Privacy Policy

I. Controller & Data Protection Officer

The controllers within the meaning of the General Data Protection Regulation (GDPR) are:

Extra & Bold Design GmbH
Europa-Allee 20, 49685 Emstek
Email: info@be-extra.de · Phone: +49 4473 3259960

Extra & Bold Strategy GmbH (for the areas concerning it)
Europa-Allee 20, 49685 Emstek
Email: strategy@be-extra.de

Data Protection Officer:
Care-Office UG (haftungsbeschränkt)
Hasestraße 2, 49074 Osnabrück
Email: datenschutz@care-office.de

II. General information on data processing

We generally process our users' personal data only insofar as this is necessary to provide a functioning website as well as our content and services. Processing takes place based on the user's consent (Art. 6(1)(a) GDPR), for the performance of a contract (lit. b), to comply with legal obligations (lit. c) or on the basis of our legitimate interest (lit. f).

III. Hosting & infrastructure

Vercel

This website is hosted by Vercel Inc. (USA). When it is accessed, technically necessary data such as IP address, timestamp and the URL accessed are processed (Art. 6(1)(f) GDPR). The data transfer to the USA is safeguarded by Standard Contractual Clauses (SCC).

GitHub

The source code of this website is managed via GitHub (GitHub Inc., USA). Only a small amount of end-user data is processed in the process.

IV. Fonts & external resources

We host the fonts used on this website ourselves (self-hosted via Next.js); they are not loaded from external font services such as Google Fonts. Program libraries are bundled with the website and delivered from our own hosting, we do not embed third-party CDNs for this purpose. The only third-party resources loaded in your browser are the consent, analytics and recruiting services described below.

V. Cookies & consent management

We use technically necessary cookies as well as, with your consent, optional cookies. Your consent is managed via CookieYes, which processes the IP address, timestamp and consent status. Optional analytics and marketing tools are loaded via Google Tag Manager, only after your consent (Art. 6(1)(a) GDPR).

VI. Analytics & marketing

Subject to consent, the following services may be used:

Google Analytics (GA4), reach and usage analysis
LinkedIn Insight Tag, campaign measurement & retargeting
Leadfeeder, identification of company visits
SalesViewer, B2B visitor analysis

The legal basis is in each case your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie banner.

VII. Forms & contact

We process data entered via our contact and inquiry forms in order to handle your inquiry. To send form submissions by email, we use the service Resend (Resend, Inc.) as a processor. If you contact us by email or phone, we process your details to handle the inquiry (Art. 6(1)(b) or (f) GDPR).

VIII. Applications (recruiting)

For job listings and applications, we use the job board widget from join.com, which processes applicant data and IP addresses. We process your applicant data to carry out the application procedure (Art. 6(1)(b) GDPR in conjunction with § 26 BDSG).

IX. Data transfer to third countries

Some of the services mentioned process data in the USA. The transfer takes place on the basis of adequacy decisions or Standard Contractual Clauses pursuant to Chapter V GDPR.

X. Your rights

As a data subject, you have the following rights:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority.

XI. Withdrawal & objection

You can withdraw any consent you have given at any time with effect for the future, for cookies via the cookie banner, otherwise informally using the contact details above. You can object to processing based on legitimate interests at any time.

XII. Currency

This Privacy Policy is reviewed regularly and reflects the current state of the technology used as well as the legal requirements.