Privacy Policy

For avodaq AG and its subsidiaries (hereinafter referred to as “avodaq”), the responsible handling of personal data are a top priority. We want you to understand when, which, and for what purpose data is collected, stored, processed, as well as how it is safeguarded. On this website, you will find all relevant information regarding these topics and your rights. We take data protection seriously and treat your personal data in compliance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR).

Data Controller
The data controller within the meaning of Art. 4 No. 7 of the GDPR, responsible for the processing of personal data in accordance with the General Data Protection Regulation and other data protection provisions, is the

avodaq AG
Munich Office
Landsberger Straße 290
80687 München
Germany

Phone: +49 40 413267 0
Email: contact@avodaq.com
www.avodaq.com

Data Protection Officer

You can contact our Data Protection Officer in accordance with Art. 37 GDPR by mail or by email:

avodaq AG
Attn. Data Protection
Wendenstraße 21 b
20097 Hamburg
Germany

Phone: +49 40 413267 0
Email: datenschutz@avodaq.com

1 General information

Each time you access our online services, various types of data and information are collected. The following information provides an overview of what happens to your personal data.

2 Personal Data

Personal data is information relating to an identified or identifiable natural person. This includes all information related to your identity, such as your name, email address, or phone number. Information that cannot be linked to your identity (for example, statistical data, such as the number of users of the online service) is not considered personal data.

3 Processing of Personal Data

You can generally use our online services without disclosing your identity or providing any personal data. In such cases, we only collect general information about your visit, primarily technical data such as your internet browser, operating system, or the time of access to our online services. This information is necessary to ensure the smooth and secure operation of our website and is collected automatically when you access it. No personal evaluation or use of the data for marketing purposes takes place.

In the following sections, we explain which of our services involve the collection of personal data and for what purpose. In general, we process this data solely to enable you to use our online services and to provide the information you request.

We process personal data for the following purposes:

• Contact Requests and Customer Support: We collect data such as your name, email address, and phone number to handle inquiries and contact you.
• Contract Processing: To execute contracts, we process business data such as name, address, and contact details.
• Marketing and Advertising: With your consent, we send you information about our products and services.

The legal basis for data processing is the fulfillment of a contract (Art. 6(1)(b) GDPR) or your consent (Art. 6(1)(a) GDPR).

4 Disclosure of Personal Data to Third Parties

We generally use your personal information only to provide the services you request. If external service providers are engaged to deliver these services, their access to the data is strictly limited to the purpose of service provision. Through technical and organizational measures, we ensure compliance with data protection requirements and also obligate our external service providers to adhere to them.

Your personal data will only be disclosed if you have given your consent or if we are legally authorized or required to do so by law, regulation, or official or court order. This may include, in particular, the provision of information for law enforcement purposes, the prevention of risks, or the protection of intellectual property rights.

If we transfer your personal data—either directly or through service providers—to countries outside the European Union, we ensure compliance with the requirements set out in Articles 44 et seq. of the GDPR. We also obligate our service providers to adhere to these standards. Data will only be transmitted to countries outside the European Union where the level of data protection equivalent to that of the GDPR is guaranteed. Such a level of protection is typically ensured either by an adequacy decision of the European Commission or through appropriate safeguards in accordance with Article 46 of the GDPR.

5 Legal Basis for Data Processing

The processing of your personal data is based on the following legal grounds:

• Performance of a Contract: When a contractual relationship is established or services are rendered to you (Art. 6(1)(b) GDPR).
• Consent: If we process your data based on your consent (Art. 6(1)(a) GDPR).
• Legitimate Interest: For certain processing activities where we have a legitimate interest (Art. 6(1)(f) GDPR).

6 Data Retention and Retention Period

We may keep your personal data for a longer period if this is necessary to meet legal requirements or if avodaq needs the data to assert or defend legal claims. In such cases, your personal data will be stored until the legal retention period has expired or all related claims have been resolved.

7 Data Collection on this Website

7.1 Server-Log-Data

When you use our website for informational purposes only, we collect only the personal data that your browser automatically transmits to our server. This data is technically required to display the website correctly and to maintain its stability and security.
The collected data may be shared with relevant internal departments or external service providers (such as hosting or content management providers) for processing as needed, for example to help resolve technical issues. The legal basis for this processing is Art. 6(1)(f) of the GDPR (legitimate interest).
Log files are deleted no later than 24 hours after they are collected.

7.2 Use of Cookies

In addition to the server log files mentioned above, cookies are stored on your device when you use our website. Cookies are small data files that do not harm your device. They are stored either temporarily for the duration of your visit (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted after you leave the site. Persistent cookies remain stored on your device until you delete them yourself or your browser removes them automatically.

Cookies can be set by us (first-party cookies) or by third parties (third-party cookies). Third-party cookies enable the integration of external services on our website, for example payment solutions or embedded content.
Cookies serve various purposes. Many are technically essential to ensure the website functions properly (for example, to display videos). Others help us analyze user behavior or are used for marketing purposes.

Cookies that are required for electronic communication, to provide specific features you request (such as video playback), or to optimize our website (for example, to measure traffic) are stored based on Art. 6(1)(f) GDPR, unless another legal basis applies.

avodaq has a legitimate interest in using necessary cookies to ensure an error-free and optimized online experience. Where consent has been obtained for the use of cookies or similar technologies, data processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw your consent at any time.

You can configure your browser to inform you whenever cookies are set and decide whether to allow them in individual cases. You can also refuse cookies entirely or have them deleted automatically when you close your browser. Disabling cookies may, however, limit the functionality of the website. Further details about the cookies and services used can be found in this privacy policy.

7.2.1 Your Cookie Selection History

7.2.2 Cookies we use

Opt-out Google Tag Manager

Opt-out Google Analytics

7.3 Contact Form and Registration Form

When you contact us via a form or register for an event or service, the information you provide—including your contact details—is stored by us for the purpose of processing your request and handling any follow-up questions. We do not share this data without your consent.

The processing of this data is based on Art. 6(1)(b) GDPR if your inquiry relates to a contract or is necessary for pre-contractual measures. In other cases, processing is carried out on the basis of our legitimate interest in efficiently managing incoming inquiries (Art. 6(1)(f) GDPR), or on your consent (Art. 6(1)(a) GDPR), if applicable. You can withdraw your consent at any time.

The data you provide will remain with us until you request its deletion, revoke your consent, or the purpose for storing the data no longer applies (for example, once your inquiry has been fully processed). Statutory retention obligations remain unaffected.

7.4 Inquiries via Email or Telephone

If you contact us by email or telephone, the information you provide—including any personal data contained in your message—is stored and processed for the purpose of handling your inquiry. We do not share this data without your consent.

The processing of this data is based on Art. 6(1)(b) GDPR if your request is related to a contract or is necessary for pre-contractual measures. In all other cases, processing takes place on the basis of our legitimate interest in efficiently managing incoming inquiries (Art. 6(1)(f) GDPR), or on your consent (Art. 6(1)(a) GDPR), if it has been given. You may withdraw your consent at any time.

The data you send us via your inquiry will remain with us until you ask for its deletion, withdraw your consent, or the purpose for storing it no longer applies (for example, once your request has been fully handled). Statutory retention requirements remain unaffected.

8 Contact at Trade Fairs

avodaq participates in trade fairs to engage with visitors. If you wish, contact details can be exchanged on-site so that we can get in touch with you after the event and provide further information. Only the personal data you choose to share with us will be processed.

The processing of the personal data you provide is necessary to establish contact with you.

The data you provide will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for storing the data no longer applies (for example, once your request has been fully processed). Statutory requirements – particularly legal retention periods – remain unaffected.

9 Information and Marketing Emails

If you provide your consent via the double opt-in procedure (Art. 7 and 8 GDPR) to store your personal data for the purpose of receiving informational and marketing emails, you will subsequently receive updates about news, events, and offers from avodaq. You can withdraw your consent at any time without stating a reason, either through the unsubscribe link included in each email or by contacting us directly. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

The data you provide for receiving informational and marketing emails will be stored until you unsubscribe and will then be deleted. We reserve the right to remove or block email addresses at our discretion based on our legitimate interest (Art. 6(1)(f) GDPR). Data retained for other purposes remains unaffected. After unsubscribing, your email address may be stored in a blacklist if necessary to prevent future mailings. This data is used exclusively for this purpose and is not merged with other data. Blacklist storage serves both your interest and ours in complying with legal requirements (legitimate interest pursuant to Art. 6(1)(f) GDPR). The storage period is not limited. You may object to this storage if your legitimate interests outweigh ours.

Our informational and marketing emails contain tracking pixels (also known as web bugs) that allow us to determine whether an email has been opened and which links have been clicked by each recipient. This data helps us better tailor our communications to the preferences and interests of our subscribers. The collected data is used to send personalized emails to the respective recipients. When you revoke your consent to receive informational and marketing emails, your consent to tracking is automatically revoked as well.

9.1 Embedded Web Links in Emails

The emails we send contain links that are redirected through our servers before reaching their final destination on the Internet. This redirection allows us to adjust target URLs and measure the effectiveness of our marketing activities. We can see whether you have clicked a link in the email, and this information may be associated with your personal data. The legal basis for this processing is your consent in accordance with Art. 6(1)(a) GDPR.

10 Online Surveys

We occasionally conduct surveys as part of our online services. If you choose to participate, the data you provide will be stored and used solely for the purpose of that specific survey. Any further use, such as sending additional information, will only occur if you have explicitly given your consent within the survey.

You can decide yourself which information you wish to share during our online surveys. The processing of your data is based on your consent in accordance with Art. 6(1)(a) GDPR. Your data will be deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data, this generally applies once the respective survey has been completed.

11 Social Media Presence

avodaq is active on various social networks to inform users about our services and offerings. If you wish, you can contact us directly via these platforms. Our social media channels complement the content on our website and offer you an alternative way to get in touch with us if you prefer using these networks.
On our website, you will find links to our profiles on Xing and LinkedIn, YouTube, Kununu, and GitHub. These links are identified by the respective platform’s logo and may also allow you to share specific content with third parties.

By clicking on a link, you will be redirected to the corresponding social media page, where this privacy policy no longer applies. Please refer to the privacy policies of the respective providers for details on their data processing practices. No personal data is transmitted to these providers before you click the link. Your visit to the linked platform forms the basis for data processing carried out by that provider.

11.1 Use of YouTube

This website embeds videos from YouTube, which is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit a page on our website that contains an embedded YouTube video and actively play the video by clicking the “Play” button, a connection to YouTube’s servers is established. In this process, personal data may be transmitted to YouTube and cookies may be set. If you are logged into your YouTube account, YouTube can directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account before playing embedded videos.

According to YouTube, when videos are played in this mode, viewing activity is not used to personalize your browsing experience on YouTube, and any ads shown are non-personalized. No cookies are set until you interact with the video, but YouTube may store so-called local storage elements in your browser that function similarly to cookies, can contain personal data, and may be used for recognition purposes.

For more information about YouTube’s extended privacy mode, please refer to: https://support.google.com/youtube/answer/171780.

Activating a YouTube video on our website may result in additional data processing activities by YouTube, over which we have no control. The use of YouTube serves to present our online offerings in an appealing way, which constitutes a legitimate interest pursuant to Art. 6(1)(f) GDPR. If explicit consent has been obtained, data processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, provided this includes consent to the storage of cookies or access to information on your device (such as device fingerprinting) as defined by the TDDDG. You can revoke your consent at any time.

For further information about data protection and data processing on YouTube, please refer to YouTube’s privacy policy: https://www.youtube.com/t/privacy.

This reflects current GDPR guidance: visitors must be explicitly informed about potential data transfers and consent mechanisms, especially when using embedded content such as YouTube videos, even when privacy-enhanced mode is used.

12 Google Tag Manager

Google Tag Manager (GTM) is a tag management system provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Irelan, enabling website owners to manage website tags via a centralized interface. The tool itself does not collect personal data or set cookies directly; rather, it allows third-party tags—such as Eloqua, LinkedIn Insight Tag, Hotjar, Google Ads Remarketing, Google Ads Conversion Tracking, and Facebook Pixel—to be deployed, and these may process personal data based on the user’s consent.

The Google Tag Manager is considered a cookie-free domain, but it can trigger tags that collect data. GTM does not have access to the data collected by these third-party tags. If tracking is disabled at the cookie or domain level, this deactivation applies to all tracking tags implemented via GTM. Each subservice connected through GTM requires explicit consent under Art. 6(1)(a) GDPR, and website owners must provide clear opt-out methods for users; if a user opts out of one subservice, the opt-out applies to all related services deployed via GTM.

Website data processed via these services may be transferred to countries outside the EU/EEA, possibly including countries without adequate data protection safeguards. Notably, transfers to the United States may pose risks, since U.S. authorities could potentially access personal data without effective remedies for individuals. To mitigate such risks, website operators must adopt legally required measures under Art. 44 et seq. GDPR to ensure adequate protection, such as contractual safeguards and privacy frameworks.

For further details, Google’s privacy documentation and the GTM use policy provide additional guidance on compliance and subservice management: https://www.google.com/tagmanager/use-policy.html.

13 Google Analytics

Google Analytics is used to analyze visits to our website. The data helps us optimize both the website itself and our marketing efforts. This service is provided by Google Ireland Limited, which processes data on our behalf under contractual obligations to ensure privacy and security. Google Analytics is provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

During your visit, Google may process the following data: pages visited, achievement of website goals (such as contact forms), site interactions (like clicks and scroll behavior), approximate location (country/city), your IP address, technical details (browser, provider, device), source of visit (referrer), and a randomly generated user ID. Personal details such as name, address, or contact information are not transmitted to Google Analytics.

Data is transmitted to Google’s servers in the USA. Please note that the USA may not guarantee the same level of data protection as the EU. Google Analytics cookies, which store a randomly generated user ID, are retained for up to two years from your last visit. This allows the creation of pseudonymous usage profiles, while some data remains aggregated and stored indefinitely.

For Google Analytics to meet GDPR requirements, your explicit consent is necessary before any tracking occurs. If you do not agree, you can prevent tracking either by rejecting cookies in your browser or using the opt-out add-on from Google. Privacy settings should transparently describe Google Analytics use, cookie handling, data transfer, and retention, with a clear option to withdraw consent at any time. Details about Google’s privacy policy and Google Analytics’ terms of use are also available via the respective links.

To comply fully with GDPR, we ensure that:

• Your consent is always collected before Google Analytics is activated.
• IP addresses are anonymized before transmission if possible.
• Data retention and deletion policies are implemented.
• All users are informed about data collection, processing, and storage procedures.
• Contracts with Google include data processing and transfer safeguards.

If you would like further details on privacy options with Google Analytics, please refer to Google’s privacy policy and terms of service: https://www.google.com/analytics/terms/de.html.

14 Google Maps

Google Maps is integrated as a mapping service via Google Ireland Limited. When you use Google Maps on our website, data about your use of the map features is collected and processed by Google. The use of Google Maps is only performed after you have given explicit consent (Art. 6(1)(a) GDPR), since this service involves processing personal data, including possible transfers to third countries.

Your data will only be shared with Google Maps after you provide active consent, typically through a cookie banner or other opt-in solution. Without your consent, Google Maps will not be loaded, and no data will be transmitted. You have the right to revoke your consent at any time for future processing. For details about how Google processes your data, please refer to their privacy policy: https://www.google.com/intl/de_de/help/terms_maps.html.

15 Quentn

In our online services, we use a marketing automation software provided by Quentn.com GmbH, Friedrich-Ebert-Straße 51, 14469 Potsdam, Germany. This tool helps us send you invitations to customer events and other relevant information by email, based only on data you have explicitly provided to us.

Quentn is fully GDPR-compliant and implements necessary privacy safeguards, including a mandatory double opt-in procedure before sending marketing emails. This means you explicitly consent to receive marketing communications from us, and you can withdraw this consent any time. The software also provides a clear unsubscribe link in every email.

If you choose to unsubscribe, you can do so either by contacting us directly (using the contact details in the imprint) or via the link in the email. Upon unsubscribing, your email address will be deleted unless you explicitly consented to further use or unless we have a legal basis for continued processing, about which we inform you in this privacy notice.

Data processing through Quentn is carried out only with your consent (Art. 6(1)(a) GDPR) or as otherwise legally permitted. Quentn maintains data protection agreements with us, ensuring that your personal data is handled securely and only for the intended purposes.

16 Zapier

We use Zapier Inc., located at 548 Market St. #62411, San Francisco, CA 94104, USA, to automate and connect various web applications, enabling efficient data transfer between services for internal process optimization. This data processing is based on our legitimate interest under Art. 6(1)(f) GDPR. Zapier functions as a data processor on our behalf, and we have concluded a Data Processing Agreement (DPA) with them, ensuring compliance with GDPR requirements. Zapier processes personal data only as instructed by us, employs encryption in transit and at rest, and limits data storage to what is necessary for service provision. They have committed to the EU-US Data Privacy Framework, facilitating lawful data transfers.

As the data controller, we remain responsible for ensuring personal data processed via Zapier complies with GDPR. We only transfer data necessary for the specified automation tasks and take measures to secure access, monitor workflows, and respond to any data subject requests.

You can find additional information on Zapier’s data protection practices and privacy policies at https://zapier.com/privacy.

17 Job Portal

We provide applicants with a dedicated and separate privacy policy at https://avodaq-ag.jobs.personio.de/privacy-policy?language=de that exclusively covers the collection, processing, and use of personal data during the online application process. This policy informs candidates transparently about the types of data collected, the purposes of, data retention periods, and the rights candidates have under GDPR, including rights to access, rectification, deletion, and withdrawal of consent.

This specific privacy policy applies only to the personal data handled as part of the online application and recruitment procedure and explains that data is processed lawfully either for pre-contractual measures or based on consent. Access to personal data is restricted to authorized personnel involved in recruiting, and data is protected against unauthorized access or misuse.

By providing a dedicated privacy statement, we ensure compliance with GDPR transparency obligations and provide applicants clarity on how their data is treated separately from other data processing elsewhere on the website.

18 Your Rights

We place great value on explaining the processing of your personal data to you as transparently as possible and informing you about your rights. If you would like more detailed information or wish to exercise your rights, you can contact us at any time, and we will take care of your request.

18.1 Rights of the Data Subject

You have extensive rights concerning the processing of your personal data. These include, in particular, the right to access your data and, where applicable, to request the correction, deletion, or restriction of your data. You may also object to certain data processing activities. Moreover, you have the right to data portability regarding the personal data you provided.

If you wish to exercise any of these rights or require further information, please contact our Data Protection Officer. The contact details are available at the beginning of this page.

18.2 Revocation of Consent and Objection

You have the right to revoke any consent you have given at any time with effect for the future. Revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent up until the revocation. The designated contact person for revoking consent is our Data Protection Officer.

If the processing of your personal data is based on a legal basis other than consent, you have the right to object to such processing. Your objection will trigger a review of the processing, and if justified, the processing will be discontinued. You will be informed of the outcome of this review and, if continued processing is lawful, you will receive an explanation of the reasons why the data processing will persist.

18.3 Complaints

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data by us violates this Privacy Policy or applicable data protection regulations. This complaint can be filed in the Member State where you reside, work, or where the alleged infringement occurred.

You may also contact our Data Protection Officer, who will review your concern and inform you about the outcome of the review. The supervisory authority is obliged to investigate the complaint thoroughly and keep you informed about its progress and results, including any judicial remedies available to you.

19 Further Information and Changes

19.1 Links to other Websites

Our online offering may contain links to other websites, which are generally identified as such. We have no influence over whether the applicable data protection regulations are observed on the linked websites. Therefore, we recommend that you also carefully review the respective privacy policies on these websites.

This is a common and recommended practice under GDPR to ensure transparency and to clarify that responsibility for data protection lies with the external sites themselves. Informing users clearly that external links lead to independent sites with their own privacy and data protection measures helps to manage user expectations and limit liability.

19.2 Changes to this Privacy Policy

The date at the bottom of this Privacy Policy indicates its current status. As we continue to develop and implement new technologies, it may become necessary to update this Privacy Policy. We therefore recommend that you review this Privacy Policy from time to time for any changes.

Status of this Privacy Policy: November 2025

Please note: The English version of our privacy policy is provided for your convenience. It was generated using AI. The legally binding version is the German one.