1. General Information

Y1 Digital AG
Immenhofer Str. 21
70180 Stuttgart

Legal status representative: Sebastian Wohlrapp (Chief Executive Officer)

2. Data Protection Officer

IITR Datenschutz GmbH
Marienplatz 2
80331 München
Tel.: +49 (0)89 1891 7360
E-Mail: email@iitr.de

3. General Remarks on Data Processing

As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website and our content and services. The processing takes place on the basis of the General Data Protection Regulation (GDPR) as well as other applicable data protection regulations.

Applicable legal bases:
– Art. 6 para. 1 lit. a GDPR
– Consent of the data subject
– Art. 6 para. 1 lit. b GDPR
– Performance of a contract or pre-contractual measures
– Art. 6 para. 1 lit. c GDPR
– Compliance with a legal obligation
– Art. 6 para. 1 lit. f GDPR
– Safeguarding legitimate interests of the controller

4. Provision of the Website / Server Log Files

When you access our website, your browser automatically transmits the following data, which is stored in server log files:

IP address of the requesting computer (anonymised after storage), date and time of access, name and URL of the retrieved file, amount of data transferred, browser type and version, operating system, and referrer URL (previously visited page).

This data is technically necessary to display the website correctly and to ensure the security and stability of the system. This data is not merged with other data sources.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the technical provision and security of the website).

Storage period: Log files are deleted after 7 days at the latest, unless a security incident requires longer retention.

5. Hosting (Framer)

Our website is run on the Framer platform (Framer B.V., Rozengracht 197A, 1016 LZ Amsterdam, Netherlands; if applicable, server infrastructure in the USA). Framer processes connection data to the extent technically necessary and may record its own technical event data. We have concluded a data processing agreement with Framer in accordance with Art. 28 GDPR. Insofar as data is transferred to the USA, this takes place on the basis of EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in running a technically reliable website).

6. Content Delivery Network / Proxy (Cloudflare)

We use the service Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) as a Content Delivery Network and reverse proxy. All requests to our website are routed through Cloudflare's servers. In doing so, technical connection data, in particular IP addresses, can be processed by Cloudflare to optimize the delivery speed and protect the website from attacks. We have concluded a data processing agreement with Cloudflare. The transfer to the USA takes place on the basis of EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR. Cloudflare is also certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the security and performance of the website).

7. Cookies

Our website uses cookies. Cookies are small data sets that your browser stores on your end device. We distinguish between technically necessary cookies and cookies that require prior consent.

Technically necessary cookies are essential for the operation of the website. They can be disabled in your browser, but this may restrict the functionality of the website.

Non-essential cookies (e.g. for analysis and marketing) are only set with your explicit consent, which you can withdraw at any time with effect for the future.

Legal basis: Art. 6 para. 1 lit. f GDPR for technically necessary cookies; Art. 6 para. 1 lit. a GDPR for all other cookies.

8. Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager allows us to manage website tags centrally. Google Tag Manager itself does not set cookies or collect personal data, but it enables the triggering of other tags which, for their part, may collect data.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient tag management).

9. Google Analytics

Our website uses Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Measurement ID: G-CP3J0R8PCG.

Google Analytics enables the analysis of user behavior on our website. This includes recorded pages, duration of stay, origin of the visit, approximate location (based on the anonymised IP address), browser and operating system, as well as a pseudonymous client ID. We have activated IP anonymisation. The collected data is transmitted to Google servers in the USA. We have concluded a data processing agreement with Google; data transfer to the USA takes place on the basis of EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent). Google Analytics is only used after your explicit consent via our consent management.

Objection / Opt-out: You can prevent collection by Google Analytics by withdrawing your consent via our cookie banner or by installing the browser plugin available at https://tools.google.com/dlpage/gaoptout.

Storage period: The data is automatically deleted after 14 months.

10. Leadfeeder

Our website uses Leadfeeder (Leadfeeder Oy, Mikonkatu 17 C, 00100 Helsinki, Finland; infrastructure in the USA, if applicable). Leadfeeder is a B2B analysis service that uses IP addresses to determine which companies have visited our website. In doing so, connection data such as IP address, visited pages, and visit times are recorded and matched with publicly available company databases. We have concluded a data processing agreement with Leadfeeder. Insofar as data is transferred to the USA, this takes place on the basis of EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in identifying business visitors for sales purposes).

Objection / Opt-out: https://www.leadfeeder.com/opt-out/

11. Newsletter

When you register for our newsletter, we collect your email address and, optionally, other data provided by you. Registration is subject to a double opt-in procedure: after registering, you will receive a confirmation email in order to actively confirm your registration. We use this data exclusively for sending the newsletter.

Your data will remain stored until you unsubscribe from the newsletter. Unsubscribing is possible at any time via the unsubscribe link in the newsletter or by sending us a message. By unsubscribing, you withdraw your consent; processing that has already taken place remains lawful.

Your email address, which we received in connection with the purchase of a product or service, will be used by us for direct advertising of our own similar products or services, provided you have not objected to this use (§ 7 para. 3 UWG). You can object to this use at any time without incurring any additional costs.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent); § 7 para. 3 UWG for advertising to existing customers.

12. Contact Form and Email Contact

If you contact us via our contact form or by email, the data you provide (e.g. name, email address, subject, message) will be stored and processed to handle your request. Your data will not be passed on to third parties unless this is necessary to process your request.

Legal basis: Art. 6 para. 1 lit. b GDPR, provided the request is related to a contractual relationship; otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to user requests).

Storage period: The data will be deleted after final processing, provided there are no statutory retention obligations to the contrary.

13. Video Conferencing and Webinar Software

We use external software to conduct video conferences and webinars. The following data is processed in this context: first name, last name, email address; optional audio and video transmission as well as content from chat functions; to the extent technically necessary, connection data of your system. Data processors in the USA are used. Data transfer takes place on the basis of EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR. Recordings only take place with prior documented consent of the participants.

Legal basis: Art. 6 para. 1 lit. b GDPR (contractual measures) or Art. 6 para. 1 lit. f GDPR (legitimate interest in digital communication).

Storage period: Technical connection data is deleted as soon as it is no longer required. Otherwise, statutory retention obligations apply.

14. Applications Procedure

Data concerned: Application documents (name, contact details, CV, certificates, and other data shared as part of the application).

Purpose of processing: Implementation and decision on the application process.

Legal basis: Art. 6 para. 1 lit. b GDPR in conjunction with § 26 para. 1 BDSG.

Recipients: Public bodies where statutory priority exists; internal decision-makers; external service providers within the scope of order processing.

Third country transfers: Data processors outside the EU may be used; transfers take place on the basis of EU Standard Contractual Clauses.

Storage period: Application data is usually deleted within four months after notification of the decision, unless consent to longer storage has been granted.

15. Customer and Prospect Data

Data concerned: Data shared for contract initiation and execution; additional data only on the basis of explicit consent.

Purpose of processing: Contract initiation, contract execution, customer care.

Legal basis: Art. 6 para. 1 lit. b GDPR; if applicable Art. 6 para. 1 lit. a GDPR (consent); Art. 6 para. 1 lit. c GDPR (legal obligations).

Recipients: Public bodies; external service providers as data processors; other bodies on the basis of consent or overriding legitimate interest.

Third country transfers: Transfers to third countries take place exclusively on the basis of EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR.

Storage period: Subject to statutory retention obligations, usually 10 years (§ 257 HGB, § 147 AO).

16. Employee Data

Data concerned: Data necessary for the establishment, implementation, and termination of the employment relationship.

Purpose of processing: Implementation of the employment relationship including payroll accounting and company organization.

Legal basis: Art. 6 para. 1 lit. b GDPR in conjunction with § 26 para. 1 BDSG; if applicable Art. 6 para. 1 lit. c GDPR.

Recipients, third country transfers and storage period: As under Section 15.

17. Supplier Data

Data concerned: Contact and contract data shared for contract initiation and execution.

Purpose of processing: Performance of supply and service contracts.

Legal basis: Art. 6 para. 1 lit. b GDPR; if applicable Art. 6 para. 1 lit. c GDPR.

Recipients, third country transfers and storage period: As under Section 15.

18. Your Rights as a Data Subject

You have the following rights against us regarding your personal data:

Right of access (Art. 15 GDPR): You can request information about the data processed by us.

Right to rectification (Art. 16 GDPR): You can request the correction of incorrect data.

Right to erasure (Art. 17 GDPR): Under certain conditions, you can request the deletion of your data.

Right to restriction of processing (Art. 18 GDPR): You can request the restriction of the processing of your data.

Right to data portability (Art. 20 GDPR): You can receive your data in a commonly used, machine-readable format.

Right to object (Art. 21 GDPR): You can object to the processing of your data on the basis of Art. 6 para. 1 lit. f GDPR at any time.

Right to withdraw consent (Art. 7 para. 3 GDPR): You can withdraw consent once given at any time with effect for the future, without this affecting the lawfulness of the processing carried out up to the withdrawal.

To exercise your rights, please contact us or our Data Protection Officer in writing or by email (see contact details above).

19. Right to Lodge a Complaint with the Supervisory Authority

You have the right to complain to a data protection supervisory authority about the processing of your personal data by us. The supervisory authority responsible for us is:

Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg (LfDI BW) Königstraße 10a 70173 Stuttgart Tel.: +49 (0)711 615541-0 E-Mail: poststelle@lfdi.bwl.de Website: www.baden-wuerttemberg.datenschutz.de

20. Obligation to Provide Personal Data

The provision of personal data is partly required by law or contract for concluding a contract with us. Without providing the required data, a contract cannot be concluded. Insofar as the provision is voluntary, you will be informed of this separately in the respective context.

21. Automated Decision-Making / Profiling

Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place.

Status: June 2026