Privacy policy

1. Controller and data protection contact

The controller for the processing of personal data on this website is Zyberum GmbH, Jägerstieg 12, 30657 Hannover, Germany, represented by its managing director Tom Zaubermann. Email: info@zyberum.com, phone: +49 176 439 17074.

Your contact for all data protection questions is Tom Zaubermann, at info@zyberum.com or at the address above. We have not appointed a data protection officer because there is no legal obligation to do so (Art. 37 GDPR, § 38 BDSG).

2. Hosting and server log files

This website is operated by Scaleway SAS, 8 rue de la Ville l’Evêque, 75008 Paris, France, in data centres in the EU. Scaleway processes the data on our behalf (Art. 28 GDPR).

With every request the server processes technically necessary data: IP address, date and time, requested page, amount of data transferred, referrer, browser and operating system. This is needed to deliver the website and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. Log data is deleted after 14 days at the latest, unless we need it to investigate a specific security incident.

The connection to this website is encrypted with TLS (shown by “https://” in the address bar).

3. Consent, cookies and local storage

We only use technologies that are not needed to run the website (analytics and marketing) with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You decide in the consent banner which categories you allow. You can withdraw or change your consent at any time with effect for the future via “Cookie settings” in the footer.

In your browser’s local storage we keep: your choice in the consent banner (“zy-consent-v1”, strictly necessary under § 25(2) TDDDG; we ask again after 12 months) and, only with marketing consent, campaign parameters such as gclid and UTM values (“zy-attribution”, 90 days), so that we can link an enquiry to the ad that brought you here.

We use Google Consent Mode v2 in basic mode: as long as you have not consented, Google services are not loaded at all.

4. Contact form, email and phone

If you contact us via the contact form, email or phone, we process your details (name, email address and, if provided, company, phone number and message) and the type of reply you asked for, in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries), and your consent given via the checkbox (Art. 6(1)(a) GDPR). We need your name and email address to reply; all other details are optional.

Form submissions are sent directly to our CRM system HubSpot (HubSpot Ireland Ltd., 1 Sir John Rogerson’s Quay, Dublin 2, Ireland; parent company HubSpot Inc., USA). Our HubSpot account is hosted in HubSpot’s EU data centre; HubSpot processes the data on our behalf. If you have allowed marketing cookies, we also send the campaign parameters described in section 3. Emails are processed with Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin, Ireland).

We delete enquiries once they have been dealt with and no business relationship results, at the latest 12 months after the last contact. If a contract is concluded, we keep business correspondence for six years (§ 257 HGB) and accounting records for ten years (§ 147 AO).

5. Appointment booking

For appointment bookings we use HubSpot. The calendar is only loaded when you open a booking; your IP address and browser data are then transferred to the provider, whose privacy policy applies. We use the data you provide when booking to hold the appointment (Art. 6(1)(b) GDPR).

HubSpot’s scheduling tool is part of our CRM system (see section 4); booked appointments are stored in our calendar and in the CRM. We delete appointment data under the same rules as enquiries.

6. Self-checks (CRA and NIS2)

Your answers in the self-checks are evaluated only in your browser and are neither sent to us nor stored. If you have allowed analytics cookies, Google Analytics only records which result was shown, not your individual answers.

7. Google Tag Manager, Google Analytics 4 and Google Ads

With your consent, we use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Tag Manager to manage tags, Google Analytics 4 for statistics on the use of the website, and Google Ads to measure whether ads lead to enquiries or bookings. This involves device and browser data, pages visited, click IDs (gclid) and conversion events such as “enquiry sent” or “meeting booked”. Google Analytics 4 does not store full IP addresses.

Cookies used: “_ga” and “_ga_<ID>” (Analytics, 2 years) and “_gcl_au” (Google Ads, 90 days). We delete analytics data after 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

8. HubSpot tracking

If you consent to marketing technologies, we load HubSpot’s tracking code. This lets us link an enquiry to the previous visit history and follow up on leads in a more targeted way. Cookies used: “hubspotutk” and “__hstc” (6 months), “__hssc” (30 minutes), “__hssrc” (session). The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG.

9. Videos (YouTube)

On some pages we show videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). At first you only see a preview image stored on our server. Only when you press play is the video loaded from youtube-nocookie.com; your IP address and browser data are then transferred to YouTube, and Google’s privacy policy applies. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

10. Fonts, external links and social media

All fonts are served from our own server; there is no connection to Google Fonts. Links to external websites and networks are plain links: data is only transferred when you click them.

We run company profiles on LinkedIn, X, Facebook and YouTube. When you visit them, the operators process your data under their own privacy terms. For the page statistics (“Page Insights”) of our LinkedIn page, we are joint controllers with LinkedIn Ireland Unlimited Company (Art. 26 GDPR); LinkedIn has undertaken to handle data subject requests. The legal basis for our profiles is Art. 6(1)(f) GDPR; our legitimate interest is communicating with prospects and presenting our company.

11. Job applications

We process applications you send by email to career@zyberum.com to carry out the application process (Art. 6(1)(b) GDPR in conjunction with Art. 88 GDPR). Only the people involved in the process have access. If we do not hire you, we delete your documents six months after the process ends, so that we can defend ourselves against possible claims under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). If you would like to be considered for future positions for longer, we ask for your consent first.

12. Recipients and transfers to third countries

Your data is only received by the service providers named in this policy: Scaleway (hosting, France), HubSpot (CRM and scheduling, EU hosting), Microsoft (email, Ireland) and, only with your consent, Google (Analytics, Ads and YouTube, Ireland). We have concluded data processing agreements with the providers that work on our behalf (Art. 28 GDPR).

HubSpot, Microsoft and Google have parent companies in the USA, so access from the USA cannot be ruled out. These companies are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).

13. Obligation to provide data and automated decisions

You are not legally or contractually obliged to provide data. Without a name and email address, however, we cannot answer an enquiry. There is no automated decision-making, including profiling, under Art. 22 GDPR.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal. Just contact info@zyberum.com.

15. Right to object under Art. 21 GDPR

WHERE WE PROCESS YOUR DATA ON THE BASIS OF ART. 6(1)(F) GDPR (LEGITIMATE INTERESTS), YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. WE WILL THEN NO LONGER PROCESS YOUR DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

WHERE WE PROCESS YOUR DATA FOR DIRECT MARKETING, YOU CAN OBJECT AT ANY TIME WITHOUT GIVING REASONS. AN EMAIL TO INFO@ZYBERUM.COM IS ENOUGH.

16. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is the Landesbeauftragter für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

Version

September 2026. This is a translation; the German version is legally binding.