Privacy policy

Hinweis / Note: Die deutsche Fassung ist die rechtsverbindliche Version. Die englische Fassung ist eine Arbeitsübersetzung ohne eigenständigen Rechtsstatus; bei Abweichungen gilt ausschließlich die deutsche Fassung.

The German version is the legally binding version. The English version is a working translation without independent legal status; in case of discrepancies, the German version alone shall prevail.

Last updated: 28 July 2026

1. Introduction

Below we inform you about the processing of personal data when using

our website www.emax-digital.com

our social media profiles.

Personal data is any data that can be related to a specific natural person, e.g. their name or IP address.

1.1 Contact details

The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is emax digital GmbH, Balanstr. 73, Munich, Germany, email: contact@emax-digital.com. We are legally represented by Dominik Pietrowski and Andreas Kleofas.

Our data protection officer can be reached via heyData GmbH, Gormannstr. 14, 10119 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.

1.2 Scope of data processing, purposes of processing, and legal bases

We describe the scope of data processing, the purposes of processing, and the legal bases in detail below. The following legal bases generally apply to data processing:

Art. 6(1)(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent.

Art. 6(1)(1)(b) GDPR is the legal basis where processing of personal data is necessary for the performance of a contract, e.g. when a website visitor purchases a product from us or we perform a service for them. This legal basis also applies to processing required for pre-contractual measures, such as inquiries about our products or services.

Art. 6(1)(1)(c) GDPR applies where we process personal data to comply with a legal obligation, as may be the case, for example, under tax law.

Art. 6(1)(1)(f) GDPR serves as the legal basis where we can rely on legitimate interests for the processing of personal data, e.g. for cookies required for the technical operation of our website.

1.3 Data processing outside the EEA

To the extent we transfer data to service providers or other third parties outside the EEA, adequacy decisions of the EU Commission pursuant to Art. 45(3) GDPR guarantee the security of the data during transfer, where such decisions exist, as is currently the case for the United Kingdom, Canada, and Israel, for example.

For data transfers to service providers in the USA, the legal basis for the transfer is an adequacy decision of the EU Commission, provided the service provider is additionally certified under the EU-US Data Privacy Framework.

In other cases (e.g. where no adequacy decision exists), the legal basis for the data transfer, unless we indicate otherwise, is generally Standard Contractual Clauses. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. Pursuant to Art. 46(2)(b) GDPR, they ensure the security of the data transfer. Many providers have given contractual guarantees going beyond the Standard Contractual Clauses that provide additional protection for the data, for example guarantees regarding data encryption or an obligation on the third party to notify data subjects if law enforcement authorities seek access to the data.

1.4 Retention period

Unless expressly stated otherwise in this privacy policy, data stored by us is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations preclude deletion. Where data is not deleted because it is required for other, legally permissible purposes, its processing is restricted, i.e. the data is blocked and not processed for other purposes. This applies, for example, to data we are required to retain for commercial or tax law reasons.

1.5 Rights of data subjects

Data subjects have the following rights against us regarding their personal data:

Right to access,
Right to rectification or erasure,
Right to restriction of processing,
Right to object to processing,
Right to data portability,
Right to withdraw a given consent at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. Contact details of the data protection supervisory authorities are available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6 Obligation to provide data

Within the scope of a business relationship or other relationship, customers, prospects, or third parties are only required to provide us with the personal data necessary for establishing, performing, and terminating the business relationship or other relationship, or which we are legally obliged to collect. Without this data, we will generally have to decline to enter into a contract or provide a service, or will no longer be able to perform an existing contract or other relationship.

Mandatory fields are marked as such.

1.7 No automated decision-making in individual cases

We generally do not use fully automated decision-making pursuant to Article 22 GDPR to establish or perform a business relationship or other relationship. Should we use such procedures in individual cases, we will inform you separately where legally required to do so.

1.8 Contacting us

When you contact us, e.g. by email or telephone, the data you provide to us (e.g. name and email address) is stored by us in order to answer your questions. The legal basis for this processing is our legitimate interest (Art. 6(1)(1)(f) GDPR) in responding to inquiries addressed to us. We delete the data arising in this context once storage is no longer required, or restrict its processing where statutory retention obligations apply.

2. Newsletter

We reserve the right to inform customers who have already used our services or purchased goods from us from time to time by email or other means about our offers, provided they have not objected to this. The legal basis for this data processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in direct marketing (Recital 47 GDPR). Customers may object to the use of their email address for marketing purposes at any time, free of charge, for example via the link at the end of each email or by email to our email address stated above.

Prospective customers have the option to subscribe to a free newsletter. We process the data provided at registration exclusively for sending the newsletter. Registration takes place by selecting the corresponding field on our website, by ticking the corresponding box on a paper document, or through another clear affirmative action by which the person expresses their consent to the processing of their data, so that the legal basis is Art. 6(1)(1)(a) GDPR. Consent can be withdrawn at any time, e.g. by clicking the corresponding link in the newsletter or by notifying us at the email address stated above. The processing of the data up to the withdrawal remains lawful even in the event of a withdrawal.

Based on the recipients' consent (Art. 6(1)(1)(a) GDPR), we also measure the open and click rates of our newsletters in order to understand which content is relevant to our recipients.

We send newsletters using the HubSpot tool provided by HubSpot, Inc., 25 1st Street, Cambridge, MA 0214, USA. The provider processes content, usage, meta/communication, and contact data in the USA. Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.

3. B2B direct outreach (collection of data from third-party sources pursuant to Art. 14 GDPR)

We process personal data of representatives of potential business customers (B2B) for the purpose of business development and direct outreach. The provider processes content, usage, meta/communication, and contact data (e.g. names, business email addresses, LinkedIn profile URLs). The data originates from publicly accessible sources or B2B databases (e.g. Apollo). The legal basis for the processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in direct marketing and acquisition in the B2B sector. Data subjects may object to the use of their data for marketing purposes at any time, free of charge, for example by email to our email address stated above.

4. Data processing on our website

4.1 Notice for website visitors from Germany

Our website stores information on website visitors' end devices (e.g. cookies) or accesses information already stored on the end device (e.g. IP addresses). The specific information involved is described in the following sections.

This storage and access takes place on the basis of the following provisions:

Where such storage or access is strictly necessary to provide the service of our website expressly requested by website visitors (e.g. to operate a chatbot used by the website visitor or to ensure the IT security of our website), it takes place on the basis of Section 25(2) No. 2 of the German Telecommunications-Digital-Services-Data Protection Act (TDDDG).

Otherwise, this storage or access takes place on the basis of the website visitor's consent (Section 25(1) TDDDG).

Downstream data processing takes place in accordance with the following sections and on the basis of the provisions of the GDPR.

4.2 Informational use of the website

When the website is used for informational purposes only, i.e. when website visitors do not separately transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This constitutes our legitimate interest, so that the legal basis is Art. 6(1)(1)(f) GDPR.

This data comprises:

IP address
Date and time of the request
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Volume of data transferred in each case
Website from which the request originates
Browser
Operating system and its interface
Language and version of the browser software.

This data is additionally stored in log files. It is deleted once it is no longer required for storage, at the latest after 14 days.

4.3 Web hosting and provision of the website

Our website is hosted by IONOS. The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The provider processes personal data transmitted via the website, e.g. content, usage, meta/communication, or contact data, in the EU. Further information can be found in the provider's privacy policy at https://www.ionos.de/terms-gtc/datenschutzerklaerung/.

It is our legitimate interest to provide a website, so that the legal basis for the data processing described is Art. 6(1)(1)(f) GDPR.

Our website is hosted by HubSpot. The provider is HubSpot, Inc., 25 1st Street, Cambridge, MA 0214, USA. The provider processes personal data transmitted via the website, e.g. content, usage, meta/communication, or contact data, in the USA. Further information can be found in the provider's privacy policy at https://legal.hubspot.com/de/privacy-policy.

It is our legitimate interest to provide a website, so that the legal basis for the data processing described is Art. 6(1)(1)(f) GDPR.

The legal basis for the transfer to a country outside the EEA is an adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is ensured because the EU Commission has decided, by way of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country offers an adequate level of protection.

4.4 Contact form

When you contact us via the contact form on our website, we store the data requested there and the content of the message. The legal basis for the processing is our legitimate interest in responding to inquiries addressed to us. The legal basis for the processing is therefore Art. 6(1)(1)(f) GDPR. We delete the data arising in this context once storage is no longer required, or restrict its processing where statutory retention obligations apply.

4.5 Job postings

We publish job postings on our website, on pages linked to the website, or on third-party websites. The data provided as part of an application is processed to carry out the application process. Where such data is necessary for our decision to establish an employment relationship, the legal basis is Art. 88(1) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG). We have marked or otherwise indicated the data required to carry out the application process. If applicants do not provide this data, we cannot process the application. Any further data is voluntary and not required for an application. If applicants provide further information, the basis for its processing is their consent (Art. 6(1)(1)(a) GDPR).

We ask applicants to refrain from including information on political opinions, religious beliefs, and similarly sensitive data in their CV and cover letter. Such information is not required for an application. If applicants nevertheless provide such information, we cannot prevent its processing as part of processing the CV or cover letter. Its processing is then also based on the applicant's consent (Art. 9(2)(a) GDPR).

Finally, we process applicants' data for further application procedures where they have given us their consent to do so. In this case, the legal basis is Art. 6(1)(1)(a) GDPR.

We pass on applicants' data to the responsible HR staff, to our processors in the recruiting field, and to other staff otherwise involved in the application process.

If we enter into an employment relationship with the applicant following the application process, we do not delete the data until the employment relationship has ended. Otherwise, we delete the data no later than six months after an applicant is rejected.

If applicants have given us their consent to also use their data for further application procedures, we do not delete their data until one year after receipt of the application.

4.6 Booking of appointments

Website visitors can book appointments with us via our website. For this purpose, in addition to the data entered, we process meta or communication data. We have a legitimate interest in offering prospective customers a user-friendly way to arrange appointments. The legal basis for the data processing is therefore Art. 6(1)(1)(f) GDPR.

For scheduling appointments, we use the HubSpot Meetings tool provided by HubSpot, Inc.; further information can be found under section 4.9.4 (HubSpot).

4.7 Offering of goods or services

We offer goods or services via our website. In the ordering or shipping process, we involve the following service providers, who only receive the personal data required to provide their service:

• Name
• Company
• Email

The data is processed to perform the contract concluded with the respective website visitor (Art. 6(1)(1)(b) GDPR).

4.8 Technically necessary cookies

Our website uses cookies. Cookies are small text files stored in the web browser on a website visitor's device. Cookies help to make the offering more user-friendly, effective, and secure. To the extent these cookies are necessary for the operation of our website or its functions (hereinafter "technically necessary cookies"), the legal basis for the related data processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in providing customers and other website visitors with a functioning website. We specifically use technically necessary cookies for the following purposes,

• Cookies that retain language settings
• Cookies set by payment providers to process payments, which do not analyze user behavior, and cookies that retain language settings

4.9 Third-party providers

4.9.1 Google Analytics

We use Google Analytics for analysis purposes. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The provider processes usage data (e.g. websites visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA. The legal basis for the processing is Art. 6(1)(1)(a) GDPR. The processing takes place on the basis of consent. Data subjects can withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country is ensured because the EU Commission has decided, by way of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country offers an adequate level of protection.

The data is deleted once the purpose of its collection no longer applies and no retention obligation precludes deletion. Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

4.9.2 Google Tag Manager

We use Google Tag Manager for advertising and analysis purposes. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times) in the USA.

The legal basis for the processing is Art. 6(1)(1)(a) GDPR. The processing takes place on the basis of consent. Data subjects can withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

We delete the data once the purpose of its collection no longer applies. Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

4.9.3 Google Web Fonts

We use Google Web Fonts for typography on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes meta/communication data (e.g. device information, IP addresses) in the USA.

Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

4.9.4 HubSpot

We use HubSpot for analysis, lead generation, marketing automation, and scheduling appointments (HubSpot Meetings). The provider is HubSpot, Inc., 25 1st Street, Cambridge, MA 0214, USA. The provider processes usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), and content data (e.g. entries in online forms) in the USA.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in managing data in a simple and cost-effective manner.

The data is deleted once the purpose of its collection no longer applies and no retention obligations preclude deletion. Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.

4.9.5 HubSpot LiveChat

We use HubSpot LiveChat as a live chat tool. The provider is HubSpot, Inc., 25 1st Street, Cambridge, MA 0214, USA. The provider processes usage data (e.g. websites visited, interest in content, access times), content data (e.g. entries in online forms), and meta/communication data (e.g. device information, IP addresses) in the USA.

4.9.6 Apollo

4.9.7 Waalaxy

We use Waalaxy to support outreach via the LinkedIn network. The provider is Waapi SAS, ZAC Hippocrate, Immeuble Arion II, 270 Av Nina Simone, 34000 Montpellier, France. The provider processes usage data, contact data, and profile data (e.g. LinkedIn profile names, job titles) in the EU. The legal basis for the processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in reaching out to and interacting with business contacts on social media platforms.

Further information is available in the provider's privacy policy at https://www.waalaxy.com.

4.9.8 Apollo

We use Apollo for lead generation purposes. The provider is ZenLeads Inc., 340 S Lemon Ave #4750, Walnut, CA 91789, USA. The provider processes usage data (e.g. websites visited, interest in content, access times), contact data (e.g. email addresses, phone numbers), and meta/communication data (e.g. device information, IP addresses) in the USA. The legal basis for the processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in managing lead data for direct marketing purposes. The transfer of personal data to a country outside the EEA is based on Standard Contractual Clauses. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. Pursuant to Art. 46(2)(b) GDPR, they ensure the security of the data transfer. The data is deleted once the purpose of its collection no longer applies and no retention obligation precludes deletion. Further information is available in the provider's privacy policy at https://www.apollo.io/privacy-policy/.

4.9.9 Google Ads

We use Google Ads for advertising, analysis, and remarketing purposes. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA. The legal basis for the processing is Art. 6(1)(1)(a) GDPR. The processing takes place on the basis of consent. Data subjects can withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country is ensured because the EU Commission has decided, by way of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country offers an adequate level of protection. Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.

4.9.10 heyData

We have integrated a data protection seal on our website. The provider is heyData GmbH, Gormannstr. 14, 10119 Berlin, Germany. The provider processes meta/communication data (e.g. IP addresses) in the EU.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in providing website visitors with confirmation of our data protection compliance. At the same time, the provider has a legitimate interest in ensuring that only customers with an existing contract use its seal, which is why a mere image copy of the certificate is not a viable alternative for confirmation.

The data is masked after collection so that it can no longer be related to a person. Further information is available in the provider's privacy policy at https://heydata.eu/datenschutzerklaerung.

5. Data processing on social media platforms

We maintain a presence on social media networks in order to present our organization and our services there. The operators of these networks regularly process their users' data for advertising purposes. Among other things, they create user profiles from users' online behavior, which are used, for example, to display advertising on the networks' own pages and elsewhere on the internet that corresponds to users' interests. For this purpose, the network operators store information about usage behavior in cookies on users' computers. It cannot be ruled out that the operators combine this information with further data. Users can find further information, as well as guidance on how to object to processing by the page operators, in the privacy policies of the respective operators listed below. It is also possible that the operators or their servers are located in non-EU countries, meaning that they process data there. This may give rise to risks for users, for example because enforcing their rights becomes more difficult or government authorities gain access to the data.

When users of the networks contact us via our profiles, we process the data provided to us in order to respond to inquiries. This constitutes our legitimate interest, so that the legal basis is Art. 6(1)(1)(f) GDPR.

5.1 Facebook

We maintain a profile on Facebook. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available at https://www.facebook.com/policy.php. One way to object to the data processing is via the advertising settings: https://www.facebook.com/settings?tab=ads. We are jointly responsible with Facebook, on the basis of an agreement within the meaning of Art. 26 GDPR, for the processing of the data of visitors to our profile. Facebook explains exactly which data is processed at https://www.facebook.com/legal/terms/information_about_page_insights_data. Data subjects may exercise their rights against both us and Facebook. However, under our agreement with Facebook, we are obliged to forward inquiries to Facebook. Data subjects will therefore receive a faster response if they contact Facebook directly.

5.2 LinkedIn

We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy is available at https://www.linkedin.com/legal/privacy-policy?_l=de_DE. One way to object to the data processing is via the advertising settings: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

5.3 Xing

We maintain a profile on Xing. The operator is New Work SE, Dammtorstraße 29-32, 20354 Hamburg. The privacy policy is available at https://privacy.xing.com/de/datenschutzerklaerung.

6. Changes to this privacy policy

We reserve the right to amend this privacy policy with effect for the future. The current version is always available here.

7. Questions and comments

If you have any questions or comments regarding this privacy policy, please feel free to contact us using the contact details provided above.

End ---

Archived Version

Privacy Policy