1 General Information

Below we inform you about the processing of your personal data when you use our website. We would like to explain our processing operations and comply with our legal obligations, in particular those arising from the EU General Data Protection Regulation (GDPR).
With these data protection notices, we fulfil our obligation under Art. 12 to Art. 14 GDPR. You can find the full text of the GDPR here.

Definitions

• Personal data within the meaning of Art. 4 No. 1 GDPR are any data relating to you personally, e.g. name, address, e-mail addresses, user behaviour.

• Processing within the meaning of Art. 4 No. 2 GDPR is any operation related to personal data, e.g. the collection, storage, combination or deletion of your data.

Controller

The controller pursuant to Art. 4 Para. 7 GDPR is

Groundfog GmbH
Königsbrücker Str. 34
01099 Dresden
contact@groundfog.cloud

(see our imprint).

Data Protection Officer

You can reach our Data Protection Officer at

compliance@groundfog.cloud

or at our postal address with the addition “Datenschutzbeauftragte”

Groundfog GmbH
Attn. Data Protection Officer
Königsbrücker Str. 34
01099 Dresden

2 Data Collection When Accessing and Using Our Website

Your data are collected partly automatically when you access our website (e.g. to display the website at all) and partly when you provide them (e.g. by entering data in our contact form). Below you will find a description of the scope of our data processing, the legal bases, purpose, storage period and options for objection or deletion with regard to our data processing.

2.1 Website Encryption and Internet/Data Security (TLS/SSL Encryption)

We use SSL/TLS encryption to protect your data on our website. Encryption is active when “https://” and a lock symbol are shown in your browser. Encryption protects your data from third-party access. We point out, however, that complete protection of your data from third-party access cannot be guaranteed.

2.2 Data Processing by and with Third Parties

In this section we inform you about data processing operations performed by and with third parties (processing on our behalf or joint responsibility). If the third party acts on its own responsibility, you can also contact the provider directly to assert your rights.

2.2.1 Adobe Systems Software Ireland Limited

Our website is hosted on servers of Adobe Systems Software Ireland Limited. Adobe is an internationally active cloud service provider based in Ireland and part of the Adobe group headquartered in the USA.
All data collected and stored by us when you visit our website therefore reside on Adobe servers.
We have concluded a data processing agreement pursuant to Art. 28 GDPR.

Data processed:

• IP address (anonymised)
• Technical access data
• Accessed content

Third-country transfer:

Adobe may transmit data outside the EU, particularly to the USA. The transfer is based on the EU Commission’s Standard Contractual Clauses. Detailed information on Adobe’s data processing can also be found in Adobe’s privacy policy.

Privacy policy: https://www.adobe.com/de/privacy/policy.html

2.2.2 Amazon Web Services (AWS, CloudFront)

To deliver content efficiently we use the content delivery network (CDN) Amazon CloudFront, a service of Amazon Web Services, Inc. (AWS). All data collected by CloudFront when you visit our website reside on AWS servers.
CloudFront enables faster, more secure delivery of our website content to you by caching content at locations closer to you, thus reducing load times.

Data processed:

• Anonymised IP address
• Timestamp
• Device information
• Requested resources (e.g. images, scripts)

Third-country transfer:

Personal data may be transferred to servers in third countries, particularly the USA. The transfer is based on the EU Commission’s Standard Contractual Clauses. AWS is also certified under the EU-U.S. Data Privacy Framework. Further information on data processing and your rights can be found in AWS’s privacy policy.

Privacy policy: https://aws.amazon.com/privacy/

We have also concluded a data processing agreement with CloudFront (AWS) pursuant to Art. 28 GDPR.

2.3 Data Processing with Cookies

Our website uses cookies. Cookies are text files stored on the user’s device.
We distinguish between technically necessary cookies and cookies for analysis and marketing purposes (e.g. Google Analytics, HubSpot). You can prevent or restrict the setting of cookies at any time via your browser settings.

2.3.1 Description of Data Processing

Your data are processed with cookies as follows:

• Storage of session information
• Analysis of user behaviour
• Personalisation of content

The following cookies are set:

Scope of data processing

• IP address (anonymised)
• Pages or subpages visited on our website
• Timestamp
• Other usage data (e.g. session duration, device used, referrer)

The anonymisation prevents us from assigning the data to the calling user. The data are not stored together with other personal data of the user by us.

Legal basis for data processing

• Technically necessary cookies: Art. 6 Para. 1 lit. f GDPR (legitimate interest)
• Analysis and marketing cookies: Art. 6 Para. 1 lit. a GDPR (your consent)

Purpose of data processing

• Ensuring the functionality of the website (necessary cookies)
• Analysis and optimisation of our online offering (analysis and marketing cookies)
• Marketing and reach measurement (analysis and marketing cookies)

Storage duration

Cookies are either stored only for the duration of your visit and deleted automatically when you close your browser (session cookies), or they remain on your device beyond your session (persistent cookies). The storage duration is indicated above for each cookie.

Objection / deletion option

You can withdraw your consent at any time via the cookie settings on our website. You can also delete stored cookies manually at any time and activate automatic deletion of cookies when closing your browser. Otherwise, cookies expire after their storage period and are deleted.

2.4 Further Data Processing

The following describes data processing with external tools that we use to conduct our business processes, for marketing and sales activities, and to analyse and optimise our digital offering. If you contact us by e-mail, we process your information to handle your request. Communication is via Google Workspace.

Services used (providers):

• Google Workspace (Google Ireland Limited / Google LLC)
• HubSpot (HubSpot Inc.)
• LinkedIn (LinkedIn Inc.)
• Apollo (Apollo.io)
• E-mail communication (via Google Workspace)

Data processed:

• Name, e-mail address, telephone number
• Company name
• LinkedIn profile
  Message content, form content
• IP address (shortened)
• Usage behaviour on our website (e.g. pages visited, duration, interactions)
• Device used, operating system, browser type

Scope of processing:

Data are processed automatically or manually, stored, analysed and linked with CRM systems. They are used for personalised marketing communication, internal automation and to analyse and improve our website.

Third-country transfer:

When using the services (Google Workspace, HubSpot, LinkedIn, Apollo) personal data may be transferred to third countries (particularly the USA). The transfer is based on the EU Standard Contractual Clauses. HubSpot is additionally certified under the EU-U.S. Data Privacy Framework. All providers implement appropriate technical and organisational measures to protect your data (e.g. encryption, access restrictions). We have concluded data processing agreements with all providers pursuant to Art. 28 GDPR.

Legal basis for processing:

• Art. 6 Para. 1 lit. b GDPR (performance of a contract) for handling your request
• Art. 6 Para. 1 lit. a GDPR (your consent) insofar as you have consented to further marketing communication
• For communication aimed at initiating or fulfilling a contract, processing is based on Art. 6 Para. 1 lit. b GDPR (pre-contractual measures).

Purposes of processing:

• Customer relationship management
• Responding to enquiries
• Marketing and sales automation
• Identification of potential business contacts
• Analysis and improvement of our digital offerings
• Success measurement and optimisation of paid media campaigns on LinkedIn

Storage period:

Until you withdraw your consent or at the latest 3 years after the last user interaction in accordance with our deletion policy.

Note on HubSpot: After a deletion request, your data are permanently deleted by HubSpot within 30 days (according to the provider).

Further information and privacy policies:

• Google Workspace: https://policies.google.com/privacy
• HubSpot GDPR info: https://legal.hubspot.com/de/privacy-policy
• Apollo: https://www.apollo.io/privacy-policy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

3 Rights of Data Subjects / Your Rights as a Website User

3.1 Your Rights

You may exercise the following rights regarding your processed personal data at any time using the contact details provided in section 1.2:

• Access (Art. 15 GDPR): Obtain information about the processing purposes, data category, recipient categories, planned storage period, existence of a right to rectification, erasure, restriction of processing or objection, existence of a right to lodge a complaint, source of your data (if not collected by us), and the existence of automated decision-making including profiling.

• Rectification (Art. 16 GDPR): Immediate correction of inaccurate or completion of your data stored by us.

• Erasure (Art. 17 GDPR): Deletion of your data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, fulfilling a legal obligation, reasons of public interest or establishing, exercising or defending legal claims.

• Restriction of processing (Art. 18 GDPR): Restriction of processing if you contest the accuracy of the data or processing is unlawful.

• Data portability (Art. 20 GDPR): Receive your data in a structured, commonly used and machine-readable format or request transmission to another controller.

• Objection (Art. 21 GDPR): Object to processing if it is based on Art. 6 Para. 1 S. 1 lit. e or lit. f GDPR. Unless it concerns direct marketing, please explain why we should not process your data as we do; we will examine the situation and either stop or adjust the processing or demonstrate our compelling legitimate grounds.

• Withdrawal of consent (Art. 7 Para. 3 GDPR): Withdraw any consent given at any time; this will prevent future processing based on that consent.

• Complaint (Art. 77 GDPR): Lodge a complaint with a supervisory authority. Our competent authority is:

Sächsische Datenschutz- und Transparenzbeauftragte (SDTB)
Maternistraße 17, 01067 Dresden
P.O. Box 11 01 32, 01330 Dresden
post@sdtb.sachsen.de
<www.datenschutz.sachsen.de>

3.2 Notes on Changes

As data protection law and technological or organisational changes evolve, our privacy notices are regularly reviewed for the need for adjustments or additions. You will be informed of changes, in particular on our website at <www.groundfog.cloud>.
These data protection notices are current as of September 2026.