Privacy policy

This Privacy Policy explains how personal data on the website www.fridaypoppins.de (hereinafter „website“) is processed by Friday/Poppins (Friday Poppins GmbH). Friday/Poppins (Friday Poppins GmbH) only processes such data as is necessary to provide and secure the website and its services, in line with the principle of data minimisation. „Personal data“ means any information relating to an identified or identifiable natural person (data subject), such as name, address, telephone number, date of birth, email address or IP address. Information that cannot be attributed to a specific person, for example due to anonymisation, does not constitute personal data.

‍

1. Data Controller

The controller responsible for the processing of personal data on the website within the meaning of the General Data Protection Regulation (GDPR) is:

Friday/Poppins (Friday Poppins GmbH)

Große Hamburger Straße 17, 10115 Berlin, Germany

info@fridaypoppins.de

For data protection enquiries or to exercise your data subject rights, please contact info@fridaypoppins.de.

‍

‍

2. Data Protection Officer

The following has been appointed as Data Protection Officer:

Kertos GmbH  

Brienner Straße 41 

80333 Munich 

Germany 

Email: dsb(at)kertos.io  

‍

‍

3. Data Processing on Our Website

‍

‍‍3.1 Provision of the Website

Purpose of Processing:  

We process your data in order to

·     ensure the reliable operation of the website

·     provide user-friendly access to our website

·    and maintain IT security

Recipient: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA

Data Processed:

·    IP address of the requesting device

·    Method (e.g. GET, POST), date and time of the request

·    Address of the website accessed and path of the requested file

·    Website/file from which the request originated, if applicable (HTTP referrer)

·    Information on the browser and operating system used

·    HTTP protocol version, HTTP status code, size of the file delivered

·    Request information such as language, content type, content encoding, character encoding

Legal Basis: Art. 6(1)(f) GDPR. Processing of the data named is necessary to provide the website and to ensure secure, user-friendly operation.

Retention Period: The data collected is deleted as soon as it is no longer required for the operation of the website, and at the latest after 30 days, unless a statutory retention obligation applies.

International Data Transfer: Data may be transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Webflow, Inc. is certified under this framework.

Further Information: https://webflow.com/legal/privacy

‍

‍‍3.2 Amazon CloudFront‍

Purpose: Speeding up and optimising the delivery of website content via a content delivery network (CDN) used as part of our Webflow hosting.

Recipient: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg

Data Processed:

·     Technical connection data (e.g. IP address, date and time of access)

·     Usage data (e.g. page content accessed, referrer URL)

·     Communication and status data (e.g. HTTP status code, amount of data transferred)

·    Device and software information (e.g. browser type and version, operating system)

Legal Basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the fast and reliable delivery of our website content.

Retention Period: The data is deleted as soon as it is no longer required for the purpose stated.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Amazon Web Services is certified under this framework.

Further Information: https://aws.amazon.com/privacy/

‍

3.3 Finsweet

Purpose: Provision of additional website functions and interactive elements (e.g. filter, sort and list functions) as part of our Webflow website.

Recipient: Finsweet Inc., 2774 Harbor Rd, Merrick, NY 11566-4608, USA

Data Processed:

·     Technical access data (e.g. IP address, time of access)

·     Usage data related to the execution of the embedded scripts

Legal Basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the technical provision of website functions.

International Data Transfer: Data is transferred to the USA on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, as Finsweet Inc. is not known to be certified under the EU-U.S. Data Privacy Framework.

Further Information: https://finsweet.com/privacy

‍

3.4 jsDelivr

Purpose: Provision of JavaScript program libraries and other web resources via a content delivery network for the technical functionality and acceleration of our website.

Recipient: Volentio JSD Limited, Suite 2a1, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom

Data Processed:

·     Technical connection data (e.g. IP address, time of access)

·     Device and browser information technically required to deliver the requested file

Legal Basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the fast and reliable provision of technical website resources.

International Data Transfer: Data is transferred to the United Kingdom on the basis of the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR).

Further Information: https://www.jsdelivr.com/terms/privacy-policy

‍

3.5 Newsletter

Purpose: Sending email newsletters to inform you about products, services and company activities. We use the„HubSpot“ service to manage sign-ups and our mailing list.

Recipient: HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, D01 K2C5, Ireland

Data Processed:

·      Name

·      Email address

·      Company name (if provided)

Legal Basis: Consent pursuant to Art.6(1)(a) GDPR

Retention Period: The data is stored for as long as you are subscribed to the newsletter. You may withdraw your consent at any time by unsubscribing; after unsubscribing, your data is deleted unless statutory retention obligations require otherwise.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); HubSpot, Inc. is certified under this framework.

Further Information: You can unsubscribe from the newsletter at any time by clicking the unsubscribe link at the end of each newsletter. Further information: https://legal.hubspot.com/privacy-policy

‍

3.6 Job Applications

Purpose: Selection of applicants for the possible establishment of an employment relationship.

Recipient: HiBob GmbH, Karl-Liebknecht-Straße 29a, 10178 Berlin, Germany

Data Processed:

·     Name

·     Email address

·     Phone number

·     CV/résumé

·     Cover letter

·     Any further application documents you provide

·     IP address

·     Browser type and version

·     Operating system

·    Date and time of access

Legal Basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures) and  Art. 6(1)(f) GDPR, insofar as our legitimate interest lies in the efficient conduct of the application process.

Retention Period: We store your personal data until the application process has concluded. In the event of a rejection, your data is stored for a further six months after you are notified of the decision. In the event of a legal dispute, longer retention may occur until the matter is finally resolved. If you are hired, your application documents are stored in your personnel file for the duration of the employment relationship. You may withdraw your application or object to the processing at any time; in which case your data will be deleted and your application will no longer be considered.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Hi Bob, Inc. is certified under this framework.

Further Information: https://www.hibob.com/privacy/privacy-policy/

‍

3.7 Analytics and Tracking

Cookies are small text files stored by your browser on your device. Cookies do not execute programs and do not install malware. Comparable technologies include web storage (local/session storage), fingerprinting, tags and pixels. Most browsers accept these technologies by default; however, you can adjust your settings so that their use is blocked or requires your consent. If cookies or similar technologies are blocked, certain features of the website may not be fully available.

Purpose: We use tracking and analytics tools to continuously optimise our website and adapt it to your requirements. For this purpose, information is collected using corresponding technologies or device information is combined (device fingerprinting).

Legal Basis: We use technically necessary tools for operating the website on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR or to perform a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR. The storage of, or access to, information on your device is mandatory in these cases and is governed by Section 25(2)TDDDG (German Telecommunications Digital Services Data Protection Act). Optional tools are used exclusively with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG . The tracking and analytics tools used, their respective purpose and the data processed are set out below.

Recipient:

Google Analytics 4, Google Tag Manager, HubSpot Analytics, HubSpot Forms, LinkedIn Insight Tag

‍

3.8 Google Analytics 4

Purpose: Web analytics

Recipient: Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Data Processed:

·     Device data (e.g. IP address, device type, screen resolution)

·     Browser data (e.g. browser used, language, installed plug-ins)

·     Usage data (e.g. pages visited, time spent per page, click paths, scroll depth, entry and exit pages)

·     Event data (e.g. clicks on buttons/links, forms submitted)

·     Location data (e.g. country, city)

·     Source and traffic data (e.g. referrer URL, traffic source such as search engine)

·     Conversion and goal-completion data (e.g. newsletter sign-ups, goals achieved on the website)

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Google is certified under this framework. Standard Contractual Clauses (SCCs) are also in place with Google.

Further Information: https://policies.google.com/privacy

‍

3.9 Google Tag Manager

Purpose: Managing and triggering website tags via a single interface

Recipient: Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Data Processed:

·     Access data (e.g. time of page view, referrer URL)

·     Device data (e.g. IP address, device type)

·     Browser data (e.g. browser used, language settings)

·     Event data (e.g. tag triggering, interactions with embedded scripts)

·     Location data (e.g. country, city – based on IP address)

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG

Retention Period: Cookies are stored for up to 90 days.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR) as well as additional Standard Contractual Clauses(SCCs).

Further Information: https://policies.google.com/privacy

‍

3.10 HubSpot Analytics

Purpose: Monitoring the website and supporting and optimising digital marketing activities

Recipient: HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, D01 K2C5, Ireland

Data Processed:

·     Identification data (e.g. unique user token, user identifier in the „hubspotutk“ cookie)

·     Access data (e.g. date and time of visit, website domain)

·     Session data (e.g. number of sessions, duration of individual visits)

·     Device data (e.g. device type, operating system)

·     Browser data (e.g. browser used, language settings)

·     Usage data (e.g. pages visited, returning visits)

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG

Retention Period: Cookies are stored for up to 90 days.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); HubSpot, Inc. is certified under this framework.

Further Information: https://legal.hubspot.com/privacy-policy

‍

3.11 HubSpot Forms

Purpose: Providing online forms (e.g. contact and enquiry forms) on our website

Recipient: HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, D01 K2C5, Ireland

Data Processed:

·    First name

·    Last name

·    Email address

·    Company

·    Phone number

·    Your message (content of your enquiry)

Legal Basis: Art. 6(1)(f) GDPR; our legitimate interest lies in providing forms for efficient communication. If your enquiry concerns the conclusion or performance of a contract, processing is based on Art. 6(1)(b) GDPR.

Retention Period: The data is deleted once its purpose has been fulfilled, and at the latest once the relevant communication has concluded.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); HubSpot, Inc. is certified under this framework.

Further Information: https://legal.hubspot.com/privacy-policy

‍

3.12 LinkedIn Insight Tag

Purpose: Reach measurement and analysis of user behaviour, and optimisation of marketing activities, using the LinkedIn Insight Tag

Recipient: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland and LinkedIn Corporation,1000 W Maude Ave, Sunnyvale, CA 94085, USA

Data Processed:

·     Access data (e.g. IP address, time of access)

·     Usage data (e.g. pages visited, interactions on the website)

·     Source and traffic data (e.g. referrer URL, origin of visitors)

·     Device data (e.g. device type, screen resolution)

·     Browser data (e.g. browser used, language settings)

·     Location data (e.g. country, city – based on IP address)

Legal Basis: Consent pursuant to Art. 6(1)(a) GDPR

Retention Period: Generally stored for up to 12 months.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR) as well as additional Standard Contractual Clauses (SCCs).

Further Information: https://www.linkedin.com/legal/privacy-policy

‍

3.13 Cookiebot

Purpose: Managing consent for the use of cookies

Recipient: Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany

Data Processed:

·     Device data (e.g. IP address, device type)

·     Event data (e.g. preference settings, interaction with embedded scripts)

Legal Basis: Art. 6(1)(f) GDPR; our legitimate interest lies in demonstrating your consent.

Retention Period: Up to 180days.

Further Information: https://www.cookiebot.com/en/privacy-policy/

‍

3.14 Cookie Overview

4. Contacting Us by Email

Purpose: Processing and responding to your enquiry.

Data Processed:

·        Name

·        Email address

·        Content of your message

Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with you). If your enquiry concerns the conclusion or performance of a contract, processing is based on Art. 6(1)(b) GDPR.

Retention Period: Your data is only stored for as long as is necessary to finally deal with your enquiry.

‍

‍

5. Social Media Presence

Purpose: Communicating with prospective customers, providing information about our products and services, and analysing the use of our social media presence.

Recipient:

·       LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

·      Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland („Instagram“)

Data Processed:

·      Demographic information (e.g. age, gender)

·      Professional information (e.g. industry, work experience)

·      Interaction data (e.g. likes, shares)

·      Usage statistics (e.g. pageviews, video views)

·      Content preferences (e.g. popular topics, interests)

Joint Controllership with LinkedIn and Meta (Instagram):

With regard to the processing of statistical usage data for our presence on LinkedIn and Meta (so-called „Page Insights“), we and LinkedIn Ireland Unlimited Company or Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR; joint controllership concerns in particular the collection and analysis of usage data to generate page statistics, while LinkedIn or Meta (Instagram) assumes primary responsibility for handling data subject rights and fulfilling information obligations. The key content of the respective joint-controllership arrangements (in particular regarding the allocation of responsibilities and the handling of data subject rights) can be found in the Joint Controller Addendum of LinkedIn and the Page Controller Addendum of Meta (Instagram) (see the platforms' privacy notices).

Legal Basis:

·      Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures)

·      Art. 6(1)(f) GDPR (legitimate interest in effective information and communication)

Retention Period: In accordance with the privacy policies of the respective platforms

International Data Transfer: Possible transfer to the USA and other third countries, depending on the respective platform

Further Information:

- Meta & Instagram:

o   https://de-de.facebook.com/legal/terms/information_about_page_insights_data

o   https://www.facebook.com/legal/terms/page_controller_addendum

o   https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect

- LinkedIn:

o   https://legal.linkedin.com/pages-joint-controller-addendum

o  https://www.linkedin.com/legal/privacy-policy

Note: We have no influence over the independent data processing carried out by the platform operators. When visiting our social media presence, usage data may be transmitted to the operators, who use it for their own purposes. Data subject rights can be exercised directly against the platform operators.

‍

‍

6. International Data Transfers

Personal data is primarily processed within the EU/EEA. Transfers to so-called „third countries“ only take place in compliance with the requirements of the GDPR and where appropriate safeguards are in place. Before any transfer to a service provider in a third country, the level of data protection is assessed. A transfer only takes place if sufficient protective mechanisms exist. All service providers must enter into a data processing agreement. Additional measures are required for providers outside the EEA. Under Art. 44 et seq. GDPR, a transfer is permissible if at least one of the following conditions is met:

·     The European Commission has determined that an adequate level of data protection exists.

·     Standard Contractual Clauses have been agreed with the recipient.

·     Other appropriate safeguards pursuant to Art. 46 GDPR exist.

·     In certain exceptional cases pursuant to Art. 49 GDPR.

‍

‍

7. CRM, Sales and Lead Management

Purpose: Managing and maintaining relationships with customers, prospects and other contractual or business partners (B2B), including lead management, qualification and prioritisation of leads, documentation of communication and contract histories, planning and steering of sales activities, and enrichment of contact and company data from public sources and specialised B2B data providers.

Recipient: HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, D01 K2C5, Ireland

Data Processed:

• First and last name
• Business contact details (e.g. email address, phone number, business address)
• Company-related data (e.g. company name, industry, company size, function/position, department)
• Data on contractual matters and enquiries (e.g. quote number, service interests, history of enquiries and matters)
• Communication and interaction data (e.g. appointments, meeting notes, participation in events/webinars, response to emails, content accessed)
• Enriched information from publicly accessible sources or B2B data providers (e.g. additional company information, professional profile details, topics/focus areas, assignment to segments or „scores“ for prioritising leads)

Legal Basis:

• Performance of a contract and pre-contractual measures pursuant to Art. 6(1)(b) GDPR, insofar as we are in a (pre-)contractual relationship with you/your employer.
• In addition, legitimate interest pursuant to Art. 6(1)(f) GDPR in the efficient organisation of sales and business relationships, targeted B2B communication, and the optimisation of our products and services. Insofar as we process personal data for direct marketing purposes and associated profiling measures (e.g. lead scoring to prioritise contacts), you may object to this processing at any time with effect for the future.

Retention Period: For the duration of the business relationship or for as long as a legitimate interest in further storage exists (e.g. following up on enquiries, maintaining business relationships); the data is subsequently deleted or anonymised unless statutory retention periods apply. Contact data of prospects/leads with whom no interaction has taken place for an extended period is regularly deleted or processed further only in anonymised form for statistical purposes.

International Data Transfer: Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR); HubSpot, Inc. is certified under this framework.

Further Information: https://legal.hubspot.com/privacy-policy

‍

‍

8. Recipients

We only disclose the personal data we collect if:

·  you have given us your express consent pursuant to Art. 6(1)(a) GDPR,

·  disclosure is necessary to safeguard our legitimate interests or to assert, exercise or defend legal claims, and there is no reason to assume that your overriding interests warranting protection, or your fundamental rights and freedoms requiring the protection of personal data, prevail (Art. 6(1)(f) GDPR),

·  we are legally obliged to disclose the data (Art. 6(1)(c) GDPR), or

·  this is legally permissible and necessary to perform a contract with you or to carry out pre-contractual measures at your request (Art. 6(1)(b) GDPR).

Possible recipients are:

·  Processors: Group companies or external service providers (e.g. in the areas of technical infrastructure and processing, maintenance, payment processing), which are carefully selected and monitored. Processors may only process the data in accordance with our instructions.

·  Public authorities: Authorities and government institutions (e.g. tax authorities, public prosecutors, courts) to which we must transmit personal data, for example to fulfil statutory obligations or to protect legitimate interests.

‍

‍

9. Data Security and Protective Measures  

We implement appropriate technical and organisational measures to ensure the security and confidentiality of your personal data. These measures serve to protect against unauthorised access, manipulation, loss or misuse. Our security measures are reviewed regularly and adapted to the state of the art and current industry standards.

Please note that, despite extensive protective measures, data transmission over the internet may in principle contain security vulnerabilities. In particular, unencrypted communication (e.g. standard email) carries the risk that data may be intercepted by third parties. We have no influence over the conduct of external parties. We therefore recommend using encryption or other protective measures when transmitting sensitive information electronically, in order to minimise potential risks.

‍

‍

10. Retention Period and Deletion/Blocking of Data 

Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Further storage only takes place where required by EU or national regulations to which the controller is subject. Data is likewise deleted or blocked once a statutory retention period expires, unless further storage is required for the performance of a contract.

‍

‍

11. Data Subject Rights  

With regard to your personal data, you have the following rights:

a.    Right to information (Art. 15 GDPR, Section 34 BDSG): You may request information as to whether and which personal data we process about you, for what purpose, to which recipients or categories of recipients the data is disclosed, and how long the data is stored.

b.    Right to rectification (Art. 16 GDPR): You may request the immediate correction of inaccurate personal data or the completion of incomplete personal data.

c.    Right to erasure (Art. 17 GDPR): You may request the erasure of your personal data, in particular where it is no longer required, where you withdraw your consent, or where the data was processed unlawfully.

d.    Right to restriction of processing (Art. 18 GDPR): You may request that the processing of your data be restricted, for example if you dispute the accuracy of the data.

e.    Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or – where technically feasible – to request that it be transmitted to another controller.

f.     Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent given at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal remains unaffected.

Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to the processing of your personal data, in particular in connection with direct marketing or associated profiling.

‍

Version History