, provide content and services you request, and send newsletters with your consent. We use optional statistics and diagnostics services only after you consent. Visiting the website, continuing to use it, or closing the privacy settings does not constitute consent.

Depending on the processing involved, the following legal bases under the General Data Protection Regulation (GDPR) apply: Article 6(1)(a) for consent, Article 6(1)(b) for performing a contract or taking steps at your request before entering into a contract, Article 6(1)(c) for legal obligations, and Article 6(1)(f) for legitimate interests, particularly secure website operation and responding to general business inquiries. We take your interests and fundamental rights and freedoms into account.

Storing information on your device or accessing information on it is also subject to Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Strictly necessary technologies rely on Section 25(2) no. 2 TDDDG; optional technologies rely on your consent under Section 25(1) TDDDG.

Website delivery and technical logs

When you access the website, data required for the network connection and delivery of the website is processed. This may include your IP address, the requested address, date and time, browser type and version, operating system, and referring website. Technical access and error logs support website delivery, troubleshooting, and prevention of abuse. IP addresses and technical identifiers can be personal data.

We use Cloudflare to deliver and protect the website. As a technical service provider, Cloudflare may process connection and request data for these purposes. Further information is available in Cloudflare's privacy policy.

The legal basis for necessary technical processing is Article 6(1)(f) GDPR. Our legitimate interest is a secure, functioning website. This processing is separate from optional web analytics: a page request does not, by itself, result in data being sent to Google Analytics.

Technical logs are needed only for as long as required for operation, investigation of errors or security incidents, and any applicable legal record-keeping obligations. Rejecting optional analytics does not prevent technically necessary processing.

Contact, inquiries, and requested content

When you contact us using a form or by email, we process the information you provide to respond to your request. Depending on the form, this includes your name, business email address, company, telephone number, message, and company size. The relevant form indicates which information is required and which is optional.

When you request a resource, consultation, or workshop, or register for an event, we also process the context of your request, such as the selected resource, topic, or event. Submitted self-assessments may include answers, scores, and recommendations derived from them. A form submission may also include the source page, referring page, language, and available campaign parameters so that we can identify the context and handle the request.

Processing for the requested service and associated communication is based on Article 6(1)(b) GDPR where it concerns a contract or steps before entering into one. For other inquiries, it is based on our legitimate interest in responding under Article 6(1)(f) GDPR. Where we obtain separate consent, Article 6(1)(a) GDPR applies. Without the required information, we may be unable to handle the particular request.

We use Resend, a service provided by Plus Five Five, Inc., USA, to send form notifications, confirmations, and requested information. Recipient details, contact information, and content required for the relevant message are transmitted to this email service provider. An inquiry or download alone does not subscribe you to the newsletter; a separate selection is required. Further information is available in Resend's privacy policy.

When you subscribe to a newsletter, we process your email address, selected topics, and any first and last names you choose to provide. This information is used to manage the subscription and send the information you subscribed to. Contact details and topic selections are processed by Resend for these purposes.

The legal basis is your consent under Article 6(1)(a) GDPR. Newsletter consent is separate from your choice concerning the website's statistics and diagnostics services. Consent to web analytics is neither a requirement for a newsletter subscription nor consent to receive newsletters.

You may withdraw newsletter consent at any time with effect for the future, particularly through the unsubscribe option in the newsletter or by contacting us. We will then stop using your data to send the relevant newsletter. Where necessary, information may be retained to respect your unsubscribe request, demonstrate consent, or comply with legal obligations.

Necessary cookies and form protection

Necessary technologies store your privacy choice and language preference and protect public forms against automated abuse. The consent cookie heureka_cookie_consent_v2 stores the selected categories, version, and decision time for 180 days. i18n_redirected stores the language preference. These settings do not authorize optional analytics.

Public forms use Cloudflare Turnstile. Technical browser and connection data may be processed to identify automated access. Cloudflare may also use technically necessary browser storage where required to protect the requested function. The legal bases are Section 25(2) no. 2 TDDDG for strictly necessary device access and Article 6(1)(f) GDPR for protecting the forms.

Details about cookies, storage lifetimes, and your choices are available in our Cookie Policy.

Optional statistics and diagnostics

The services described below are used only with your consent to Statistics & diagnostics and only where the respective integration is enabled. This category is not preselected. You can use the website with necessary technologies only.

The legal bases are your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG.

Google Analytics 4

We use Google Analytics 4, provided by Google Ireland Limited, Ireland, to understand website usage and improve content and navigation. The web stream uses measurement ID G-ZX53QX8PQF.

The Google tag is loaded only after you consent. Before consent, and when you choose necessary technologies only, this integration sends no Google Analytics measurement requests or cookieless consent-mode pings. After consent, only analytics storage is granted. Advertising storage, transmission of user data for advertising, advertising personalization, and Google signals remain disabled in this integration.

Google Analytics may process pseudonymous browser and session identifiers, visited URLs and page titles, referring URLs, timestamps, engagement duration, language, browser and device information, and approximate location. The IP address is transmitted as a technical requirement of the network connection. Google states that, for users in the EU, Switzerland, and the United Kingdom, it uses the IP address to derive approximate location and discards it before logging the analytics data. This does not automatically make the remaining analytics data anonymous.

The enabled enhanced-measurement options capture the following, where supported by the page and Google's automatic detection:

Page views and navigation between pages, including browser-history changes.
Scrolling and outbound link clicks.
Website searches with search terms from configured URL parameters.
Starts, progress, and completion of supported embedded YouTube videos.
File-download clicks, including related link and file information.
Form starts and detected submissions, including technical form identifiers, destination addresses, and submit-button labels.

Our integration does not add custom transmission of contact-form field values, passwords, email addresses, or an account User-ID to Google Analytics. Automatic form detection does not establish that a request was successfully processed by the server. Google's email-redaction feature is enabled for this stream. It is an additional safeguard, not a complete filter for personal data; URLs, search terms, and form metadata in particular may contain such information.

The first-party cookies _ga and _ga_ZX53QX8PQF, or _ga_*, support pseudonymous recognition and session management. Their lifetime in this integration is limited to a maximum of 180 days, with automatic renewal on each visit disabled. Browsers may impose shorter lifetimes. Retention of data already received by Google is separate and is governed by the Analytics property's retention and deletion settings. Deleting a cookie does not automatically delete that data.

Google may also process data through Google LLC in the USA and at other locations outside the European Economic Area. Google describes its transfer mechanisms, including the EU–US Data Privacy Framework and standard contractual clauses where applicable, in its data-transfer information. Further information is available in Google's privacy policy and its explanation of data use on websites using Google services.

Sentry

Sentry helps diagnose browser errors and performance problems. Without consent, the corresponding client events, performance transactions, logs, session data, and breadcrumbs are not transmitted. After consent, affected pages, browser and device information, error context, timing data, and the IP address required for network communication may be processed. Default transmission of personal identifiers is disabled. Further information is available in Sentry's privacy policy.

Leadfeeder by Dealfront

Where the integration is enabled, Leadfeeder helps identify which companies visit the website and which content is relevant to them after you consent. It may process IP addresses, visited pages, timestamps, visit duration, browser and device information, and referring sources. These signals are associated with companies where technically possible. This does not mean that all processed data is anonymous. The Cookie Policy explains the cookies and browser storage involved; further information is available in the provider's privacy notice.

You can change or withdraw your choice at any time using Privacy settings in the footer. On withdrawal, Google Analytics collection is disabled immediately, known Google Analytics and Leadfeeder storage is removed, and the page is reloaded to stop optional trackers from continuing to run. Necessary privacy and language preferences are retained.

Withdrawal applies to future processing. It does not affect the lawfulness of processing before withdrawal or automatically delete data already received by service providers. You can contact us to exercise your rights concerning that data. An earlier consent decision made before Google Analytics was added does not enable the additional service; a new decision is requested.

Recipients and international data transfers

Personal data is received by the teams at heureka handling the relevant task and by the technical service providers used for that task. These include the providers described above for website operation, form protection, email delivery, and – only with the relevant consent – optional analytics and diagnostics. Data may also be disclosed where required by law.

International service providers may process data outside the European Economic Area, particularly in the USA. The requirements of Articles 44 et seq. GDPR must be observed. Depending on the recipient and processing, an applicable adequacy decision or appropriate safeguards, particularly standard contractual clauses, may be relevant. Naming a provider or certification does not constitute a blanket guarantee for every processing activity. You can request information about the safeguards applicable to a specific transfer, and a copy of or details about them, at datenschutz@heureka.com.

Retention and data security

We retain personal data for as long as it is required for the relevant processing purpose. For inquiries and requested services, the relevant criteria include handling the request, subsequent communication, and any statutory retention or record-keeping obligations. When the purpose and any further legal basis cease to apply, the data is deleted or its processing is restricted as appropriate. Necessary data may be retained longer for establishing, exercising, or defending legal claims.

For newsletter data, the relevant criteria include the subscription period and necessary unsubscribe and consent records. Technical logs are governed by operational and security purposes; optional analytics data by the described analysis purposes and the respective retention and deletion settings. Specific cookie lifetimes are set out in the Cookie Policy and are not equivalent to retention periods for server-side data.

Transmission through the website is encrypted using HTTPS. This does not guarantee end-to-end encryption of emails or every subsequent processing operation. Please do not submit sensitive or confidential information that is unnecessary for your request.

External links

Links to external websites and social networks lead to services operated by other controllers. Social-media references in the footer are links, not embedded Facebook plugins. When you open such a link, processing on the destination website is governed by that provider's privacy notice. Separately, optional measurement of an outbound link click on our website depends on your analytics consent.

Your data-protection rights

You can exercise your rights by contacting datenschutz@heureka.com, among other available means. Requests are not restricted to written submissions. The statutory conditions and exceptions under the GDPR apply.

Access

Under Article 15 GDPR, you can ask whether and which personal data we process about you and obtain a copy of that data. This includes information about processing purposes, data categories, recipients, retention periods or the criteria used to determine them, your rights, the source of data not collected from you, and any automated decision-making, including profiling. For transfers to third countries, you are entitled to information about appropriate safeguards.

Rectification

Under Article 16 GDPR, you can request correction of inaccurate personal data and completion of incomplete personal data without undue delay.

Restriction of processing

Under Article 18 GDPR, you can request restriction where you contest accuracy, processing is unlawful and you prefer restriction to erasure, we no longer need the data but you require it for legal claims, or an objection is awaiting a decision. Apart from storage, further processing is then permitted only under the statutory conditions. You will be informed before a restriction is lifted.

Erasure

Under Article 17 GDPR, you can request erasure, particularly where the data is no longer necessary, you withdraw consent and no other legal basis applies, there is a valid objection, data has been processed unlawfully, or a legal obligation requires erasure. The right also covers the statutory cases concerning data collected in connection with information society services offered to children.

Exceptions may apply, particularly for exercising freedom of expression and information, legal obligations or public tasks, public health interests, protected archiving, research or statistical purposes, and legal claims. Where data has been made public, an obligation to erase also includes reasonable measures, as required by law, to inform other controllers of the request to erase links, copies, or replications.

Notification of recipients

Under Article 19 GDPR, we communicate rectification, erasure, or restriction to recipients unless this is impossible or involves disproportionate effort. On request, we will inform you about those recipients.

Data portability

Under Article 20 GDPR, you can receive the data you provided in a structured, commonly used, machine-readable format where processing is based on consent or a contract and is carried out by automated means. You can request transmission to another controller where technically feasible. The rights of others must not be adversely affected; statutory exceptions, particularly for public tasks, remain applicable.

Objection

Under Article 21 GDPR, you can object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. We will then stop processing the data unless overriding compelling legitimate grounds apply or the processing serves legal claims.

You may object at any time to processing for direct marketing and related profiling without providing particular reasons. Processing for those purposes will then stop. Where technically provided for, you can also exercise your right to object in connection with information society services by automated means using technical specifications.

Under Article 7(3) GDPR, you can withdraw consent at any time with effect for the future. Processing previously carried out on the basis of consent remains lawful. For optional website analytics, use the privacy settings; for newsletters, use the unsubscribe option or contact us.

Automated decisions

Under Article 22 GDPR, you generally have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Statutory exceptions remain applicable. Where provided for, your rights include human intervention, expressing your point of view, and contesting the decision.

Complaint to a supervisory authority

Under Article 77 GDPR, you can lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work, or the alleged infringement. Other administrative and judicial remedies remain available. The authority will inform you of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.