Privacy Policy

Last updated: 3 September 2026

I. Controllers

The controllers within the meaning of the General Data Protection Regulation (GDPR) are:

Extra & Bold Design GmbH
Europa-Allee 20, 49685 Emstek, Germany
Email: info@be-extra.de · Phone: +49 4473 3259960

Extra & Bold Strategy GmbH (for the areas concerning it)
Europa-Allee 20, 49685 Emstek, Germany
Email: strategy@be-extra.de

II. Data Protection Officer

Our Data Protection Officer is:

Care-Office UG (haftungsbeschränkt)
Hasestraße 2, 49074 Osnabrück, Germany
Email: datenschutz@care-office.de

III. General information on data processing

We process personal data only to the extent necessary to provide a functional website, to handle enquiries, to conduct application procedures, to comply with legal obligations, or for the analytics and marketing purposes described in this privacy policy.

Personal data means any information relating to an identified or identifiable natural person. This includes in particular name, email address, telephone number, company, communication content, IP address, device information, usage data and application documents.

Processing is carried out in particular on the following legal bases:

• Art. 6(1)(a) GDPR, where you have consented to the processing;
• Art. 6(1)(b) GDPR, where processing is necessary for pre-contractual measures or the performance of a contract;
• Art. 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation;
• Art. 6(1)(f) GDPR, where processing is necessary to protect our legitimate interests and no overriding interests of the data subject prevail;
• Section 26 of the German Federal Data Protection Act (BDSG), where personal data is processed in connection with employment and applications;
• Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), where information is accessed on or stored in your terminal equipment.

IV. Accessing the website and server log files

When you access our website, technically necessary data is processed by the hosting provider. This includes in particular the IP address, the date and time of access, the URL requested, the previously visited page, the browser used, the operating system and technical information about the device used.

This processing serves the secure, stable and technically error-free provision of the website as well as the prevention of misuse and attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional provision of our website.

Log file data is deleted as soon as it is no longer required for the purposes stated, unless statutory retention obligations apply.

V. Hosting with Vercel

Our website is delivered and hosted via services provided by Vercel Inc., USA, or affiliated companies. In the course of provision, the IP address, timestamp, URL requested, technical device and browser data and other connection data required for delivery may be processed.

This processing serves the secure and functional provision of the website on the basis of Art. 6(1)(f) GDPR.

Where personal data is transferred to the USA or other third countries, the transfer takes place on the basis of a transfer mechanism permitted under Chapter V GDPR. Where the respective provider is certified under the EU-U.S. Data Privacy Framework for the specific processing, the transfer may be based on an adequacy decision of the European Commission. Otherwise, standard contractual clauses and, where appropriate, additional safeguards apply.

VI. GitHub

We use GitHub, Inc., USA, to manage and provide the source code of our website. The service is used in particular for version control, collaboration during development and the technical provision of the website code.

As a rule, no additional content data from contact forms is transmitted to GitHub. However, visitor data may be processed to the technically necessary extent, for example through security, access and log data.

Processing is based on Art. 6(1)(f) GDPR. Where a transfer to the USA takes place, the section “Data transfers to third countries” applies.

VII. Fonts, code libraries and external resources

The fonts used on this website are self-hosted and delivered via our own website infrastructure. No fonts are loaded from Google Fonts or comparable external font services.

Code libraries are generally bundled with the website and delivered via our own infrastructure. External content delivery networks are not used for this purpose.

VIII. Cookies and consent management with CookieYes

Our website uses technically necessary cookies and comparable technologies. These are required for the website to function, for security features to be provided and for you to use the functions you request.

In addition, optional analytics and marketing technologies may be used with your consent. Your consent is managed via CookieYes. In this context, the IP address, the time of the decision, the consent status, the categories selected and technical information about the consent may be processed.

Consent data is processed to document and manage your choices and to meet data protection accountability obligations on the basis of Art. 6(1)(c) GDPR.

Where cookies or comparable technologies that are not technically necessary are used, access to your terminal equipment takes place only in accordance with Section 25 TDDDG and on the basis of your consent.

You can change or withdraw your consent at any time with effect for the future via the cookie banner settings.

IX. Google Tag Manager

We use Google Tag Manager for the technical management and control of website tags. Google Tag Manager serves as the management system for the analytics, marketing and recruiting services described below.

Optional tags are generally loaded only after the respective required consent has been given. Google Tag Manager may process technical information such as IP address, browser and device information and information about the tags triggered.

Where processing is necessary for the management of non-essential tags, it is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25 TDDDG. Where the service is used in a technically necessary manner, processing is based on Art. 6(1)(f) GDPR.

X. Google Analytics 4

With your consent, we may use Google Analytics 4 to analyse the use of our website. This may involve processing information about page views, session duration, interactions, technical device and browser data, approximate location data and, where applicable, a truncated or otherwise protected IP address.

We use Google Analytics for reach measurement, statistical evaluation of website use and improvement of our online offering.

Processing takes place only with your consent on the basis of Art. 6(1)(a) GDPR and Section 25 TDDDG. You can withdraw your consent at any time via the cookie settings.

Where Google processes personal data in the USA, the section “Data transfers to third countries” applies.

XI. Microsoft Clarity

With your consent, Microsoft Clarity may be used. Clarity serves to analyse the use of our website and may record sessions or parts of sessions.

This may involve processing mouse movements, clicks, scrolling, page views, technical device and browser data and interactions with the website.

Microsoft Clarity is configured so that sensitive text, in particular email addresses and information entered by users, is masked. Masking also covers the content of form fields. Non-essential form content is therefore not transmitted to Microsoft Clarity servers.

Processing for analytics and optimisation purposes takes place only with your consent on the basis of Art. 6(1)(a) GDPR and Section 25 TDDDG.

XII. LinkedIn Insight Tag

With your consent, we may use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company or affiliated companies. The service is used for campaign measurement, conversion analysis and, where applicable, retargeting.

This may involve processing the IP address, browser and device information, usage data, pages visited and information about interactions with the website. Where attribution to a LinkedIn member is possible, LinkedIn may link this information to a LinkedIn account.

Processing takes place only with your consent on the basis of Art. 6(1)(a) GDPR and Section 25 TDDDG.

XIII. Leadfeeder

Where Leadfeeder is activated on our website, the service is used with your consent for B2B visitor analysis. This may involve processing technical usage data, IP addresses, pages visited, timestamps and information about usage behaviour, and attributing them to a company where applicable.

Leadfeeder is used to analyse company visits and to improve our sales and marketing activities.

Processing takes place only with your consent on the basis of Art. 6(1)(a) GDPR and Section 25 TDDDG.

XIV. Google Ads

Where Google Ads is activated, we may use Google Ads, conversion tracking and, where applicable, remarketing functions with your consent. These services are used to measure advertising campaigns, attribute conversions and deliver and cap advertising.

This may involve processing the IP address, browser and device information, pages visited, interactions, conversion events and campaign information.

Where enhanced conversions or comparable functions are used, an email address originating from a form, or a hash value derived from it, may be processed for conversion attribution.

Google Ads is loaded only after prior consent. Processing is based on Art. 6(1)(a) GDPR and Section 25 TDDDG.

XV. Automatic advanced matching

In connection with the conversion and matching functions used, automatic advanced matching may be applied. A pixel may read an email address from a form, derive a hash value from it and transmit that hash value to the respective service in order to attribute conversion events and campaigns.

A hash value is not automatically anonymous. Depending on the technical implementation, it may still relate to a person or be attributed to a person in combination with other information. The email address, and the hash value derived from it, is therefore treated as personal data or data relating to an identifiable person.

Processing takes place exclusively after prior consent on the basis of Art. 6(1)(a) GDPR and Section 25 TDDDG. You can withdraw your consent at any time via the cookie settings.

XVI. OpenAI

We use services provided by OpenAI in connection with the processing and evaluation of digital content and with the conversion and data attribution functions in use.

Where an email address from a form is read, hashed and transmitted to OpenAI as part of automatic advanced matching, OpenAI processes the hash value in order to attribute and measure conversion events. The transmission does not take place in plain text but in the form of a hash value. Since a hash value may under certain circumstances still relate to a person, it is treated under data protection law as personal data or data relating to an identifiable person.

Processing takes place only after prior consent on the basis of Art. 6(1)(a) GDPR and Section 25 TDDDG.

Where OpenAI processes personal data outside the European Union or the European Economic Area, the transfer takes place on the basis of the applicable safeguards under Chapter V GDPR, in particular standard contractual clauses and, where appropriate, supplementary technical and organisational measures.

XVII. Contact and enquiry forms

When you use our contact or enquiry form, we process the data you enter. This includes in particular your name, email address, telephone number, company, subject, the full content of your enquiry, any other information provided voluntarily, the date and time of submission and technical metadata of the transmission.

Processing serves to handle and answer your enquiry, to contact you and, where applicable, to prepare or perform a contract.

The legal basis is Art. 6(1)(b) GDPR where the enquiry is directed at concluding or performing a contract. Otherwise, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling incoming enquiries and communicating with prospects, clients and business partners.

Providing the information marked as mandatory is necessary for us to process your enquiry. Providing further information is voluntary.

XVIII. Odoo

To handle, manage and document contact and sales enquiries, we use Odoo, business software provided by Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium.

When you use our contact or enquiry form, your name, email address, telephone number, company, your role and the content of your enquiry are stored in our Odoo system. A company record, a contact and an opportunity are created from it.

We process this data to manage enquiries, to communicate, to document business relationships and to support our sales processes.

Processing to handle your enquiry is based on Art. 6(1)(b) or (f) GDPR. Where Odoo processes the data on our behalf and on our instructions, processing takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Odoo S.A. is based in Belgium and therefore within the European Union.

The storage period depends on the purpose of the enquiry, statutory retention obligations and our internal deletion periods. Enquiries are deleted as soon as they are no longer required for the respective purpose, unless statutory retention obligations or legitimate interests in longer storage apply.

XIX. Sanity

We use Sanity to store and manage the content of our website and enquiry information.

Where form data or enquiry content is stored in or processed via Sanity, this may concern in particular your name, email address, telephone number, company and the full content of your enquiry.

Processing serves to store, manage and provide the content concerned and to handle enquiries on the basis of Art. 6(1)(b) or (f) GDPR.

Sanity may process data through its own systems and through the sub-processors it uses, within or outside the European Union or the European Economic Area. Where personal data is transferred to a third country, the transfer takes place on the basis of the applicable safeguards under Chapter V GDPR, in particular adequacy decisions, standard contractual clauses and, where appropriate, supplementary measures.

The storage period depends on the respective processing purpose, statutory retention obligations and our internal deletion periods.

XX. Email communication and Microsoft 365

We process personal data that you send us by email or that arises in the course of email communication with you. This includes in particular your email address, the content of your message, attachments, signature data, communication timestamps and technical transmission data.

For receiving, storing and sending business email we use Microsoft 365, Exchange Online and Outlook. This may involve processing personal data from contact enquiries, applications and other business communication.

Processing serves to handle and answer the communication, to carry out pre-contractual or contractual measures, to comply with legal obligations and to protect legitimate interests on the basis of Art. 6(1)(b), (c) or (f) GDPR.

Microsoft may process personal data through affiliated companies and sub-processors, including outside the European Union or the European Economic Area. Where a transfer to a third country takes place, the requirements of Chapter V GDPR apply.

XXI. Resend

We use Resend, Inc. to send form submissions. Resend processes the data required for sending email, in particular sender and recipient addresses, subject, message text and, where applicable, attachments or form content.

Processing serves the transmission and delivery of the communication you requested on the basis of Art. 6(1)(b) or (f) GDPR.

Where Resend processes the data on our behalf and on our instructions, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Where Resend processes personal data outside the European Union or the European Economic Area, the transfer takes place on the basis of the applicable safeguards under Chapter V GDPR.

XXII. Applications and recruiting with Join

We use the job board widget provided by Join for job postings and applications.

When you apply through our recruiting offering, we process the application data you submit. This includes in particular your name, contact details, CV, cover letter, references, professional qualifications, information about your career to date and other information from your application documents.

In addition, technical data such as IP address, time of access and browser information may be processed.

Processing serves to conduct the application procedure on the basis of Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG.

Where you expressly consent to being included in a talent pool or to longer storage of your application data, processing is based on Art. 6(1)(a) GDPR.

Application data is deleted as soon as it is no longer required for the application procedure, generally no later than six months after the conclusion of the application procedure, unless a statutory permission, a consent or a legal ground for longer storage applies.

XXIII. Data transfers to third countries

Some of the service providers named are based outside the European Union or the European Economic Area, or may process data through sub-processors outside these territories.

A transfer to a third country takes place only where the requirements of Chapter V GDPR are met. Possible bases for transfer are in particular an adequacy decision of the European Commission pursuant to Art. 45 GDPR, standard contractual clauses of the European Commission pursuant to Art. 46(2)(c) GDPR, additional technical, organisational or contractual measures and, in exceptional cases, the conditions of Art. 49 GDPR.

For the USA, an adequacy decision exists in favour of organisations that are certified under the EU-U.S. Data Privacy Framework and listed in the relevant certification list. The decision does not automatically apply to every US company, nor to every processing operation of a US company.

XXIV. Storage period

We store personal data only for as long as is necessary for the respective purpose. The data is then deleted unless statutory retention obligations, the assertion or defence of legal claims, or other legally recognised grounds justify longer storage.

For business records, statutory retention periods may arise in particular from the German Commercial Code (HGB), the German Fiscal Code (AO) and other statutory provisions.

XXV. Data security

We take appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure and unauthorised access.

The measures are selected and reviewed regularly, taking into account the state of the art, the costs of implementation, the scope and purposes of processing and the varying likelihood and severity of possible risks.

XXVI. Your rights

Subject to the statutory requirements, you have the right of access pursuant to Art. 15 GDPR, to rectification pursuant to Art. 16 GDPR, to erasure pursuant to Art. 17 GDPR, to restriction of processing pursuant to Art. 18 GDPR, to data portability pursuant to Art. 20 GDPR, to object pursuant to Art. 21 GDPR, as well as the right to withdraw any consent given at any time with effect for the future.

To exercise your rights, you can contact us or our Data Protection Officer directly.

XXVII. Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time with effect for the future.

Withdrawal can be effected via the settings of our cookie banner or by an informal message to the contact details given above.

The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

XXVIII. Objection to processing

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you may object to that processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object to that processing at any time without giving reasons.

XXIX. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

The supervisory authority responsible for us is in particular:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany

The right to complain may also be exercised with any other competent data protection supervisory authority.

XXX. Currency of this privacy policy

We review this privacy policy regularly and adapt it to changes to our website, the services used, the data processing operations and the legal requirements.