This privacy policy describes how we, as the data protection controllers, process your personal data in connection with this website and the services and other provisions built upon it. The privacy policy applies regardless of the domains, systems, platforms, devices used, and also for services not provided online.

1. **General Information**

We treat the data entrusted to us with strict confidentiality and exclusively in compliance with relevant data protection regulations. Data processing is carried out solely for the purpose of achieving a purpose agreed upon in the contract, based on explicit consent, or on another legal basis.

Furthermore, we implement organizational, contractual, and technical security measures, in line with current technology, to ensure that data protection regulations are observed and your data is secured as best as possible.

2. **Collection and Processing of Personal Data**

Your personal data is collected both during your registration and specific contract conclusions/assignments and also automatically by your computer when you visit our website. The data actually transmitted automatically depends on the use of certain third-party software or analysis tools.

These data may include:

- Inventory data (name, address).

- Company data (company registration number; VAT number).

- Contact data (email, phone numbers, social media addresses).

- Content data (text inputs in forms, marketing budget, marketing area).

- Contract data (subject matter of the contract, duration, customer category).

- Payment data (bank details, payment history).

- Usage data (visited websites, interest in content, access times).

- Meta/communication data (IP addresses, time of the request, access status/http status code, amount of data transferred, website from which the request comes, browser and browser settings, operating system and its interface, language and version of the browser software).

- Project information may contain specific personal data in the course of project processing;

There is no obligation to actually provide the data we ask you to provide. If you choose not to do so, e.g., by using ad blockers or plug-ins, certain functions may not be fully available for technical reasons, or registration may not be possible if data required for registration is missing. This could also mean that requests or projects cannot be realized.

3. **Categories of Persons Affected by Processing**

- Customers, prospects, business partners.

- Visitors and users of the online offer.

Hereinafter, we collectively refer to the affected persons as "users".

4. **Purposes of Data Processing**

Personal data is processed for the following purposes:

- To fulfill the purpose intended when entering your data into the designated fields, especially for registration, signing up for a newsletter, or implementing commissioned services;

- Processing of contractual services;

- To technically develop and improve the website;

- To create usage statistics;

- To detect, prevent, and investigate attacks or malware.

- Marketing, advertising, and market research.

- Responding to contact requests and communicating with users.

5. **Used Terms**

5.1. "Personal data" are all information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

5.2. "Processing" is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data.

5.3. "Controller" refers to the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

6. **Changes and Updates to the Privacy Policy**

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as the changes in our data processing make it necessary. We will inform you as soon as the changes require your participation (e.g., consent) or other individual notification.

7. **Security Measures**

We take appropriate technical and organizational measures in accordance with legal requirements, considering the state of technology, the implementation costs, and the nature, scope, circumstances, and purposes of processing as well as the different likelihood and severity of the risk to the rights and freedoms of natural persons; the measures include, in particular, securing the confidentiality, integrity, and availability of data by controlling physical access to the data, as well as the access, input, transfer, ensuring availability and its separation. Furthermore, we consider the protection of personal data already in the development, or selection of hardware, software, and procedures, according to the principle of data protection through technology design and by data protection-friendly default settings.

8. Cookies When you visit our website, "cookies" are stored on your device. These are small text files that store certain settings and data for exchange with our system via your browser. A cookie contains the name of the domain from which the cookie data was sent, as well as information about the age of the cookie and a cookie ID. Cookies help us to improve our web presence and to offer you optimized services.

The so-called session cookies used by us only temporarily store the data explained above about your use of the website. This allows your computer to be recognized when you return to our web presence. Session cookies are deleted when you close your browser or leave the website.

In addition, persistent cookies are used, which are stored on your computer until you manually delete them. Such cookies enable us to recognize your device, which has already visited our web presence, and to analyze the use of our web presence in a non-personal manner.

If you want to control the cookie settings on your computer, you can choose your browser settings so that you receive a notification when a website wants to store cookies. You can also completely block cookies or delete them once they have already been stored on your computer. If you want to learn more about this, use the "Help" function in your browser.

Please note that restricting cookies may affect the use of our web presence.

9. Integration of Third-Party Technologies Our web pages incorporate technologies, services, or libraries from third parties, such as those from jQuery.com, Google, Twitter, or YouTube, to optimize the user experience, improve loading speeds and page presentation, or to display special media content, such as videos.

This involves calling up resources from these providers from external servers (and thus also transmitting data such as the IP address), which may be located outside the European Union. We have no control over the data collected and data processing operations, nor are we aware of the full extent of data collection, the purposes, and the storage periods. For further information on the purpose and scope of data collection and processing by these third parties, please refer to the respective privacy statements of these providers. There you will also find further information about your related rights and settings options for protecting your privacy.

10. Web Analysis Our website uses features of the web analysis service Google Analytics, a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses "cookies". We process your data based on our overriding legitimate interest in creating a cost-effective web access statistics in an easy-to-use manner (Art 6 para 1 lit f GDPR).

The information generated by the cookie about your use of this website (including IP address and URLs of the accessed web pages) is transferred to servers in the USA and stored there. We do not store any of your data collected in connection with Google Analytics. This website uses the IP anonymization feature offered by Google Analytics. Therefore, your IP address will be truncated/anonymized by Google as soon as Google receives your IP address. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activities, and to provide us with other services related to website and internet use. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent the storage of the analysis cookie by setting your browser accordingly. We point out that in this case you may not be able to use all the features of this website in full. You can also download and install a browser plugin that prevents Google from collecting your data in connection with Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=de

You can also prevent the collection of your data by clicking on the link below, which sets an opt-out cookie that prevents the future collection of your data when visiting our website:

For more information on Google's terms of use and privacy policy, please visit https://policies.google.com/privacy?hl=de

11. Google Re/Marketing Services We use the marketing and remarketing services (short "Google Marketing Services") of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), based on our legitimate interests, i.e., interest in analyzing, optimizing, and economically operating our online offering as per Art. 6 Abs. 1 lit. f. GDPR.

Google is certified under the Privacy Shield Agreement, thereby guaranteeing compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Google Marketing Services allow us to display ads more specifically for and on our website, presenting users with ads that potentially match their interests. For example, if a user is shown ads for products they were interested in on other websites, this is referred to as "Remarketing". For these purposes, a code from Google is executed directly by Google and so-called (Re)marketing Tags (invisible graphics or code, also known as "Web Beacons") are integrated into the webpage when our and other websites where Google Marketing Services are active are called up. With their help, an individual cookie, i.e., a small file, is stored on the user's device (similar technologies can also be used instead of cookies). The cookies can be set from various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com, or googleadservices.com. This file notes which web pages the user has visited, what content they are interested in, and what offers they have clicked on, as well as technical information about the browser and operating system, referring web pages, visiting time, and other information on the use of the online offer. The IP address of the users is also captured, where we inform in the context of Google Analytics that the IP address is shortened within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and only in exceptional cases is transferred in full to a Google server in the USA and shortened there. The IP address is not merged with the user's data within other Google offers. The aforementioned information may also be linked by Google to such information from other sources. When the user subsequently visits other websites, ads tailored to their interests can be displayed to them.

The data of the users are processed pseudonymously within the framework of the Google Marketing Services. That is, Google stores and processes, e.g., not the name or email address of the users, but processes the relevant data cookie-related within pseudonymous user profiles. That is, from the perspective of Google, the ads are not managed and displayed for a concretely identified person, but for the cookie owner, regardless of who this cookie owner is. This does not apply if a user has expressly allowed Google to process the data without this pseudonymization. The information collected by Google Marketing Services about users is transmitted to Google and stored on Google's servers in the USA.

Among the Google Marketing Services we use is the online advertising program "Google AdWords". In the case of Google AdWords, each AdWords customer receives a different "Conversion-Cookie". Thus, cookies cannot be tracked across websites by AdWords customers. The information obtained with the help of the cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. However, the AdWords customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. They do not receive any information that can personally identify users.

Based on the Google Marketing Service "DoubleClick", we can integrate third-party advertisements. DoubleClick uses cookies that enable Google and its partner websites to display ads based on users' visits to this website or other websites on the Internet.

Based on the Google Marketing Service "AdSense", we can integrate third-party advertisements. AdSense uses cookies, with which Google and its partner websites enable the placement of ads based on visits by users to this website or other websites on the Internet.

We can also use the "Google Optimizer" service. Google Optimizer allows us in the context of so-called "A/B testing" to understand how various changes to a website affect it (e.g., changes to input fields, design, etc.). For these testing purposes, cookies are placed on users' devices. Only pseudonymous data of the users is processed.

Furthermore, we can use the "Google Tag Manager" to integrate and manage Google analysis and marketing services into our website.

For more information on Google's use of data for marketing purposes, visit the overview page: https://policies.google.com/technologies/ads, Google's privacy policy is available at https://adssettings.google.com/authenticated.

12. Facebook Remarketing Within our online offering, so-called "Facebook Pixels" of the social network Facebook, operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are located in the EU, by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"), are used. With the help of the Facebook Pixel, it is possible for Facebook to determine the visitors of our offer as a target group for the display of ads, so-called "Facebook Ads". Accordingly, we use the Facebook Pixel to show the Facebook Ads placed by us only to those Facebook users who have shown an interest in our online offering. This means that with the help of the Facebook Pixel, we want to ensure that our Facebook Ads correspond to the potential interest of the users and are not perceived as annoying. With the help of the Facebook Pixel, we can also understand the effectiveness of Facebook advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advertisement.

The Facebook Pixel is directly integrated by Facebook when our web pages are called up and can store a so-called cookie, i.e., a small file, on your device. When you subsequently log in to Facebook or visit Facebook in a logged-in state, the visit to our offer is noted in your profile. The data collected about you is anonymous to us, so it does not provide us with any conclusions about the identity of the users. However, the data is stored and processed by Facebook, so a connection to the respective user profile is possible. The processing of data by Facebook is carried out within the framework of Facebook's Data Use Policy. Accordingly, you can find more information about the functioning of the remarketing pixel and generally about the display of Facebook Ads in Facebook's Data Use Policy: https://www.facebook.com/policy.php.

You can object to the collection by the Facebook Pixel and the use of your data for the display of Facebook Ads. To do this, you can access the page set up by Facebook and follow the instructions on the settings for usage-based advertising: https://www.facebook.com/settings?tab=ads or declare the objection via the US page http://www.aboutads.info/choices/ or the EU page http://www.youronlinechoices.com/. The settings are platform-independent, i.e., they are adopted for all devices, such as desktop computers or mobile devices.

13. ActiveCampaign We use ActiveCampaign on our website, a service for our email marketing. The provider is the American company ActiveCampaign, 1 N Dearborn St 5th floor, Chicago, IL 60602, USA. ActiveCampaign processes data, including in the United States of America – USA. We note that, according to the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. This can mean various risks for the legality and security of data processing.

As the basis for data processing with recipients located in third countries (outside the European Union, Liechtenstein, Iceland, Norway, especially in the USA) or data transfer there, ActiveCampaign uses standardized contractual clauses approved by the EU Commission (Art. 46, para. 2 and 3 GDPR). These clauses oblige ActiveCampaign to comply with the EU level of data protection when processing relevant data outside the EU. These clauses are based on an implementing decision of the EU Commission. You can find this decision and the clauses, among other things, here: https://ec.europa.eu/germany/news/20210604-datentransfers-eu_de.

More about the data processed through the use of ActiveCampaign can also be found in the Privacy Policy at https://www.activecampaign.com/legal/privacy-policy.

14. Business Analysis and Market Research To economically operate our business, recognize market trends, and understand customer and user preferences, we analyze the data available to us on business transactions, contracts, inquiries, etc. We process inventory data, communication data, contract data, payment data, usage data, and metadata based on Art. 6 Abs. 1 lit. f. GDPR, involving customers, prospects, business partners, visitors, and users of the online offer. The analyses are conducted for the purpose of business evaluations, marketing, and market research. In doing so, we may consider the profiles of registered users with details such as their purchasing transactions. The analyses serve to enhance user-friendliness, optimize our offer, and improve our business efficiency. These analyses are for our use only and are not disclosed externally unless they are anonymous analyses with aggregated values.

If these analyses or profiles are personal, they are deleted or anonymized upon the user's cancellation, or otherwise two years after the conclusion of the contract. Moreover, the overall business analyses and general trend determinations are created anonymously wherever possible.

15. Collection of Access Data and Log Files Based on our legitimate interests in the sense of Art. 6 Abs. 1 lit. f. GDPR, we collect data on every access to the server where this service is located (so-called server log files). Access data includes the name of the accessed web page, file, date and time of access, amount of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address, and the requesting provider.

Log file information is stored for security reasons (e.g., to investigate abuse or fraud actions) for a maximum of seven days and then deleted. Data whose further retention is required for evidence purposes is exempt from deletion until the final clarification of the respective incident.

16. Online Presence in Social Media Based on our legitimate interests in the sense of Art. 6 Abs. 1 lit. f. GDPR, we maintain online presences within social networks and platforms to communicate with active customers, prospects, and users there and inform them about our services. The terms and conditions and data processing policies of the respective operators apply when accessing the respective networks and platforms.

We use Google Analytics to show ads placed within Google's and its partners' advertising services only to users who have shown an interest in our online offer or who have certain characteristics (e.g., interests in specific topics or products determined by the visited web pages) that we transmit to Google (so-called "Remarketing" or "Google Analytics Audiences"). With the help of Remarketing Audiences, we also want to ensure that our ads correspond to the potential interest of the users and are not perceived as annoying.

17. Disclosure and Transmission of Data If we disclose data to other persons and companies (processors or third parties) within the framework of our processing, transmit it to them or otherwise grant them access to the data, this is done only based on a legal permission (e.g., if a transfer of the data to third parties, such as payment service providers, according to Art. 6 Abs. 1 lit. b GDPR is necessary for contract fulfillment), if you have consented, a legal obligation provides for this, or based on our legitimate interests (e.g., when using agents, hosting providers, tax, economic and legal advisors, customer care, accounting, billing, and similar services that allow us to efficiently and effectively fulfill our contractual obligations, administrative tasks, and duties).

If we commission third parties to process data on the basis of a so-called "data processing agreement", this is done based on Art. 28 GDPR.

The basic business model of our services is to mediate between customers and IT experts, compare offers, and assist in selecting an expert. As part of these services, forwarding information to the experts is necessary. This includes partly the personal data mentioned under 2. By commissioning the desired services, you expressly consent to the forwarding of this personal data. This can be revoked at any time. Due to the core element of forwarding this data to experts to enable successful mediation, further support and mediation will be discontinued or limited in this case.

18. Transfers to Third Countries If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs as part of using services of third parties or disclosing/transmitting data to third parties, this is only done to fulfill our (pre)contractual obligations, based on your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or let the data be processed in a third country only if the special conditions of Art. 44 et seq. GDPR are present. This means, for example, processing is carried out on the basis of special guarantees, such as the officially recognized determination of a level of data protection equivalent to the EU (e.g., for the USA through the "Privacy Shield") or observance of officially recognized special contractual obligations (so-called "standard contractual clauses").

19. Borlabs Cookie This website uses Borlabs Cookie, which sets a technically necessary cookie (borlabs-cookie) to save your cookie consents. Borlabs Cookie does not process any personal data. In the borlabs-cookie, your consents that you have given when entering the website are stored. If you want to revoke these consents, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked again for your cookie consent.

20. Transmission of Personal Data For the above-mentioned purposes, we transmit your personal data to the following recipients:

• IT experts for offer preparation;

• Payment service providers for completing a purchase process, if payment processing is done through us;

• Hosting providers;

• Providers of analysis tools (see "Web Analysis").

Some of the above-mentioned recipients are located outside the country in which you are located or from which you accessed the website. The level of data protection in other countries may not correspond to that of your country. We transmit personal data only to countries for which the EU Commission has decided that they have an adequate level of data protection or we implement measures to ensure that all recipients have an adequate level of data protection. These are available upon request.

21. Data Retention Your personal data will only be stored as long as there is a legal basis for it. In the case of a contract conclusion, all data from the contractual relationship will be stored until the end of the tax retention period (7 years).

22. Your Rights According to the General Data Protection Regulation, you as the data subject have the rights and remedies listed below.

Right to Information According to Art 15 GDPR, every data subject has the right to request confirmation as to whether personal data concerning them is being processed. It may be necessary for you to prove your identity in a suitable form.

Correction and Deletion According to Art 16 GDPR, as a data subject, you have the right to immediately request the correction of incorrect personal data concerning you or - considering the purposes of the data processing - the completion of incomplete personal data. According to Art 17 GDPR, there is a right to deletion ("right to be forgotten") of the data.

Restriction of Processing According to Art 18 GDPR, there is the right to restrict the processing of all collected personal data which can only be processed with individual consent or for the assertion and enforcement of legal claims from then on.

Data Portability According to Art 20 GDPR, there is the right to data portability, which is the right to request the unhindered and unrestricted transmission of collected personal data to a third party.

Right to Object According to Art 21 para 1 GDPR, every data subject has the right, for reasons arising from their particular situation, to object at any time to the processing of personal data concerning them, which is necessary for the performance of a task that is in the public interest or in the exercise of official authority conferred on the controller (Art 6 para 1 lit e GDPR) or which is necessary for the protection of the legitimate interests of the controller or a third party (Art 6 para 1 lit f GDPR). This also applies to profiling based on these provisions. The controller will no longer process the personal data unless they can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is for the establishment, exercise, or defense of legal claims.

According to Art 21 paras 2 and 3 GDPR, every data subject has the right to object to the processing of data for the purpose of direct advertising with effect for the future.

If you take measures to enforce your rights mentioned above from the GDPR, we must respond immediately, but at the latest within one month after receipt of your request for the proposed measure.

Right of Recourse For requests concerning violation of the right to information, violation of the rights to confidentiality, correction, or deletion, the data protection authority is responsible.

23. Responsible Party and Contact: If you have questions or concerns about the processing of your personal data, please contact us by mail or email: lucas@creatiks.io