Privacy Policy
This privacy notice informs you about how we handle your personal data and about your rights under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The controller responsible for data processing is 2besales GmbH (hereinafter referred to as “we” or “us”).
I. General information
1. Contact
If you have any questions or suggestions regarding this information, or if you wish to contact us to exercise your rights, please send your request to:
Patrick Häfner
2besales GmbH
Lena-Christ-Str. 2
82031 Grünwald
Germany
Phone: +49 89 540489383
Email: info@2besales.de
2. Legal bases
In data protection law, the term personal data refers to any information relating to an identified or identifiable natural person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. We only process data where there is a legal basis for doing so. We process personal data only:
with your consent (Art. 6(1)(a) GDPR),
for the performance of a contract to which you are a party, or at your request to take steps prior to entering into a contract (Art. 6(1)(b) GDPR),
for compliance with a legal obligation (Art. 6(1)(c) GDPR), or
where processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party (Art. 6(1)(f) GDPR).
3. Storage period
Unless otherwise stated in the following information, we only store data for as long as is necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law.
From the end of the calendar year in which the data was collected, we will retain personal data in our accounting records for ten years and personal data in business letters and contracts for six years. In addition, we will retain data relating to consents that require proof, as well as to complaints and claims, for the duration of the statutory limitation periods.
4. Categories of recipients of the data
We use processors in the course of processing your data. The processing operations carried out by such processors include, for example, hosting, maintenance and support of IT systems, CRM management, marketing activities, and accounting and billing. In addition, we may transfer your personal data to postal and delivery services, our bank, tax advisers/auditors or the tax authorities.
5. Data transfers to third countries
Visiting our website and using the services we employ may involve the transfer of certain personal data to third countries. Such a transfer is lawful if the European Commission has determined that the country ensures an adequate level of data protection or if appropriate safeguards pursuant to Art. 46 GDPR are in place. Unless otherwise stated below, we use the EU Standard Contractual Clauses as appropriate safeguards.
6. Your rights
As a data subject, you have the following rights in particular:
Right of access (Art. 15 GDPR, Section 34 BDSG)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR, Section 35 BDSG)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to withdraw consent (Art. 7(3) GDPR)
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
7. Right to object
Under Art. 21(1) GDPR, you have the right to object to processing based on Art. 6(1)(e) or (f) GDPR. Where we process personal data for direct marketing purposes, you may object to this processing at any time pursuant to Art. 21(2) and (3) GDPR.
II. Data processing on our website
1. Processing of server log files
When you use our website purely for information purposes, general information that your browser transmits to our server is stored automatically (e.g. browser type, operating system, page accessed, IP address, date and time). This processing serves the technical administration and security of the website and is based on Art. 6(1)(f) GDPR. The stored data is deleted after seven days.
2. Cookies
We use cookies and similar technologies on our website. Technically necessary cookies are set without consent. We only set cookies that are not technically necessary (e.g. for analytics and marketing purposes) with your consent pursuant to Art. 6(1)(a) GDPR. Information on the individual cookies can be found in the settings of our consent management tool.
3. Consent management tool
This website uses a consent management banner to control cookies and to document your consent. The legal basis for this documentation is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can adjust or withdraw your consent at any time via the fingerprint icon on the left-hand edge of the screen.
4. Contact options and enquiries
Our website contains contact forms through which you can send us messages. The transmission is encrypted. We process the data provided for the purpose of handling your enquiry. The legal basis is Art. 6(1)(b) GDPR (for contract-related enquiries) or Art. 6(1)(f) GDPR (for other enquiries).
5. Online shop / workshop bookings
If you order a product or register for a workshop, we process the data you provide exclusively for the purpose of performing the contract on the basis of Art. 6(1)(b) GDPR.
6. Google Analytics 4
We use Google Analytics 4 (GA4), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 is a web analytics service that uses cookies and similar technologies to collect and analyse data on user behaviour on our website. This involves processing, among other things, online identifiers (cookie IDs), IP addresses (which are anonymised) and device information.
Unlike previous versions (Universal Analytics), GA4 does not use full IP addresses by default. In addition, event-based measurement methods are used. Data may be transferred to Google servers in the USA; the legal basis for this is the EU Standard Contractual Clauses.
The legal basis for using GA4 is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. The data is automatically deleted after 14 months.
You can also prevent data collection by GA4 using the browser plug-in available at https://tools.google.com/dlpage/gaoptout.
7. Google Ads conversion tracking
We use Google Ads provided by Google Ireland Limited. If you reach our website via a Google ad, a so-called conversion cookie is set, which provides us with anonymised conversion statistics. Personal identification is not possible. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
8. Meta Pixel / Facebook Ads
We use the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). The Meta Pixel is a JavaScript code snippet that allows us to track the actions of visitors on our website after they have seen or clicked on a Facebook or Instagram ad.
The following data, among others, is collected and transmitted to Meta: IP address, browser information, page views and conversion events (e.g. contact enquiries). Meta may link this data to your Facebook profile if you are logged in to Facebook. The data may be transferred to the USA; the legal basis for this is the EU Standard Contractual Clauses.
The legal basis for using the Meta Pixel is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time via our consent management tool.
Further information can be found in Meta’s privacy policy: https://www.facebook.com/privacy/explanation
9. LinkedIn Insight Tag
We use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The Insight Tag enables us to measure conversions, re-engage website visitors (retargeting) and obtain detailed information about our target audience.
When you visit our website, the Insight Tag sets a cookie in your browser if you are logged in to LinkedIn. This records, among other things, the URL, referrer URL, IP address (truncated), device properties and timestamp and transmits them to LinkedIn. LinkedIn may assign this data to your LinkedIn profile. The data may be transferred to the USA; the legal basis for this is the EU Standard Contractual Clauses.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
Further information and opt-out options can be found at: https://www.linkedin.com/legal/privacy-policy
10. HubSpot
We use HubSpot, provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, or in the EU: HubSpot Ireland Limited, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated CRM and marketing platform that we use for the following purposes:
Management of customer and prospect data (CRM)
Email marketing and sending newsletters
Landing page tracking and form processing
Analysis of user behaviour on our website
In the process, personal data (e.g. name, email address, IP address, page views) may be collected and transferred to HubSpot servers in the USA. The legal basis for the transfer is the EU Standard Contractual Clauses. We have concluded a data processing agreement (DPA) with HubSpot pursuant to Art. 28 GDPR.
Depending on the context, the legal basis for the processing is Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest).
Further information can be found in HubSpot’s privacy policy: https://legal.hubspot.com/privacy-policy
11. Calendly
We use Calendly, provided by Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA, for appointment booking. If you book an appointment with us via Calendly, the data you enter (e.g. name, email address and any other information) is transmitted to and stored by Calendly. The data is transferred to the USA; the legal basis for this is the EU Standard Contractual Clauses. We have concluded a data processing agreement (DPA) with Calendly pursuant to Art. 28 GDPR.
The legal basis for the data processing is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient appointment management).
Further information: https://calendly.com/privacy
12. OnceHub (ScheduleOnce)
In addition to or as an alternative to Calendly, we use OnceHub (formerly ScheduleOnce), provided by OnceHub Ltd., 10 Lower Baggot Street, Dublin 2, Ireland. OnceHub enables online appointment booking and management. The data you enter (e.g. name, email address, preferred appointment times) is transmitted to OnceHub and stored on its servers. Data may be transferred to third countries; the legal basis for this is the EU Standard Contractual Clauses. We have concluded a data processing agreement (DPA) with OnceHub pursuant to Art. 28 GDPR.
The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.
Further information: https://www.oncehub.com/privacy-policy
13. Claude (Anthropic)
As part of our internal work processes, we use Claude, an AI language model provided by Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. Claude is used for tasks such as text creation, summaries and internal analyses.
Where personal data (e.g. content from client communications or project data) is processed when using Claude, this is done on the basis of our legitimate interest in efficient work processes (Art. 6(1)(f) GDPR) or on the basis of consent (Art. 6(1)(a) GDPR). We have concluded a data processing agreement (DPA) with Anthropic pursuant to Art. 28 GDPR. Data may be transferred to the USA; the legal basis for this is the EU Standard Contractual Clauses.
Please note that when using Claude, we do not enter any special categories of personal data (Art. 9 GDPR) and do not enter any data that would allow individuals to be directly identified, unless this is expressly required for the task in question.
Further information can be found in Anthropic’s privacy policy: https://www.anthropic.com/privacy
14. Third-party services and content
We embed content and services from third-party providers on our website, which technically requires your IP address to be transmitted to the respective providers. This processing is based on Art. 6(1)(f) GDPR.
III. Data processing on our social media pages
We maintain company pages on several social media platforms (Facebook, Instagram, LinkedIn) in order to offer additional ways to obtain information and communicate with us.
1. Facebook and Instagram pages
Meta Platforms Ireland Limited is, in principle, the sole controller for the processing of personal data when you visit our Facebook or Instagram page. In addition, we and Meta process anonymised page statistics (“Page Insights”) as joint controllers. The legal basis is Art. 6(1)(f) GDPR.
Further information and opt-out options: https://www.facebook.com/privacy/explanation
2. LinkedIn company page
For visits to our
LinkedIn page, LinkedIn Ireland Unlimited Company is, in principle, the sole controller. As part of Page Insights, we and LinkedIn process anonymised statistics as joint controllers. The legal basis is Art. 6(1)(f) GDPR.
We have concluded a joint controller agreement with LinkedIn (available at: https://legal.linkedin.com/pages-joint-controller-addendum). LinkedIn is responsible for enabling you to exercise your rights under the GDPR.
3. Comments and direct messages
We process information that you share with us via our social media pages (e.g. comments, direct messages) as sole controller on the basis of Art. 6(1)(f) GDPR in order to get in touch with the persons making enquiries.
IV. Other data processing
1. Customer and prospect data
If you contact us as a customer or prospect, we process your data in order to establish or perform the contractual relationship on the basis of Art. 6(1)(b) GDPR. In addition, we process customer and prospect data for analysis and marketing purposes on the basis of Art. 6(1)(f) GDPR.
2. Data processing agreements (DPAs)
We have concluded data processing agreements pursuant to Art. 28 GDPR with all service providers that process personal data on our behalf. This applies in particular to:
HubSpot Ireland Limited (CRM & marketing)
Calendly LLC (appointment booking)
OnceHub Ltd. (appointment booking)
Anthropic PBC (AI language model Claude)
These DPAs ensure that these service providers only process personal data in accordance with our documented instructions and have implemented appropriate technical and organisational measures to protect the data.
3. Use of your email address for marketing purposes
We may use the email address you provided when registering or ordering to inform you about our own similar products and services. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG). You can object to this at any time without incurring any costs other than the transmission costs according to the basic rates — by clicking the unsubscribe link in any mailing or by emailing info@2besales.de.
Photos
Julia Mittelhamm
Johann-Fischer-Str. 11
69121 Heidelberg
Germany
Phone: +49 171 5817752
Email: info@juliamittelhamm.com
