Privacy Policy

This Privacy Policy provides information about the processing of personal data in connection with our activities and operations, including our website at the domain name ventrz.ai. In particular, we explain why, how, and where we process personal data. We also provide information about the rights of individuals whose data we process.

For specific or additional activities and operations, we may publish further privacy statements or other information regarding data protection.

We are subject to Swiss law as well as any applicable foreign law, such as, in particular, that of the European Union (EU) with the European General Data Protection Regulation (GDPR).

In its decision of July 26, 2000, the European Commission recognized that Swiss data protection law ensures an adequate level of data protection. In a report dated January 15, 2024, the European Commission confirmed this adequacy decision.

Table of Contents

• 1. Contact Information
• 2. Definitions and Legal Basis
• 3. Nature, Scope, and Purpose of the Processing of Personal Data
• 4. Automation and Artificial Intelligence (AI)
• 5. Disclosure of Personal Data
• 6. Communication
• 7. Job Applications
• 8. Data Security
• 9. Personal Data Abroad
• 10. Rights of Data Subjects
• 11. Use of the Website
• 12. Notifications and Communications
• 13. Social Media
• 14. Third-Party Services
• 15. Website Extensions
• 16. Measuring Success and Reach
• 17. Final Notes on the Privacy Policy

1. Contact Information

The data controller under data protection law is:

In certain cases, third parties may be responsible for processing personal data, or there may be joint responsibility with third parties. Upon request, we are happy to provide data subjects with information regarding the respective responsibility.

1.1 Data Protection Officer or Data Protection Advisor

We have appointed the following Data Protection Officer or Data Protection Advisor as the point of contact for data subjects and authorities regarding inquiries related to data protection:

2. Definitions and Legal Basis

2.1 Definitions

Data Subject: A natural person whose personal data we process.

Personal data: Any information relating to an identified or identifiable natural person.

Sensitive personal data: Data regarding trade union, political, religious, or ideological views and activities; data regarding health, privacy, or membership in an ethnic or racial group; genetic data; biometric data that uniquely identifies a natural person; data concerning criminal or administrative sanctions or proceedings, and data concerning social assistance measures.

Processing: Any handling of personal data, regardless of the means and methods used, such as retrieving, comparing, adapting, archiving, storing, reading, disclosing, obtaining, collecting, erasing, organizing, arranging, storing, modifying, disseminating, linking, destroying, and using personal data.

European Economic Area (EEA): Member states of the European Union (EU) as well as the Principality of Liechtenstein, Iceland, and Norway.

2.2 Legal Basis

We process personal data in accordance with Swiss law, in particular the Federal Act on Data Protection (Data Protection Act, DSG) and the Ordinance on Data Protection (Data Protection Ordinance, DSV).

To the extent that the European General Data Protection Regulation (GDPR) applies, we process personal data in accordance with at least one of the following legal bases:

• Art. 6(1)(b) of the GDPR for the processing of personal data necessary to fulfill a contract with the data subject and to carry out pre-contractual measures.
• Article 6(1)(f) of the GDPR for the processing of personal data necessary to safeguard legitimate interests—including the legitimate interests of third parties—provided that the fundamental freedoms and rights as well as the interests of the data subject do not take precedence. Such interests include, in particular, the sustainable, people-oriented, secure, and reliable conduct of our activities and operations; ensuring information security; protect against misuse; the enforcement of our own legal claims; and compliance with Swiss law.
• Art. 6(1)(c) GDPR for the processing of personal data necessary to comply with a legal obligation to which we are subject under the applicable law of Member States in the European Economic Area (EEA).
• Art. 6(1)(e) GDPR for the necessary processing of personal data to perform a task carried out in the public interest.
• Article 6(1)(a) of the GDPR for the processing of personal data with the consent of the data subject.
• Article 6(1)(d) of the GDPR for the processing of personal data necessary to protect the vital interests of the data subject or another natural person.
• Art. 9(2) et seq. of the GDPR for the processing of special categories of personal data, in particular with the consent of the data subjects.

The European General Data Protection Regulation (GDPR) refers to the handling of personal data as the processing of personal data and the handling of sensitive personal data as the processing of special categories of personal data (Art. 9 GDPR).

3. Nature, Scope, and Purpose of the Processing of Personal Data

We process the personal data necessary to carry out our activities and operations in a sustainable, people-friendly, secure, and reliable manner. The personal data processed may include, in particular, the following categories: browser and device data, content data, communication data, metadata, usage data, master data (including inventory and contact data), location data, transaction data, contract data, and payment data. The personal data may also constitute special-category personal data.

We also process personal data that we receive from third parties, obtain from publicly available sources, or collect in the course of our activities and operations, to the extent that such processing is permitted.

We process personal data, where necessary, with the consent of the data subjects. In many cases, we may process personal data without consent, for example, to comply with legal obligations or to safeguard legitimate interests. We may also request consent from data subjects even when their consent is not required.

We process personal data for as long as is necessary for the respective purpose. We anonymize or delete personal data, in particular, in accordance with statutory retention and statute-of-limitations periods.

4. Automation and Artificial Intelligence (AI)

We may process personal data automatically or use artificial intelligence to process personal data.

We may use profiling to automatically evaluate certain personal aspects relating to data subjects. Profiling is used, for example, to analyze or predict interests, behaviors, or personal preferences.

We will provide information on a case-by-case basis regarding decisions that are based exclusively on the automated processing of personal data and that have legal consequences for the data subjects or significantly affect them (automated individual decisions).

4.1 Use of AI at Ventrz

As part of our services, we use AI-powered systems and language models to analyze, structure, and summarize information and documents provided by clients, and to use them to generate, in particular, market, product, technology, business model, and investment analyses, as well as corresponding deliverables.

To this end, information entered, documents uploaded, and content derived therefrom may be processed by the AI models and technical service providers we use. This may also include personal data.

Ventrz uses different suitable AI models and providers depending on the specific use case. This selection may change as part of our ongoing technical development. To the extent that external providers are used, processing is carried out under appropriate contractual, technical, and organizational data protection and security measures.

Ventrz does not use customer or case data for public release or to train its own publicly accessible AI models. To the extent technically and contractually feasible, we use AI services in configurations where submitted content is not used to train the respective provider's general models.

AI-generated results may be reviewed, supplemented, or corrected by Ventrz or by consulted experts (human-in-the-loop). Significant business or investment decisions are not made exclusively by Ventrz through automation.

When using external AI services, data processing may take place outside of Switzerland or the EEA. In such cases, the provisions regarding the transfer of personal data abroad described in Section 9 of this Privacy Policy apply.

5. Disclosure of Personal Data

We may disclose personal data to third parties, have it processed by third parties, or process it jointly with third parties. Such third parties include, in particular, specialized providers whose services we utilize.

For example, we may disclose personal data to banks and other financial service providers, government agencies, educational and research institutions, consultants and attorneys, interest groups, IT service providers, cooperation partners, credit and business information agencies, logistics and shipping companies, marketing and advertising agencies, media outlets, organizations and associations, social institutions, telecommunications companies, insurance companies, and payment service providers.

6. Communication

We process personal data in order to communicate with individuals as well as with government agencies, organizations, and companies. In doing so, we process, in particular, data that a data subject provides to us when establishing contact, for example, by mail or email. We may store such data in an address book or using comparable tools.

Third parties who provide us with data about other individuals are obligated to ensure the data protection of those data subjects on their own. In particular, they must guarantee that such data is accurate and may be disclosed.

We use selected services from suitable providers to facilitate and improve communication with individuals and other communication partners. We may also use such services to manage and otherwise process the data of data subjects beyond the scope of direct communication.

7. Job Applications

We process personal data about applicants to the extent necessary to assess their suitability for employment or for the subsequent performance of an employment contract. The required personal data is derived in particular from the information requested, for example, in connection with a job posting. We may publish job postings with the assistance of appropriate third parties, for example in electronic and print media or on job portals and recruitment platforms.

We also process personal data that applicants voluntarily provide or publish, particularly as part of cover letters, resumes, and other application materials, as well as online profiles.

We process—to the extent that the General Data Protection Regulation (GDPR) applies—personal data about applicants, in particular in accordance with Article 9(2)(b) of the GDPR.

We may allow applicants to submit their information to our talent pool so that we can consider them for future job openings. We may also use such information to maintain contact and provide updates. If we believe that an applicant is a suitable candidate for an open position based on the information provided, we may inform the applicant accordingly.

We use selected services from appropriate third parties to post job openings via e-recruitment and to facilitate and manage applications.

8. Data Security

We implement appropriate technical and organizational measures to ensure data security commensurate with the respective risk. In particular, our measures ensure the confidentiality, availability, traceability, and integrity of the personal data we process; however, we cannot guarantee absolute data security.

Access to our website and our other digital presence is secured via transport encryption (SSL/TLS, specifically using the Hypertext Transfer Protocol Secure, abbreviated as HTTPS). Most browsers issue a warning before visiting a website without transport encryption.

Our digital communications—like all digital communications in general—are subject to mass surveillance without cause or suspicion by security authorities in Switzerland, the rest of Europe, the United States of America (USA), and other countries. We have no direct influence over the processing of personal data by intelligence agencies, police departments, and other security authorities. Nor can we rule out the possibility that a data subject may be specifically monitored.

9. Personal Data Abroad

We generally process personal data in Switzerland and within the European Economic Area (EEA). However, we may also export or transfer personal data to other countries, in particular to process it there or have it processed there.

We may export personal data to any country on Earth and elsewhere in the universe, provided that the law of that country ensures an adequate level of data protection in accordance with a decision by the Swiss Federal Council and—if and to the extent that the General Data Protection Regulation (GDPR) applies—also in accordance with a decision by the European Commission.

We may transfer personal data to countries whose laws do not guarantee adequate data protection, provided that data protection is ensured for other reasons, in particular on the basis of standard data protection clauses or other appropriate safeguards. In exceptional cases, we may export personal data to countries without adequate or appropriate data protection if the specific legal requirements under data protection law are met, such as the explicit consent of the data subjects or a direct connection to the conclusion or performance of a contract. Upon request, we are happy to provide data subjects with information about any safeguards or to provide a copy of such safeguards.

10. Rights of Data Subjects

10.1 Data Protection Rights

We grant data subjects all rights in accordance with applicable law. Data subjects have the following rights in particular:

• Right of Access: Data subjects may request information as to whether we process personal data about them and, if so, what personal data is involved. Data subjects shall also receive the information necessary to assert their data protection rights and to ensure transparency. This includes the personal data being processed as such, as well as, among other things, details regarding the purpose of processing, the retention period, any disclosure or export of data to other countries, and the origin of the personal data.
• Correction and restriction: Data subjects may correct inaccurate personal data, complete incomplete data, and have the processing of their data restricted.
• Right to Express a View and Human Review: Data subjects may, in the case of decisions based exclusively on the automated processing of personal data that result in legal consequences for them or significantly affect them (automated individual decisions), present their own viewpoint and request a review by a human being.
• Erasure and Objection: Data subjects may request the erasure of personal data ("right to be forgotten") and object to the processing of their data with future effect.
• Data Disclosure and Data Portability: Data subjects may request the disclosure of personal data or the transfer of their data to another data controller.

We may defer, restrict, or deny the exercise of data subjects' rights to the extent permitted by law. We may inform data subjects of any prerequisites that must be met for the exercise of their data protection rights. For example, we may refuse to provide information in whole or in part, citing confidentiality obligations, overriding interests, or the protection of other individuals. We may also, for example, refuse to delete personal data in whole or in part, particularly citing statutory retention obligations.

In exceptional cases, we may charge a fee for the exercise of these rights. We will inform data subjects in advance of any such costs.

We are required to take reasonable measures to identify data subjects who request information or assert other rights. Data subjects are required to cooperate.

10.2 Legal Remedies

Data subjects have the right to enforce their data protection claims through legal action or to file a report or complaint with a data protection supervisory authority.

The data protection supervisory authority for private data controllers and federal agencies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

European data protection supervisory authorities are organized as members of the European Data Protection Board (EDPB). In some member states of the European Economic Area (EEA), the data protection supervisory authorities have a federal structure, particularly in Germany.

11. Use of the Website

11.1 Cookies

We may use cookies. Cookies—including our own cookies (first-party cookies) and cookies from third parties whose services we use (third-party cookies)—are data stored in the browser. Such stored data is not necessarily limited to traditional text-based cookies.

Cookies can be stored temporarily in the browser as "session cookies" or for a specific period of time as so-called permanent cookies. "Session cookies" are automatically deleted when the browser is closed. Permanent cookies have a specific retention period. In particular, cookies make it possible to recognize a browser the next time it visits our website and thereby, for example, measure the reach of our website. However, permanent cookies can also be used for online marketing, for example.

Cookies can be disabled, restricted, or deleted in whole or in part at any time via your browser settings. Browser settings often also allow for the automated deletion and other management of cookies. Without cookies, our website may no longer be fully available. We actively request—at least to the extent required by applicable law—your explicit consent to the use of cookies.

On our website, analytics cookies (Google Analytics 4) are only set after you explicitly consent via the cookie banner by clicking "Accept all." If you choose "Essential only," no analytics or marketing cookies are loaded. You can withdraw your consent at any time with effect for the future by deleting the stored site data in your browser; the cookie banner will then be displayed again on your next visit.

For cookies used to measure performance and reach or for advertising, a general opt-out is available for many services through AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance), or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

11.2 Logging

For each visit to our website and our other digital presence, we may log at least the following information, provided that it is transmitted to our digital infrastructure during such visits: Date and time, including time zone; IP address; access status (HTTP status code); operating system, including user interface and version; browser, including language and version; specific subpages of our website accessed, including the amount of data transferred; and the last webpage accessed in the same browser window (referrer).

We record such information, which may also constitute personal data, in log files. This information is necessary to ensure that our digital presence is available on a permanent, user-friendly, and reliable basis. The information is also necessary to ensure data security—including through third parties or with the assistance of third parties.

11.3 Web Beacons

We may incorporate tracking pixels into our digital presence. Tracking pixels are also known as web beacons. Tracking pixels—including those from third parties whose services we use—are typically small, invisible images or JavaScript scripts that are automatically loaded when you access our digital presence. Tracking pixels can collect at least the same information as is recorded in log files.

12. Notifications and Communications

12.1 Performance and Reach Measurement

Notifications and communications may contain web links or tracking pixels that track whether an individual message has been opened and which web links were clicked. Such web links and tracking pixels may also track the use of notifications and communications on a personal basis. We require this statistical tracking of usage for performance and reach measurement so that we can send notifications and communications in a way that is effective, user-friendly, sustainable, secure, and reliable, based on the needs and reading habits of the recipients.

12.2 Consent and Objection

You must generally consent to the use of your email address and other contact information, unless such use is permitted for other legal reasons. We may use the "double opt-in" procedure to obtain double-confirmed consent, if necessary. In this case, you will receive a message with instructions for double confirmation. We may log the consents obtained, including IP addresses and timestamps, for evidentiary and security purposes.

You may generally opt out of receiving notifications and communications, such as newsletters, at any time. By opting out, you may also object to the statistical tracking of your usage for the purpose of measuring success and reach. This does not apply to necessary notifications and communications related to our activities and operations.

12.3 Service Providers for Notifications and Communications

We send notifications and communications with the help of specialized service providers.

13. Social Media

We maintain a presence on social media platforms and other online platforms to communicate with interested individuals and provide information about our activities and operations. In connection with such platforms, personal data may also be processed outside of Switzerland and the European Economic Area (EEA).

The General Terms and Conditions (GTC), Terms of Use, privacy policies, and other provisions of the individual operators of such platforms also apply in each case. These provisions provide information, in particular, about the rights of data subjects directly vis-à-vis the respective platform, including, for example, the right of access.

For our social media presence on Facebook, including so-called Page Insights, we are jointly responsible—to the extent that the General Data Protection Regulation (GDPR) applies—with Meta Platforms Ireland Limited (Ireland) and the Meta group of companies (including those in the U.S.). Page Insights provide information on how visitors interact with our Facebook presence. We use Page Insights to ensure that our social media presence on Facebook is effective and user-friendly.

Further information regarding the nature, scope, and purpose of data processing, details on the rights of data subjects, and the contact information for Facebook as well as Facebook's Data Protection Officer can be found in Facebook's Privacy Policy. We have entered into the so-called "Addendum for Controllers" with Facebook and have thereby specifically agreed that Facebook is responsible for ensuring the rights of data subjects. For "Page Insights," the relevant information can be found on the About Page Insights page, including "About Page Insights Data."

14. Third-Party Services

We use services provided by specialized third parties to ensure that we can carry out our activities and operations in a sustainable, user-friendly, secure, and reliable manner. These services allow us, among other things, to embed features and content into our website. When such embedding occurs, the services used collect users' IP addresses—at least temporarily—for technically necessary reasons.

For necessary security-related, statistical, and technical purposes, third parties whose services we use may process data related to our activities and operations in an aggregated, anonymized, or pseudonymized form. This includes, for example, performance or usage data required to provide the respective service.

In particular, we use:

• Google services: Providers: Google LLC (U.S.) / Google Ireland Limited (Ireland), in part for users in the European Economic Area (EEA) and Switzerland; general information on data protection: "Data Protection and Security Principles," "More Information on How Google Uses Personal Data," Privacy Policy, "Google Is Committed to Complying with Applicable Data Protection Laws," "Guide to Data Protection in Google Products," "How We Use Data from Websites or Apps on Which Our Services Are Used," "Types of Cookies and Similar Technologies Used by Google," "Ads You Can Control" ("Personalized Ads").

14.1 Digital Infrastructure

We use services from specialized third parties to access the digital infrastructure required in connection with our activities and operations. These include, for example, hosting and storage services from selected providers.

In particular, we use:

• Google Cloud, including Google Cloud Platform (GCP): storage space and other infrastructure; Google Cloud-specific providers: national or regional Google subsidiaries, depending on the country and region; Google Cloud-specific information: "Data Protection Center," "Google Cloud and General Data Protection Principles," "Google Cloud Data Protection Notices," "Data Protection."
• Use of Lovable (App Development & Deployment): We use the AI-powered development tool Lovable from GPT Engineer AB, Stockholm, Sweden (hereinafter "Lovable") to develop and deploy our application.
  • Nature and Scope of Processing: Lovable enables us to efficiently create and update web applications. If you use our application, which is hosted on Lovable's infrastructure, technical data (e.g., IP address, browser type, time of access) as well as data you enter into the app may be processed.
  • Purpose: Lovable is used to provide a functional, modern, and user-friendly application and to optimize our digital services.
  • Legal basis: Your data is processed based on our legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in efficient software development and the secure operation of our application. If the application is used to fulfill a contract, Article 6(1)(b) of the GDPR serves as the legal basis.
  • Data Transfer: Since Lovable may use infrastructure providers (sub-processors) in third countries (particularly the U.S.), we have entered into a Data Processing Agreement (DPA) with the provider, including EU Standard Contractual Clauses, to ensure an adequate level of data protection.
  • For more information on data protection at Lovable, please see their Privacy Policy at: lovable.dev.

14.2 Scheduling

We use services from specialized third parties to schedule appointments online, such as for meetings. In addition to this Privacy Policy, any terms and conditions directly applicable to the services used—such as terms of use or privacy policies—also apply.

In particular, we use:

• Google Calendar: Online scheduling; Provider: Google; Google Calendar-specific information: "Scheduling with Google Calendar," "Privacy in Google Calendar."

14.3 Audio and Video Conferences

We use specialized services for audio and video conferences to enable online communication. This allows us, for example, to hold virtual meetings or conduct online classes and webinars. Participation in audio and video conferences is also subject to the legal terms of the individual services, such as privacy policies and terms of use.

Depending on your situation, we recommend that you mute your microphone by default when participating in audio or video conferences, as well as blur your background or display a virtual background.

In particular, we use:

• Google Meet: Video conferences; Provider: Google; Google Meet-specific information: "Google Meet – Security and Privacy for Users."
• Zoom: Platform for collaborative work, particularly video conferences; Provider: Zoom Video Communications Inc. (U.S.); Information on data protection: "Privacy at Zoom," Privacy Policy, "Compliance."

14.4 Online Collaboration

We use third-party services to enable online collaboration. In addition to this Privacy Policy, any terms and conditions of the services used that are directly visible—such as terms of use or privacy policies—also apply.

In particular, we use:

• Asana: Enterprise collaboration platform; Provider: Asana Inc. (U.S.); Privacy information: "Trust at Asana," Privacy Policy, Bug Bounty Program.
• Miro: Whiteboard platform; Provider: RealtimeBoard Inc. (U.S.); Privacy information: Privacy Policy, "Miro Trust Center."
• Slack: Platform for productive collaboration, particularly via chat; Providers: Slack Technologies LLC (U.S.) for users in Canada and the U.S. / Slack Technologies Limited (Ireland) for users in the rest of the world; Privacy information: Privacy Policy, "Trust Center," "Frequently Asked Questions About Privacy," "Data Management: Transparency and Clarity," Cookie Policy.

14.5 Social Media Features and Social Media Content

We use third-party services and plugins to embed features and content from social media platforms and to enable the sharing of content on social media platforms and through other channels.

In particular, we use:

• Facebook (Social Plugins): Embedding Facebook features and content, such as "Like" or "Share"; Providers: Meta Platforms Ireland Limited (Ireland) and other Meta companies (including those in the U.S.); Privacy Information: Privacy Policy.
• Instagram Platform: Embedding Instagram content; Providers: Meta Platforms Ireland Limited (Ireland) and other Meta companies (including those in the U.S.); Data protection information: Privacy Policy (Instagram), Privacy Policy (Facebook).
• LinkedIn Consumer Solutions Platform: Embedding LinkedIn features and content, for example using plugins such as the "Share Plugin"; Provider: Microsoft; LinkedIn-specific information: "Privacy," Privacy Policy, Cookie Policy, Cookie Management / Opting out of email and SMS communications from LinkedIn, Opting out of interest-based advertising.

14.6 Maps

We use third-party services to embed maps on our website.

In particular, we use:

• Google Maps, including the Google Maps Platform: mapping service; Provider: Google; Google Maps-specific information: "How Google uses location information."

14.7 Digital Content

We use services from specialized third parties to integrate digital content into our website. Digital content includes, in particular, images, videos, music, and podcasts.

In particular, we use:

• YouTube: Video platform; Provider: Google; YouTube-specific information: "Privacy and Security Center," "My Data on YouTube."

14.8 Fonts

We use third-party services to embed selected fonts, as well as icons, logos, and symbols, into our website.

In particular, we use:

• Google Fonts: Fonts; Provider: Google; Google Fonts-specific information: "Your Privacy and Google Fonts," "Privacy and Data Collection" (Google Fonts).

14.9 Advertising

We use targeted advertising on third-party platforms, such as social media platforms and search engines, to promote our activities and operations.

With such advertising, we aim in particular to reach people who are already interested in our activities and operations or who might be interested in them (remarketing and targeting). To this end, we may transmit relevant information—which may include personal data—to third parties that enable such advertising. We can also determine whether our advertising is successful, specifically whether it leads to visits to our website (conversion tracking).

Third parties through whom we advertise and with whom you, as a user, have an account may, in some cases, associate your use of our website with your profile on their platform.

In particular, we use:

• Google Ads: Search engine advertising; Provider: Google; Google Ads-specific information: Advertising based, among other things, on search queries, with various domain names—in particular doubleclick.net, googleadservices.com, and google-syndication.com—used for Google Ads; Privacy Policy for Advertising; "Manage ads displayed directly through Ads."
• LinkedIn Ads: Social media advertising; Providers: LinkedIn Corporation (U.S.) / LinkedIn Ireland Unlimited Company (Ireland); Privacy information: Remarketing and targeting, particularly using the LinkedIn Insight Tag, "Privacy," Privacy Policy, Cookie Policy, Opting out of personalized advertising.
• Meta Ads: Social media advertising on Facebook and Instagram; Providers: Meta Platforms Ireland Limited (Ireland) and other Meta companies (including those in the U.S.); Privacy information: Targeting, including retargeting, specifically using the Meta Pixel and Custom Audiences (including Lookalike Audiences), Privacy Policy, "Ad Preferences" (user registration required).

15. Website Extensions

We use website extensions to enable additional features. We may use selected services from suitable providers or implement such extensions on our own digital infrastructure.

16. Measuring Success and Reach

We strive to measure the success and reach of our activities and operations. In this context, we may also measure the impact of third-party content or test how different parts or versions of our digital presence are used (the "A/B testing" method). Based on the results of these success and reach measurements, we can, in particular, correct errors, enhance popular content, or make improvements.

In most cases, the IP addresses of individual users are collected for performance and reach measurement. In this context, IP addresses are generally truncated ("IP masking") to comply with the principle of data minimization through appropriate pseudonymization.

Cookies may be used to measure success and reach, and user profiles may be created. Any user profiles created may include, for example, the individual pages visited or content viewed on our digital platform, information about the size of the screen or browser window, and the user's location—at least approximately. As a general rule, any user profiles created are exclusively pseudonymized and are not used to identify individual users. Certain third-party services with which users are registered may, in some cases, associate the use of our online offering with the user's account or profile on the respective service.

In particular, we use:

• Clarity: Recording and analysis of user behavior on websites; Provider: Microsoft; Clarity-specific privacy information: "What data does Clarity collect?", Data Retention, Cookie Policy.
• Google Marketing Platform: Performance and reach measurement, particularly using Google Analytics; Provider: Google; Google Marketing Platform-specific information: Measurement across different browsers and devices (cross-device tracking) using pseudonymized IP addresses, which are only transferred in full to Google in the U.S. in exceptional cases; Google Analytics Privacy Policy; Browser add-on to disable Google Analytics.
• Google Tag Manager: Integration and management of services from Google and third parties, particularly for performance and reach measurement; Provider: Google; Google Tag Manager-specific information: Privacy Policy for Google Tag Manager; additional information on data protection can be found in the privacy policies of the individual integrated and managed services.
• Hotjar: Recording of user behavior; Provider: Hotjar Ltd. (Malta); Privacy information: Recording without reference to individual website visitors, for example regarding movements and clicks with a mouse or other input device, "Privacy and Hotjar," "Privacy," Privacy Policy, Cookie Policy, "Security."

Google Analytics 4: On this website we currently use Google Analytics 4, a web analytics service provided by Google, to measure the performance and reach of our pages. Google Analytics is only loaded after your explicit consent via our cookie banner. IP anonymization is enabled, so your IP address is truncated before processing. You can withdraw your consent at any time by deleting the stored site data in your browser, or prevent data collection altogether with Google's browser add-on to disable Google Analytics.

17. Final Notes on the Privacy Policy

We have created this Privacy Policy using the Privacy Policy Generator from Datenschutzpartner.

We may update this Privacy Policy at any time. We will notify you of updates in an appropriate manner, in particular by publishing the most current version of the Privacy Policy on our website.