Privacy Policy of InterNations GmbH (InterNations)

for www.internations.org and the InterNations mobile applications

Version: 23 September 2026 Save | Print

Welcome to InterNations! The protection of your privacy and your personal data is taken very seriously and is of utmost concern to InterNations.

InterNations is a community of trust. InterNations ensures high standards for the protection of your personal data and your privacy. This Privacy Policy is designed to help you better understand how InterNations collects and deals with your personal data and information.

InterNations works hard to earn and keep your trust. Therefore, InterNations uses personal data solely to provide you with the InterNations Services. InterNations will never rent, sell, or otherwise provide personal data to any third party for advertising or for marketing purposes without your consent.

Responsible body

As a visitor to our website, you expect a high level of quality not only from our platform, but also from the processing of your personal data. We are responsible for the handling of your data, which we process in accordance with your wishes and the requirements of German and European data protection law. Personal data is any data that identifies you or makes you identifiable. We only process personal data if this is permitted by law or if you have given your prior consent.

The responsible body for the collection and processing of personal data is:

InterNations GmbH
Karlsplatz 3
80335 Munich
Germany
Tel: +49 (0)89 4613324-0
Email: info@internations.org

If you have any questions about data protection or data security, please contact our Data Protection Officer:

Mr. Bernd Fuhlert
TRIARI.US GmbH
The Data Protection Officer of InterNations GmbH
Müller-Breslau-Straße 28
45130 Essen
Germany
Email: dataprotection@internations.org

Our service providers include, for example, data centers, analysis service providers, customer service providers, technical infrastructure providers, and payment service providers. Our processors are contractually prohibited from processing your data for purposes other than those specified by us or for their own purposes. It is important to us that you can determine at any time from the following information which personal data is collected during your visit to our website and when using our services and how we process it thereafter. The competent supervisory authority for InterNations GmbH is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, email: poststelle@lda.bayern.de.
Your rights in data protection and right to withdraw consent

You have the following rights regarding the processing of your personal data, provided that the respective legal requirements are met:
1. Right of access
  You have the right to obtain information about the personal data we process concerning you and to receive a copy of such data in accordance with Art. 15 GDPR.
2. Right to rectification, erasure and restriction of processing
  You have the right to request the rectification of inaccurate personal data and, where the statutory requirements are met, the erasure of your personal data or the restriction of processing in accordance with Arts. 16, 17 and 18 GDPR.
3. Right to object
  If the processing of your personal data is based on Art. 6 (1) (e) GDPR or Art. 6 (1) (f) GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of your personal data.
  
  Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time without giving reasons.
  
  We will inform you in the following sections whenever such a right to object exists.
4. Right to data portability
  Where the legal requirements are met, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller in accordance with Art. 20 GDPR.
5. Right to withdraw consent
  If the processing of your personal data is based on your consent pursuant to Art. 6 (1) (a) GDPR or, where applicable, Art. 9 (2) (a) GDPR, you have the right to withdraw your consent at any time with effect for the future.
  
  The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. We will inform you in detail in the relevant sections below.
6. Right to lodge a complaint with a supervisory authority
  You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you believe that the processing of your personal data infringes applicable data protection law. The supervisory authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, Email: poststelle@lda.bayern.de
7. Exercising your rights
  You may exercise your rights at any time by contacting our Data Protection Officer using the contact details provided under Section 1. If you object to the processing of your personal data for advertising purposes or withdraw your consent, a short message to our Data Protection Officer by email to dataprotection@internations.org or by post to InterNations GmbH, Karlsplatz 3, 80335 Munich, Germany is sufficient at any time. Your data will then no longer be processed for the advertising purposes covered by the objection or withdrawal.
  
  The lawfulness of processing carried out before the objection or withdrawal remains unaffected. After your objection to the processing of your personal data for advertising purposes or the withdrawal of your consent, we may retain the data necessary for this purpose, such as your name, address, and email address, in an internal suppression list and process such data exclusively for the purpose of ensuring compliance with your objection or withdrawal in future advertising activities.
  
  This processing is carried out pursuant to Art. 6 (1) (f) GDPR in conjunction with Art. 21 (3) GDPR. Our legitimate interest lies in documenting and implementing your objection or withdrawal and ensuring compliance with applicable data protection requirements. For any questions regarding the processing of your personal data, you may contact our Data Protection Officer at any time.
Processing of personal data on our website
1. Visiting our website
  InterNations GmbH processes so-called server log files when you visit our website. When our website is accessed, our web server records the domain name or the IP address of your computer, the file name and the URL requested, the HTTP response code and, where applicable, the URL from which you were referred to our website. The processing of this data is technically necessary to ensure the secure and proper operation of our website.
  
  The legal basis for this processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure, stable, and technically proper provision of our website. We are supported in this by our technical service providers, which act as processors within the meaning of Art. 28 GDPR.
  
  The above-mentioned data is also logged and used for the purpose of defending against illegal use, abusive access, attempted attacks on our web server, and similar security-related incidents. The legal basis for this security-related processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring the security of our website, systems, and users.
  
  The data will generally be deleted after 60 days unless longer retention is required in an individual case for evidentiary purposes, to establish, exercise or defend legal claims, or to investigate a specific security incident.
2. Registration on the platform
  If you register for our platform on our website, we process the personal data provided during registration in order to provide you with the platform and the related contractual services. The legal basis for this processing is Art. 6 (1) (b) GDPR.
  
  The mandatory information requested during registration is necessary for the conclusion and performance of the contract. Your date of birth is required to verify that you have reached the age of 18, as our services are intended exclusively for adults. Your email address is required in order to confirm your registration and to send you necessary service-related communications.
  
  We also process your data to the extent required by law in order to comply with statutory archiving and retention obligations under German commercial and tax law. The legal basis for this processing is Art. 6 (1) (c) GDPR. The provision of personal data and registration data is necessary for the conclusion and performance of the contract. If you do not provide the required data, we may not be able to create your account or provide the requested services.
  
  In addition, we may use your contact data for direct marketing relating to our own similar services and campaigns where this is legally permissible. Where the applicable legal requirements are met, such processing is carried out on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in informing existing users about our own comparable services and maintaining the customer relationship.
  
  We may also send you marketing communications or recommendations concerning selected offers, products or services of our cooperation partners. Such communications are sent by InterNations. Your contact details are not disclosed to the respective cooperation partner for the purpose of sending these communications unless we separately inform you about such disclosure and an appropriate legal basis applies.
  
  Where prior consent is required for sending marketing communications by electronic mail, in particular for marketing or recommendations relating to offers of third-party cooperation partners, such communications will only be sent on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and the applicable requirements governing electronic direct marketing. You may withdraw your consent at any time with effect for the future. In addition, you have the right to object at any time to the processing of your personal data for direct marketing purposes. You can exercise these rights, in particular, by using the unsubscribe option provided in the respective marketing communication.
  
  We process your registration data for as long as your account exists and until you request its deletion, unless statutory retention obligations or other overriding legal reasons require further storage.
3. Premium Services
  If you order a service from us, your personal data will be processed in order to perform the contractual service, including contract administration, billing, and payment processing. The legal basis for this processing is Art. 6 (1) (b) GDPR. We also process your data to the extent required by law in order to comply with statutory archiving and retention obligations under German commercial and tax law. The legal basis for this processing is Art. 6 (1) (c) GDPR.
  
  In addition, we may use your data for direct advertising relating to our own similar products and campaigns where this is legally permissible. Such processing is carried out pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest lies in informing existing customers about our own similar products and services and maintaining the customer relationship.
  
  You have the right to object to the processing of your personal data for direct marketing purposes at any time. Further recipients of this data may include payment service providers, billing service providers, and other service providers involved in contract administration and subscription management, insofar as this is necessary for the performance of the contract.
  
  The duration of the processing depends on the purpose of the contractual relationship and the applicable statutory retention obligations. Payment and billing data are generally stored for up to ten years where commercial and tax retention obligations apply. Personal data processed for direct marketing purposes will be stored only for as long as you have not objected to such processing and provided that such processing remains legally permissible.
4. Electronic Withdrawal Function
  Where you have a statutory right of withdrawal in relation to a distance contract concluded via our online user interface, we provide an electronic withdrawal function in accordance with § 356a of the German Civil Code (BGB). If you use this function to exercise your right of withdrawal, we process the personal data required to receive, process and document your withdrawal. This includes, in particular, your name, information necessary to identify the relevant contract or the part of the contract you wish to withdraw from, and information regarding the electronic means of communication to which the confirmation of receipt of your withdrawal is to be sent.
  
  In addition, we process the content of your withdrawal declaration as well as the date and time of its receipt. Where necessary, further account or contract-related information may be processed in order to identify the relevant contract and properly process your withdrawal.
  
  The processing is carried out for the purpose of enabling you to exercise your statutory right of withdrawal, processing and documenting your withdrawal, and sending you the legally required confirmation of receipt.
  
  The legal basis for this processing is Art. 6 (1) (c) GDPR in conjunction with § 356a BGB, as the processing is necessary to comply with our statutory obligations. To the extent that further processing is necessary for the performance or reversal of the contractual relationship following the withdrawal, such processing is based on Art. 6 (1) (b) GDPR. We retain the personal data processed in connection with your withdrawal only for as long as necessary to process and document the withdrawal and to comply with applicable statutory retention obligations or to establish, exercise or defend legal claims. After the applicable retention periods have expired, the data will be deleted unless further processing is required or permitted by law.
5. User Content
  After successful registration with InterNations, you may provide additional information about yourself, such as international experience, professional background, and interests. Providing additional information beyond what is required at registration is entirely optional and voluntary, but it may enable you to make better use of our services and networking features.
  
  Additionally, you can upload, publish, send, or display comments, photos, profiles, messages, notes, text, information, music, video, advertisements, listings, and other content on or through InterNations, or transmit or share such content with other users accessing the InterNations websites. You may also form relationships with other users, perform searches and queries, and form groups. InterNations processes this information in order to provide you with the requested services and personalized platform features. In most cases, InterNations retains the information so that you can, for example, access previously sent messages.
  
  The legal basis for the processing of mandatory account and content data required to provide the platform functions is Art. 6 (1) (b) GDPR. To the extent that you voluntarily provide additional optional information, such processing is also carried out in order to provide and enhance the platform functions requested by you and is generally based on Art. 6 (1) (b) GDPR. If you visit the profile of another InterNations user, that user may, depending on the applicable platform functionality and visibility settings, be able to see that you have visited his or her profile. This feature is an essential part of contact management on InterNations and thus an essential part of the InterNations services. The legal basis for this processing is Art. 6 (1) (b) GDPR.
  
  Any information and user content, except private messages to other users, that you submit to InterNations or make available to others via our platform may, depending on your visibility settings and the respective platform functionality, be visible to other users and, where applicable, to third parties visiting the InterNations websites.
  
  Such information and content may also be indexed by search engines and may become visible on external pages, for example in the form of low-resolution teaser profile pictures on event pages. The legal basis for this processing is Art. 6 (1) (b) GDPR.
  
  Inviting other people to InterNations
  
  If you choose to invite another person to InterNations to join your network, you may provide us with that person's name and email address. These personal data are not collected directly from the invited person but are provided to us by you as the inviting user. We process the name and email address of the invited person for the purpose of sending an invitation to InterNations on your behalf and, if the invitation is not accepted, up to two reminder emails. We may also process information relating to the invitation, such as the identity of the inviting user, the date and status of the invitation, in order to administer the invitation process, prevent misuse and evaluate the effectiveness of our referral and networking functions.
  
  The legal basis for this processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in enabling user-initiated invitations, facilitating networking between users and operating our referral functions. In balancing the respective interests, we take into account in particular that the invitation is initiated by an existing InterNations user, that the processing is limited to the data necessary for the invitation, and that the number of invitation and reminder emails is limited. As the personal data of the invited person are provided to us by the inviting user and are therefore not collected directly from the invited person, the invited person will be provided with the information required under Art. 14 GDPR at the time of the first invitation email. This includes, in particular, information about the source of the personal data, the purposes and legal basis of the processing and the rights of the invited person.
  
  If the invitation is not accepted, the name and email address of the invited person and other personal data processed for the invitation will be deleted no later than 30 days after the last invitation or reminder email has been sent, unless continued storage of limited data is necessary to ensure that an objection to receiving further invitations can be respected.
  
  Invited persons have the right to object at any time to the processing of their personal data for the purpose of receiving further invitations. Each invitation email provides an easy way to object to receiving further invitations.
  
  Where an invited person objects to receiving further invitations, we may retain the email address, or a suitable identifier derived from it, in a suppression list solely for the purpose of ensuring that the objection is respected and that no further invitation emails are sent to that address. The legal basis for this processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in documenting and respecting the objection and preventing further unwanted invitations. Data contained in the suppression list will not be used for invitations, advertising or other unrelated purposes and will be retained only for as long as necessary to ensure that the objection can be respected, unless applicable law requires or permits further retention. If the invited person accepts the invitation and registers with InterNations, the person's data will subsequently be processed in accordance with this Privacy Policy as part of the registered user account.
6. Third-party data transfers to non-EU countries
  Some of the service providers we use are located in countries outside the European Union (so-called “third countries”), in particular in the United States. Where personal data is transferred to such providers, this is done in accordance with the requirements of Chapter V GDPR. Where personal data is transferred to service providers in the United States that are certified under the EU-U.S. Data Privacy Framework, such transfers are based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR.
  
  Where no adequacy decision exists, we rely on appropriate safeguards pursuant to Art. 46 GDPR. In particular, we have concluded the European Commission’s Standard Contractual Clauses (SCCs) with the respective service providers. Where necessary, we also implement supplementary technical and organizational measures to ensure an adequate level of data protection. For transfers pursuant to Art. 46 GDPR, we assess on a case-by-case basis whether the level of data protection in the recipient country ensures an essentially equivalent level of protection to that within the European Union, taking into account the specific circumstances of the transfer, the nature of the data, and the applicable legal framework.
  
  Please note that, in third countries without an adequacy decision, there is a possibility that public authorities may access personal data for control and monitoring purposes and that enforceable data subject rights and effective legal remedies may not be available to the same extent as within the European Union.
  
  In exceptional cases, personal data may also be transferred to third countries on the basis of Art. 49 GDPR. Such transfers will take place only where the requirements of Art. 49 GDPR are fulfilled and, where applicable, after you have been informed of the possible risks associated with such transfers.
  
  This may in particular apply:
  - where the transfer is necessary for the performance of a contract with you or for the implementation of pre-contractual measures taken at your request;
  - where the transfer is required by law; or
  - where you have given your explicit consent after having been informed of the potential risks.
7. Data retention and deletion
  We store your personal data only for as long as necessary to achieve the respective purposes for which the data was collected or as required by applicable legal obligations. Registration data is processed for the purpose of creating and managing your account and providing access to the platform. The legal basis is Art. 6 (1) (b) GDPR. Such data is stored until you delete your account, unless statutory retention obligations or overriding legal grounds require further storage.
  
  Payment data is processed for the performance of the contract and to comply with statutory retention obligations. The legal basis is Art. 6 (1) (b) and (c) GDPR. Such data is generally stored for up to ten years where required under commercial and tax law. Tracking data processed on the basis of consent for analytics or marketing purposes is processed pursuant to Art. 6 (1) (a) GDPR and is stored only for as long as necessary for the respective purpose and in accordance with the retention periods configured in the respective tools and services used.
  
  Customer inquiries are processed in order to handle your requests and provide customer support. The legal basis is Art. 6 (1) (b) GDPR and, where applicable, Art. 6 (1) (f) GDPR. Such data is generally stored for up to six years where statutory retention obligations applicable to commercial or business correspondence apply. Once the respective storage periods have expired and there are no statutory retention obligations or overriding legal grounds, including the establishment, exercise, or defence of legal claims, the data will be deleted or anonymized.
8. Intentionally left blank
9. Tracking tools and opt-out options
  Provider-specific opt-out mechanisms may be available in addition to the consent settings provided through Cookiebot. These mechanisms provide additional options for managing certain provider-specific settings but do not replace the consent choices made through Cookiebot on our website.
  
  We use various analytics and marketing tools. To the extent that these tools use cookies or similar technologies that are not strictly necessary for the operation of the website, they are activated only after you have given your consent via Cookiebot. The legal basis for the processing of personal data in this context is Art. 6 (1) (a) GDPR. The storage of information on or access to information from your device is based on your consent pursuant to § 25 (1) TDDDG, where applicable.
  
  You may review, change or withdraw your consent at any time with effect for the future via the Cookiebot consent settings available on our website. Following the withdrawal of your consent, the respective analytics or marketing technologies requiring consent will no longer be used for the relevant purposes. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.
  
  Further information regarding the individual tools used, their purposes, the categories of data processed, applicable storage periods and available provider-specific opt-out options can be found in the respective sections of this Privacy Policy and, where applicable, in the privacy notices of the respective providers.
  
  In addition to managing your consent via Cookiebot, certain providers offer their own opt-out or advertising preference mechanisms. For example, Google provides a browser add-on for deactivating Google Analytics. Hotjar provides an opt-out mechanism for Hotjar tracking. Where the Meta Pixel is used for advertising and retargeting purposes, personalized advertising preferences can also be managed through the respective Meta account settings. Where Google Ads or related Google advertising services are used, Google also provides settings for managing personalized advertising.
  
  These provider-specific mechanisms are supplementary and do not affect your ability to change or withdraw your consent at any time through Cookiebot on our website.
10. Google Analytics
  In the context of our platform, we use the web analysis service Google Analytics. The provider for users in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited acts as our processor within the meaning of Art. 28 GDPR. Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website. The information generated by these technologies about your use of the website may be transmitted to and stored by Google on servers in the United States.
  
  The processing is carried out only on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and, where applicable, § 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie settings. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Google uses this information on our behalf to evaluate the use of the website, compile reports on website activity, and provide further services related to website and internet usage. According to Google, the IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.
  
  IP anonymization is activated to the extent technically supported by Google. Your IP address is shortened by Google within the European Union or in another contracting state of the Agreement on the European Economic Area before transmission to the United States whenever possible. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and shortened there.
  
  Google is certified under the EU-U.S. Data Privacy Framework. Further information on data processing by Google can be found in Google's privacy information. You can prevent the storage of cookies by selecting the appropriate settings in your browser. Please note that disabling cookies may limit the functionality of the website.
  
  In addition, Google provides a browser plug-in that enables users to prevent the collection and processing of Google Analytics data. You can also prevent the collection of data by Google Analytics at any time by withdrawing your consent via the cookie settings. Where technically available, an opt-out mechanism may additionally be provided by Google.
  
  Where the "demographic features" function of Google Analytics is used, reports may contain aggregated information regarding the age, gender, and interests of website visitors. Such information is derived from Google's interest-based advertising and third-party visitor data and cannot be attributed by us to a specific individual. You may deactivate this function at any time through the advertising settings of your Google account or by withdrawing your consent to the use of Google Analytics.
  
  Personal data processed through Google Analytics is retained only for as long as necessary for the purposes described above and in accordance with the retention period configured for the respective Google Analytics property.
11. Hotjar
  We use Hotjar, provided by Hotjar Ltd., Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta, in order to better understand our users’ needs and to optimize our services and user experience.
  
  Hotjar is a technology service that helps us analyze how users interact with our website, for example how much time they spend on particular pages, which links they click, and how they navigate the site. This enables us to improve the usability and functionality of our website.
  
  Hotjar uses cookies and similar technologies to collect information about user behavior and devices. This may include in particular:
  - IP address (processed in a form that does not permit direct attribution to an individual),
  - device screen size,
  - device type (unique device identifiers),
  - browser information,
  - geographic location (country only), and
  - preferred language.
  Hotjar stores this information in a pseudonymized form. Neither Hotjar nor InterNations uses this information to identify individual users.
  
  The processing is carried out only on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and, where applicable, § 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie settings. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information on data processing by Hotjar can be found in Hotjar’s privacy policy.
12. New Relic
  We use New Relic, provided by New Relic Inc., 101 Second Street, 15th Floor, San Francisco, CA 94105, USA, to monitor the performance, availability, and stability of our servers and the client-side performance of our website. In this context, New Relic may process technical data, including in particular IP addresses, performance data, system logs, error reports, and information about the browser and device used. The processing of this data is necessary in order to analyze system performance, detect and resolve technical issues, and ensure the availability, stability, and efficient operation of our services.
  
  The processing of personal data for these purposes is carried out pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring the secure, stable, and efficient operation of our website and services. New Relic acts as our processor within the meaning of Art. 28 GDPR and processes personal data only on our documented instructions.
  
  To the extent that personal data is transferred to the United States, such transfers are carried out in accordance with Chapter V GDPR. Where applicable, transfers are based on an adequacy decision pursuant to Art. 45 GDPR (EU-U.S. Data Privacy Framework) or on appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission's Standard Contractual Clauses. For more information on how New Relic processes personal data, please refer to the provider’s privacy policy at: https://newrelic.com/privacy
13. SurveyMonkey
  We use SurveyMonkey, provided by Momentive Europe UC, 2 Shelbourne Buildings, Second Floor, Shelbourne Road, Ballsbridge, Dublin 4, Ireland, to conduct online surveys and collect user feedback. Participation in surveys is voluntary. If you participate in a survey, we process the personal data provided by you in the survey, such as your responses, contact details where requested, and any other information voluntarily submitted by you. In addition, technical data such as IP addresses, browser information, device information, time of access, and usage data may be processed to provide the survey, prevent misuse, and ensure technical security.
  
  The processing is carried out for the following purposes:
  - conducting and evaluating surveys;
  - collecting feedback on our services;
  - improving our products, services, and user experience; and
  - where applicable, contacting you in relation to your survey responses, where you have consented to such contact or where this is necessary in the context of an existing customer relationship.
  Where participation in a survey is voluntary and based on your decision to provide responses, the processing is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. Where a survey is directly related to the performance of a contract with you or to pre-contractual measures, the legal basis is Art. 6 (1) (b) GDPR. Technical data required for the secure and functional provision of surveys is processed on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing secure, reliable, and misuse-resistant survey functionality.
  
  SurveyMonkey generally acts as our processor within the meaning of Art. 28 GDPR where we determine the purposes and means of the survey. We have concluded a data processing agreement with SurveyMonkey in accordance with Art. 28 GDPR. Personal data may be transferred to SurveyMonkey group companies or subprocessors in third countries, including the United States. Where such transfers take place, they are carried out in accordance with Chapter V GDPR and, where applicable, on the basis of an adequacy decision pursuant to Art. 45 GDPR or appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission's Standard Contractual Clauses.
  
  Survey data is stored only for as long as necessary for the respective survey purpose and evaluation. Unless statutory retention obligations or overriding legal grounds require further storage, survey data is generally deleted or anonymized no later than 24 months after completion of the survey. For more information, please refer to SurveyMonkey’s privacy policy at: https://www.surveymonkey.com/mp/legal/privacy-policy/
14. TrackJS
  We use TrackJS, a service provided by TrackJS LLC, to monitor and analyze JavaScript errors and technical issues on our website. In this context, personal data such as IP addresses, browser information, device information, and technical error logs may be processed. This processing is necessary to identify technical malfunctions, analyze their causes, and ensure the proper functioning of our website.
  
  The processing of personal data for the purposes described above is carried out pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest lies in maintaining the technical stability, security, and functionality of our website. To the extent that TrackJS uses cookies or similar technologies that are not strictly necessary for the operation of the website, or processes personal data for analytical or tracking purposes beyond pure error monitoring, such processing is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
  
  TrackJS processes personal data on our behalf on the basis of a data processing agreement in accordance with Art. 28 GDPR. For more information, please review the TrackJS privacy policy at: https://trackjs.com/privacy
15. Cookiebot
  We use Cookiebot, a service provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, to manage and document user consent regarding the use of cookies and similar technologies on our website. In this context, personal data such as IP address, browser information, consent status, and consent ID may be processed. A cookie named “CookieConsent” is stored on your device in order to record your consent preferences.
  
  The processing of this data is necessary to comply with legal obligations regarding the use of cookies and the documentation of consent in accordance with applicable data protection and ePrivacy regulations. The legal basis for this processing is Art. 6 (1) (c) GDPR. In addition, processing may be based on Art. 6 (1) (f) GDPR, as we have a legitimate interest in ensuring a legally compliant and technically functional consent management system. The data will be stored only as long as necessary to fulfill these purposes. For more information, please review the Cookiebot privacy policy at: https://www.cookiebot.com/en/privacy-policy/
16. Unbounce
  We use Unbounce, a service provided by Unbounce Marketing Solutions Inc., 400–401 West Georgia Street, Vancouver, BC, Canada, for the creation and operation of certain landing pages. When you access such landing pages, your browser establishes a direct connection to Unbounce servers. In this context, personal data such as your IP address, browser information, device data, and usage data may be processed. Cookies and similar technologies may also be used.
  
  The processing of personal data in connection with tracking and analytics functions is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. The processing of data necessary for the technical provision of the website is based on Art. 6 (1) (f) GDPR. Canada is recognized by the European Commission as providing an adequate level of data protection pursuant to Art. 45 GDPR. For more information, please review the Unbounce privacy policy at: https://unbounce.com/privacy/
17. Zendesk
  We use Zendesk, a service provided by Zendesk Inc., 989 Market Street, San Francisco, CA 94103, USA, to ensure the efficient handling of customer inquiries and support requests.
  
  Zendesk is used in particular for our contact forms, helpdesk functionalities, and, where applicable, live chat services. In this context, personal data may be processed, including in particular your name, email address, telephone number (if provided), communication content, and technical metadata such as IP address, browser information, and timestamps.
  
  The processing is carried out depending on the nature of your inquiry:
  - pursuant to Art. 6 (1) (b) GDPR where the inquiry relates to the initiation or performance of a contract,
  - pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in providing efficient and structured customer support.
  Personal data may be transferred to the United States. Zendesk is certified under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. In addition, appropriate safeguards, such as EU Standard Contractual Clauses pursuant to Art. 46 GDPR, have been implemented. For more information, please refer to Zendesk’s privacy notice at: https://www.zendesk.com/company/agreements-and-terms/privacy-notice/
18. Salesforce
  We use Salesforce, a service provided by Salesforce.com, Inc., Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA, to process and manage user inquiries and customer communication.
  
  In this context, personal data such as contact details, communication content, and interaction history may be processed in order to ensure efficient handling of inquiries and customer relationship management.
  
  The processing is carried out:
  - pursuant to Art. 6 (1) (b) GDPR where it is necessary for the performance of a contract or pre-contractual measures,
  - pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in efficient and structured communication processes.
  Personal data may be transferred to the United States. Salesforce is certified under the EU-U.S. Data Privacy Framework, and additional safeguards such as EU Standard Contractual Clauses have been implemented. For more information, please review the Salesforce privacy policy at: https://www.salesforce.com/company/privacy/
19. Zoom (Video Conferencing, Webinars and Online Events)
  We use the service Zoom, provided by Zoom Video Communications, Inc., 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA (“Zoom”), to conduct video conferences, webinars, and other online events. In the course of using Zoom, personal data of participants, speakers, moderators, and other involved individuals may be processed. This may include in particular:
  - identification and contact data (e.g. name, email address)
  - technical data (e.g. IP address, device and browser information, connection metadata)
  - usage data (e.g. duration of participation, interaction within the meeting)
  - content data (e.g. audio, video, chat messages, shared content)
  The extent of data processing depends on the specific use of Zoom and the functionalities activated. We process personal data exclusively for the purposes of:
  - conducting and facilitating online meetings and events
  - ensuring technical functionality, IT security, and system stability
  - communicating with participants and providing follow-up information
  Processing is carried out:
  - pursuant to Art. 6 (1) (b) GDPR where participation is required for the performance of a contract or pre-contractual measures
  - pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in efficient and secure communication and the organization of digital events
  Where recordings are made or where processing goes beyond what is necessary for the provision of the service, processing is carried out exclusively on the basis of prior consent pursuant to Art. 6 (1) (a) GDPR. Recording of meetings or webinars (including audio, video, and interaction content) takes place only if:
  - this has been clearly communicated in advance, and
  - participants have provided their explicit consent where required
  Participants may withdraw their consent at any time with effect for the future. Participation in recorded sessions is voluntary. Where possible, recordings are configured in accordance with the principle of data minimization (Art. 5 (1) (c) GDPR), for example by focusing on speakers and shared content. Zoom acts as a processor on our behalf pursuant to Art. 28 GDPR. We have concluded a data processing agreement with Zoom. Within our organization, access to personal data is restricted to those departments that require it for the purposes described above. Personal data is stored only for as long as necessary to achieve the purposes described above or to comply with legal obligations. Recordings are retained only for as long as required for their intended purpose. Further information on data processing by Zoom can be found at: https://zoom.us/privacy
20. MailChimp
  We use MailChimp, a service provided by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA, to send emails, newsletters, and other communications to users. In this context, personal data such as your email address, name, and interaction data (e.g., opening rates, click behavior) may be processed. This processing enables us to send you relevant information and to analyze and optimize our communication.
  
  The processing of your personal data for the purpose of sending newsletters is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with future effect, for example by using the unsubscribe link contained in every email. The analysis of usage behavior (e.g., opening and click rates) is also based on your consent pursuant to Art. 6 (1) (a) GDPR.
  
  Personal data may be transferred to the United States. MailChimp is certified under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. Where applicable, additional safeguards such as EU Standard Contractual Clauses pursuant to Art. 46 GDPR are implemented. For more information, please refer to MailChimp’s privacy policy at: https://mailchimp.com/legal/privacy/
21. Google Marketing Services
  We use marketing and remarketing services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). These services allow us to display advertisements in a more targeted manner and to present users with advertising that is relevant to their interests. For this purpose, Google uses cookies and similar technologies to analyze user behavior across websites.
  
  In this context, personal data such as IP address, device information, browser data, and usage behavior may be processed. This data is generally processed in pseudonymized form and is not directly linked to identifiable individuals by us. The processing of personal data in connection with Google Marketing Services is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Without your consent, these services will not be activated.
  
  The data collected may be transmitted to and stored on servers in the United States. Google is certified under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. Additional safeguards, such as EU Standard Contractual Clauses pursuant to Art. 46 GDPR, are also implemented. You may withdraw your consent at any time via your cookie settings. For more information, please refer to Google’s privacy policy at: https://www.google.com/policies/privacy
22. Location Services
  We may process information about your approximate location if you have granted us permission to do so. This may include data such as your IP-based location or, where applicable, location data provided by your device settings. We do not store precise location data unless this is explicitly required for a specific feature and you have given your prior consent.
  
  The processing of location data is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. Where the use of cookies or similar technologies is required to access or store location information on your device, processing is additionally based on § 25 (1) TDDDG. This data is used to provide location-based features, such as displaying events near you, and to improve and personalize our services. You may enable or disable location services at any time via your device or browser settings. You may also withdraw your consent at any time with effect for the future.
23. Social Media
  Our website contains links to our profiles on various social media platforms. No social media plugins are integrated directly into our website. If you follow a link to one of our social media profiles while logged into your account with the respective provider, the provider may associate your visit to our website with your user account.
  
  The processing of personal data by the respective social media providers is carried out under their own responsibility. We recommend that you review the privacy policies of the respective providers. If you wish to prevent such association, you should log out of your social media accounts before visiting our website.
24. Facebook Pixel
  We use the Meta Pixel and the Meta Conversions API, services provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The Meta Pixel enables us to measure and analyse how users interact with our website and, in particular, to track user behavior after users have interacted with advertisements on Facebook or other Meta services. In addition, we use the Meta Conversions API to transmit certain information about interactions and conversions directly from our systems to Meta. These technologies help us measure the effectiveness of our advertising, attribute conversions to advertising campaigns, optimize our marketing activities and, where applicable, create or improve audiences for advertising purposes.
  
  In this context, personal data such as IP address, device and browser information, information about interactions with our website (e.g. pages visited, registrations or other actions taken), online identifiers and information relating to conversions may be processed.
  
  Where you have provided us with additional contact information, such as your telephone number, we may also transmit such information to Meta for matching purposes in order to improve the attribution and measurement of our advertising activities. Where technically supported, contact information is transmitted in hashed form before being sent to Meta. Hashing does not render such information anonymous within the meaning of the GDPR.
  
  The use of the Meta Pixel and the transmission of personal data to Meta via the Meta Conversions API for advertising, measurement and matching purposes take place only after you have given your consent. The processing of personal data for these purposes is based on your consent pursuant to Art. 6 (1) (a) GDPR. Where information is stored on or accessed from your device, such access is additionally based on your consent pursuant to § 25 (1) TDDDG.
  
  The data processed in connection with the Meta Pixel and the Meta Conversions API may be transmitted to Meta servers in the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. To the extent that the requirements of the EU-U.S. Data Privacy Framework are met, the transfer is based on the adequacy decision pursuant to Art. 45 GDPR.
  
  You may withdraw your consent at any time with effect for the future via the Cookiebot consent settings available on our website. Following the withdrawal of your consent, the Meta Pixel will no longer be activated and personal data will no longer be transmitted to Meta via the Conversions API for the respective consent-based purposes. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. For more information, please refer to Meta’s privacy policy at: https://www.facebook.com/about/privacy/
25. TikTok Pixel
  We use the TikTok Pixel, a service provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, Ireland. The TikTok Pixel enables us to analyze user behavior on our website following interaction with TikTok advertisements. This allows us to measure the effectiveness of advertising campaigns and create target audiences. In this context, personal data such as IP addresses, device information, browser information, and user behavior may be processed.
  
  The processing is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and, where applicable, § 25 (1) TDDDG. Personal data may be transferred to third countries, including countries for which no adequacy decision of the European Commission exists. Where such transfers take place, they are carried out in accordance with Chapter V GDPR. In exceptional cases, transfers may also be based on your explicit consent pursuant to Art. 49 (1) (a) GDPR after you have been informed of the possible risks associated with such transfers.
  
  Please note that in such third countries an adequate level of data protection comparable to that within the European Union may not exist and that access to personal data by public authorities cannot be excluded. You may withdraw your consent at any time with effect for the future via the cookie settings. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
  
  For more information, please refer to TikTok’s privacy policy at: https://www.tiktok.com/legal/privacy-policy
26. YouTube
  We operate a corporate page (channel) on the social network YouTube, a service provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, represented in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use this channel to present our company, provide information about our services, and interact with users. When you visit our YouTube channel, personal data is processed by YouTube/Google. This may include in particular your IP address, information about your device and browser, pages accessed within the platform, user behavior (e.g., interactions such as likes, comments, or subscriptions), and any other data that you voluntarily provide via the platform.
  
  If you contact us via YouTube, for example through comments or direct messages, we also process your personal data in order to respond to your inquiry. In this case, the processing is carried out pursuant to Art. 6 (1) (b) GDPR if the communication is related to the initiation or performance of a contract, or pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in responding to general inquiries and maintaining communication with users.
  
  Please note that the processing of personal data on YouTube is primarily carried out by Google. In this context, Google may also process personal data outside the European Union, particularly in the United States. Google is certified under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR, ensuring an adequate level of data protection. In addition, appropriate safeguards, such as the conclusion of EU Standard Contractual Clauses pursuant to Art. 46 GDPR, may be implemented.
  
  For certain processing activities, in particular with regard to the provision of aggregated usage statistics (YouTube Analytics), joint controllership pursuant to Art. 26 GDPR may apply between us and Google Ireland Limited. However, primary responsibility for the processing of personal data on the platform lies with Google. Further information on how YouTube/Google processes personal data can be found in Google’s privacy policy at: https://policies.google.com/privacy
27. Cloudflare
  Our website uses services provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA, in order to enhance the security, performance, and availability of our website and to protect it against attacks, including distributed denial-of-service (DDoS) attacks. In this context, Cloudflare acts as a content delivery network (CDN) and reverse proxy, which means that requests to our website are routed through Cloudflare’s servers. As a result, personal data may be processed, in particular IP addresses, browser and device information, referrer URLs, access times, and other technical information required for the provision and security of the website.
  
  Cloudflare may also use cookies or similar technologies, such as the “__cf_bm” cookie, to distinguish between legitimate users and automated access (bots) and to ensure the security and integrity of the website. The processing of personal data for the purposes described above is carried out pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring the secure, stable, and efficient operation of our website and in protecting our systems against misuse and malicious activities.
  
  To the extent that Cloudflare uses cookies or similar technologies that are not strictly necessary for the operation and security of the website, or processes personal data for purposes beyond security and content delivery (e.g., analytics or optimization features), such processing is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Personal data may be transferred to the United States and, where technically necessary, to other countries in which Cloudflare operates servers. Cloudflare participates in the EU-U.S. Data Privacy Framework and is certified accordingly pursuant to Art. 45 GDPR. Where necessary, additional safeguards, including the European Commission’s Standard Contractual Clauses pursuant to Art. 46 GDPR, are implemented. For further information, please refer to Cloudflare’s Privacy Policy: https://www.cloudflare.com/privacypolicy/
28. MaxMind for Fraud Prevention and Risk Management
  We use services provided by MaxMind Inc., 14 Spring Street, Waltham, MA 02451, USA, in order to support fraud prevention, risk assessment, and the security of our platform and services. In this context, personal data may be processed by MaxMind. This may include, in particular, identification data, contact data, registration and account-related information, technical data such as IP addresses and device information, and other information relevant for the assessment of potentially fraudulent or abusive activities.
  
  The processing of this data serves the purpose of detecting and preventing fraudulent or abusive activities, performing risk assessments in connection with user registrations and activities, protecting user accounts against unauthorized access, and ensuring the security and integrity of our platform. The legal basis for this processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in preventing fraud, safeguarding the security of our systems, and protecting our users and services.
  
  To the extent that MaxMind processes personal data on our behalf, MaxMind acts as our processor within the meaning of Art. 28 GDPR and processes personal data only on our documented instructions. Personal data may be transferred to the United States. MaxMind is certified under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. For more information, please refer to MaxMind’s privacy policy: https://www.maxmind.com/en/privacy-policy
29. Google Maps
  We use the Google Maps mapping service, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in order to enable the convenient use of interactive maps on our website. When using Google Maps, personal data may be processed by Google, including in particular your IP address, location data (if enabled by you), information about your device and browser, search queries entered, and usage data related to the map functionality.
  
  The integration of Google Maps is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Without your consent, Google Maps will not be loaded.
  
  The data collected may be transmitted to and stored on servers in the United States. Google is certified under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. In addition, appropriate safeguards such as EU Standard Contractual Clauses pursuant to Art. 46 GDPR are implemented. You may withdraw your consent at any time via your cookie settings. For more information, please refer to Google’s privacy policy at: https://policies.google.com/privacy
30. Zuora
  We use Zuora, a service provided by Zuora, Inc., 3050 S. Delaware Street, Suite 301, San Mateo, CA 94403, USA, for the processing of payments. In this context, personal data required for payment processing, such as billing information, transaction data, and account-related data, may be transmitted to Zuora and processed there. The processing of personal data is carried out pursuant to Art. 6 (1) (b) GDPR, as it is necessary for the performance of a contract.
  
  Personal data may be transferred to the United States. Such transfers are carried out on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular through the conclusion of EU Standard Contractual Clauses. For more information, please refer to Zuora’s privacy policy at: https://www.zuora.com/privacy-statement/
31. PayPal
  We offer the option to process payments via PayPal. The provider of this service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”).
  
  If you choose to pay via PayPal, the payment is processed via a payment interface (iFrame) integrated into our website. When this payment interface is loaded, your browser establishes a direct connection to PayPal’s servers.
  
  In this context, PayPal may receive and process personal data, in particular your IP address, browser and device information, as well as information about your interaction with the payment interface. If you complete a transaction, additional data required for payment processing (e.g., payment details, transaction amount, and transaction reference) will be processed directly by PayPal.
  
  The processing of your personal data is carried out for the purpose of payment processing and the performance of the contract pursuant to Art. 6 (1) (b) GDPR. Please note that PayPal acts as an independent controller within the meaning of the GDPR. We have no influence over the further processing of data by PayPal. Personal data may be transferred to third countries, in particular the United States. PayPal is certified under the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. For more information, please refer to PayPal’s privacy policy at: https://www.paypal.com/privacy
32. Firebase
  To provide certain functionalities and to ensure the stability, security, and performance of our website and/or application, we use services provided by Firebase, a platform operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Firebase offers various services, including hosting, databases, authentication, crash reporting, performance monitoring, and push notifications. Depending on the specific services used, personal data may be processed, including in particular IP addresses, device information (such as operating system, device model, and browser), usage data, crash reports, technical error logs, and, where authentication services are used, identifiers such as email address and user ID.
  
  The processing of personal data for the provision of technically necessary services, such as hosting, databases, authentication, crash reporting, and performance monitoring, is carried out pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring the secure, stable, and functional operation of our website and/or application.
  
  Where Firebase services are used that involve cookies or similar technologies which are not strictly necessary for the operation of the website and/or application, or where data is processed for analytics, tracking, or marketing purposes, such processing is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
  
  Personal data may be transferred to the United States and other countries in which Google operates or engages service providers. Google participates in the EU-U.S. Data Privacy Framework and is certified accordingly pursuant to Art. 45 GDPR. Where necessary, additional safeguards, including the European Commission’s Standard Contractual Clauses pursuant to Art. 46 GDPR, are implemented. For further information, please refer to Firebase’s privacy and security information: https://firebase.google.com/support/privacy
33. Publift
  We use services provided by Publift, a programmatic advertising platform headquartered in Australia, in order to optimize and manage the delivery of advertisements on our digital properties. In this context, personal data such as IP address, device information, browser data, usage data, and cookie-based identifiers may be processed. This processing enables real-time bidding, measurement of advertising performance, and optimization of advertising delivery.
  
  The processing of personal data in connection with Publift is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Without your consent, these technologies will not be activated. Publift may share data with selected third-party advertising partners as part of its services. Personal data may also be transferred to third countries outside the European Union. Such transfers are carried out on the basis of your consent pursuant to Art. 49 (1) (a) GDPR. You may withdraw your consent at any time via your cookie settings. For more information, please refer to Publift’s privacy policy at: https://www.publift.com/privacy-policy
34. Affiliate Marketing and Commission-Based Partnerships
  We may participate in affiliate marketing programs and enter into commission-based partnerships with third-party providers. In this context, tracking links or similar technologies may be used to determine whether users interact with partner offers and, where applicable, to attribute subsequent transactions or other actions to the relevant affiliate partner.
  
  Where cookies or similar technologies are stored on or accessed from your device for affiliate tracking purposes, such technologies are used only with your prior consent in accordance with § 25 (1) TDDDG. To the extent that personal data is processed in connection with such tracking, the processing is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.
  
  Depending on the affiliate program and the technologies used, personal data such as IP address, device and browser information, cookie or other online identifiers, information about the referring partner, and information about interactions with partner offers may be processed.
  
  Where affiliate links are used without storing information on or accessing information from your device and without consent-requiring tracking technologies, personal data may be processed pursuant to Art. 6 (1) (f) GDPR where the applicable legal requirements are met. Our legitimate interest lies in measuring the success of our commercial partnerships and correctly attributing commissions. Where required by law, such processing will only take place on the basis of your consent.
  
  You may withdraw your consent at any time with effect for the future via the cookie settings. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
35. Contact / Inquiries
  If you contact us with inquiries or requests, we process the personal data you provide in order to handle and respond to your request. This may include in particular your name, contact details (e.g., email address, telephone number), and the content of your message. The processing is carried out pursuant to Art. 6 (1) (b) GDPR where your inquiry relates to the initiation or performance of a contract, and pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in responding to general inquiries and ensuring effective communication.
  
  The provision of mandatory information is necessary in order to process your request. The voluntary provision of additional information may facilitate the handling of your inquiry.
  
  We store the data collected in connection with your inquiry for as long as necessary to process your request and, where applicable, for the duration of statutory retention periods. In particular, data relating to commercial or business correspondence may be stored for up to six years pursuant to § 257 HGB and Art. 6 (1) (c) GDPR.
36. Email Advertising
  If you have given your explicit consent, we will use your personal data to send you email communications, including newsletters, updates, and information about our services and offers. The processing of your personal data for this purpose is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 7 (2) No. 3 UWG.
  
  To ensure that consent is properly obtained, we use a double opt-in procedure. In this context, your IP address and the time of registration may be recorded and stored for documentation purposes pursuant to Art. 7 (1) and Art. 6 (1) (c) GDPR. You may withdraw your consent at any time with future effect, for example by using the unsubscribe link contained in each email or by contacting us directly. We will process your data for email advertising purposes until you withdraw your consent.
37. Change of purpose
  If we change the purposes of processing, we will inform you in advance where required by law and update this Privacy Policy accordingly.
38. Extended retention periods
  The storage periods specified in this Privacy Policy may be extended where statutory retention obligations apply or where further storage is necessary for the establishment, exercise, or defence of legal claims. In such cases, the data will be restricted to the respective purpose and deleted once the reason for further retention no longer applies.
What are mandatory fields?

If certain data fields are designated as mandatory fields and/or marked with an asterisk (*), the provision of this data is either required by law or contract, or we require this data for the conclusion of the contract, the provision of the desired service, or the stated purpose.

You are generally free to decide whether to provide personal data. However, failure to provide the data marked as mandatory may result in the contract not being concluded, the requested service not being provided, or the intended purpose not being achieved.
Information on cookies and newsletters
1. InterNations uses cookies and similar technologies on its website. Cookies are small text files that are stored on your device and enable the analysis of your use of the website, as well as the provision of certain functionalities. We distinguish between cookies that are strictly necessary for the operation of the website and those that require your consent:
  - Strictly necessary cookies are required to ensure the technical functionality, security, and stability of the website. The processing of personal data in this context is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing a functioning and secure website. The storage of such cookies is permitted pursuant to § 25 (2) TDDDG.
  - All other cookies, in particular for analytics, marketing, personalization, and social media purposes, are used only with your prior consent. The processing of personal data in this context is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
  We use cookies in particular to:
  - personalize content and advertisements;
  - analyze the use of our website and improve our services;
  - provide social media functionalities; and
  - display relevant advertising.
  Some cookies are set by third-party providers. In this case, personal data may be transmitted to these providers, who may combine such data with other information that you have provided to them or that they have collected independently. Cookies that are not strictly necessary are set only after you have given your consent via our consent management platform. Without your consent, no such cookies will be stored on or accessed from your device.
  
  You may give, refuse, or withdraw your consent at any time with effect for the future via the cookie settings. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. If you do not make any specific settings, only strictly necessary cookies will be used. You can also configure your browser settings to prevent the storage of cookies or to delete existing cookies at any time. Please note that disabling cookies may limit the functionality of the website. To document your consent in accordance with Art. 7 (1) GDPR, we use a consent management platform. In this context, a consent ID and the time of consent are stored in order to demonstrate that consent has been given. Further information on the cookies and similar technologies currently used, including their providers, purposes and storage periods, is available at any time via our consent management platform.
2. Newsletter as registered user
  If you subscribe to one or more of our newsletters, we will use your email address and any additional data provided in this context to regularly send you information about current offers, services, events, competitions of InterNations GmbH, as well as information related to living abroad, and to invite you to participate in surveys. The subscription to our newsletter is based on your prior consent (Art. 6 (1) (a) GDPR in conjunction with § 7 (2) No. 3 UWG). To ensure that the subscription is initiated by the holder of the email address and to document your consent, we apply a double opt-in procedure. After registration, you will receive an email in which you must confirm your subscription. Only after this confirmation will you be added to our mailing list.
  
  In this context, we process the following personal data:
  - email address;
  - date and time of registration and confirmation;
  - IP address used at the time of registration and confirmation; and
  - where applicable, preferences or selections made in relation to the newsletter.
  The processing of this data serves the purpose of sending the newsletter and documenting your consent in accordance with Art. 7 (1) GDPR.
  
  You may withdraw your consent at any time with effect for the future. You can do so, for example:
  - via your account settings;
  - by sending an email to support@internations.org; or
  - by using the unsubscribe link included in every newsletter.
  The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
  
  Your personal data will be processed for as long as your subscription to the newsletter is active. After you unsubscribe, your data will no longer be used for newsletter purposes and will be deleted unless statutory retention obligations apply or further processing is necessary on another legal basis.
  
  In order to ensure that your withdrawal of consent is respected in the future, we may retain your email address in an internal suppression list and process such data exclusively for the purpose of preventing future newsletter communications.
  
  This processing is carried out pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest lies in documenting and implementing your withdrawal of consent and ensuring compliance with applicable data protection requirements.
Service providers for the processing of payments

The payment and bank information that is stored or entered within the framework of an order is processed for the purpose of payment processing and the performance of the contractual service (legal basis: Art. 6 (1) (b) GDPR).

In order to offer commonly used and secure payment methods, we cooperate with external payment service providers. Depending on the selected payment method, personal data necessary for processing the payment (e.g. name, billing information, payment details, transaction amount, and transaction reference) will be transmitted to the respective payment service provider.

Depending on the respective payment service and the applicable contractual arrangements, such providers may act as independent controllers within the meaning of the GDPR. In such cases, the processing of your personal data by these providers is carried out under their own responsibility and in accordance with their respective privacy policies. Further information on data processing can be found in the privacy notices of the respective providers.

The involvement of payment service providers is necessary for the execution of the contract (Art. 6 (1) (b) GDPR). Where applicable, additional processing operations may be based on our legitimate interests pursuant to Art. 6 (1) (f) GDPR, for example to ensure secure and efficient payment processing.

Where we engage service providers as processors within the meaning of Art. 28 GDPR (e.g. technical payment processing or billing services), this is done on the basis of a data processing agreement. These processors are contractually obligated to process personal data only on our instructions and not for their own purposes.

Personal data processed in the context of payment transactions will be stored for as long as necessary to fulfill the contractual relationship and to comply with statutory retention obligations under commercial and tax law (Art. 6 (1) (c) GDPR). As a rule, such retention periods amount to up to ten (10) years.

In the event of outstanding claims, we may transfer the necessary personal data to external service providers (e.g. collection agencies or legal advisors) for the purpose of enforcing our claims. Such processing is carried out pursuant to Art. 6 (1) (b) GDPR and, where applicable, pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest in the effective assertion and enforcement of legal claims.

Where personal data is transferred to service providers in third countries (in particular outside the European Union), such transfers are carried out in accordance with the requirements set out in Section 3.6 of this Privacy Policy.
Breach of Obligations

InterNations takes the confidentiality of user communications very seriously. As a general rule, we do not monitor, analyze, or actively review private communications between users. Processing of personal data in this context will only take place where there are concrete, documented, and substantiated indications of:
- a violation of our Terms and Conditions or contractual obligations
- unlawful activities; or
- a threat to the security, integrity, or proper functioning of our platform or its users
Such indications may arise, in particular, from user reports, complaints, or clearly identifiable misuse patterns. In such cases, personal data may be processed solely for the purposes of:
- investigating and clarifying the suspected violation
- preventing further misuse or harm
- enforcing our Terms and Conditions; and
- where necessary, asserting, exercising, or defending legal claims
The processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in protecting our platform, users, and legal position. Where required, processing may also be based on Art. 6 (1) (c) GDPR to comply with legal obligations. Access to personal data, including user-generated content and communications, is strictly limited:
- access is granted only in individual cases and only where necessary
- access requires a documented and justified reason and is subject to a necessity and proportionality assessment
- access is restricted to specifically authorized personnel bound by confidentiality obligations
Private communications are only accessed in exceptional cases where this is indispensable to investigate a specific and substantiated suspicion and where less intrusive measures are not sufficient. There is no general, systematic, or continuous monitoring of user communications. Furthermore, we do not use automated systems to review the content of private communications for profiling purposes or for automated decision-making within the meaning of Art. 22 GDPR.

Any processing is limited to the data strictly necessary for the respective purpose and is carried out in accordance with the principles of data minimization and proportionality pursuant to Art. 5 GDPR. Any access to private communications is subject to a documented necessity assessment and the principle of proportionality. Data processed in this context is stored only for as long as necessary to investigate and resolve the incident and, where applicable, to establish, exercise, or defend legal claims or to comply with statutory retention obligations. Afterwards, the data will be deleted or anonymized. Appropriate technical and organizational measures are implemented to ensure secure processing. Access to such data is logged, restricted, and subject to internal controls.
Links

Our websites may contain links to external websites operated by third parties. Please note that we have no influence over the content and data processing practices of such third-party websites. When you leave the InterNations websites and visit an external website, the respective provider is responsible for the processing of your personal data. We therefore recommend that you review the privacy notices of the respective websites you visit. This Privacy Policy applies exclusively to the processing of personal data carried out by InterNations.
Data security

We take appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access and to ensure compliance with the applicable data protection laws of the European Union and the Federal Republic of Germany. These measures are designed to ensure a level of security appropriate to the risk and, in particular, to safeguard the confidentiality, integrity, availability, and resilience of our processing systems and services. They are also intended to enable the timely restoration of the availability of and access to personal data in the event of a physical or technical incident.

Our security measures also include the encryption of data transmissions. Information that you enter online is transmitted using appropriate encryption technologies in accordance with the current state of the art in order to protect it against unauthorized access during transmission. However, please note that no method of transmission over the Internet and no electronic storage system can be guaranteed to be completely secure. Our data processing and security measures are continuously reviewed and improved in line with technological developments. Employees and other persons acting under the authority of InterNations GmbH who have access to personal data are bound by confidentiality obligations and are required to comply with the applicable data protection requirements.
Changes

This Privacy Policy must be adapted from time to time to the actual circumstances and the legal situation. Please check the Privacy Policy before using our platform to keep up to date with any changes or updates.