Privacy Policy

1. Data Controller and Contact

Protecting your personal data is important to us. We therefore want to explain transparently which data we process when you visit this website and use our services, for what purposes and on what legal basis this occurs, and what rights you have.

The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other data protection requirements is:

ViralSpoon GmbH
Baseler Platz 6
60329 Frankfurt am Main
Germany

Email: info@viralspoon.de
Website: https://viralspoon.de

The complete provider identification with authorized representatives and register data can be found in our imprint at viralspoon.de/legal/imprint.

Referred to below as “controller,” “ViralSpoon,” or “we.” For questions about data protection or to exercise your rights, you can reach us at info@viralspoon.de.

1.1 Data Protection Officer

We have appointed an external data protection officer. You can contact them directly with any questions or concerns regarding data protection and the exercise of your rights. You can reach them at:

ViralSpoon GmbH – Data Protection Officer –, Baseler Platz 6, 60329 Frankfurt am Main, Germany, email: datenschutz@viralspoon.de

2. General Information on Data Processing

2.1 Personal Data

Personal data is any information relating to an identified or identifiable natural person — for example, name, address, phone number, email address, IP address, or information about your usage behavior.

2.2 Legal Bases

We only process personal data if a legal basis under Art. 6(1) GDPR exists. In particular, the following may apply:

• Consent (Art. 6(1)(a) GDPR) — for example, for sending the newsletter or for cookies and analytics services requiring consent. You may withdraw consent at any time with effect for the future.
• Contract and pre-contractual measures (Art. 6(1)(b) GDPR) — for example, when processing an inquiry, registering for our software, or performing a contract.
• Legal obligation (Art. 6(1)(c) GDPR) — for example, retention obligations under commercial and tax law.
• Legitimate interest (Art. 6(1)(f) GDPR) — for example, the secure and stable operation of this website or the documentation of consent.

Where we store information on your device or access information stored there, this is additionally governed by § 25 TDDDG. Access that is not technically necessary occurs exclusively on the basis of your consent pursuant to § 25(1) TDDDG.

2.3 Categories of Data

Depending on how our services are used, we process in particular:

• Master data (e.g., name, company, role)
• Contact data (e.g., email address, phone number)
• Content data (e.g., text entered in forms, message content)
• Contract data (e.g., subject matter of the contract, term, customer category)
• Payment data (e.g., invoice data, payment history)
• Usage data (e.g., pages visited, access times, interactions)
• Connection data (e.g., IP address, device and browser information, referrer URL)

2.4 Retention Period and Deletion

We only process personal data for as long as necessary for the respective purpose. If the purpose no longer applies or you withdraw your consent, we delete the data — unless statutory retention obligations prevent this. Under § 257 HGB and § 147 AO (German Commercial Code and Fiscal Code), these are in particular ten years for books of account and annual financial statements, eight years for accounting vouchers such as invoices, and six years for commercial and business correspondence, each calculated from the end of the calendar year. In such cases, we restrict processing and delete the data once the period has expired. We state specific retention periods for the individual processing activities below.

2.5 Recipients and Data Processing Agreements

To operate this website and our services, we use carefully selected service providers, for example for hosting, consent management, email delivery, and traffic analysis. Where these service providers process personal data on our behalf, this occurs on the basis of a data processing agreement pursuant to Art. 28 GDPR. The service providers are bound by our instructions. We also disclose data where we are legally required to do so or where you have given your consent.

2.6 Transfers to Third Countries

Some of the services we use are based outside the European Union or process data outside the EU. A transfer only takes place if the requirements of Art. 44 et seq. GDPR are met — in particular, on the basis of an adequacy decision by the EU Commission, certification under the EU-U.S. Data Privacy Framework (DPF), standard contractual clauses issued by the EU Commission, or your explicit consent.

For each individual service, we indicate the basis on which a transfer to a third country occurs. Information on the Data Privacy Framework and a list of certified companies can be found at https://www.dataprivacyframework.gov/.

We note that, in particular for transfers to the USA, a residual risk remains — despite these safeguards — that US authorities may access data and that effective legal remedies for data subjects may be limited.

2.7 Security Measures

Taking into account the state of the art, the cost of implementation, and the nature, scope, circumstances, and purposes of processing, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk (Art. 32 GDPR). These include, in particular, safeguarding the confidentiality, integrity, and availability of your data, access and entry controls, encrypted transmission via TLS, and procedures for exercising data subject rights, deleting data, and responding to data breaches. We take data protection into account already when selecting services and developing our software (Art. 25 GDPR).

3. Cookies and Consent Management

3.1 What Cookies Are

Cookies are small text files stored on your device. Comparable technologies include, for example, local storage or pixels. We distinguish between:

• Technically necessary cookies: required for operating the website, for example for security functions, form processing, or storing your cookie selection. Legal basis: § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.
• Statistics and analytics cookies: help us understand how our website is used. Only with your consent.
• Marketing cookies: used to display and measure advertising. Only with your consent.

Unless we state otherwise, cookies are stored for up to two years.

In addition, our website uses browser session storage to remember your selection in the “Subject” field of the contact form for the duration of your visit. This information never leaves your browser and is deleted when the tab is closed. It is technically necessary pursuant to § 25(2) no. 2 TDDDG.

If you have consented to marketing cookies, we also store in local storage (“vs_attribution”, for no more than 90 days) and in session storage (“vs_landingpage”, until the tab is closed) which ad or campaign brought you to us and on which page your visit began. Details can be found in section 9.1.

3.2 Consent Management with Enzuzo

On your first visit to this website, we display a consent banner through which you decide which non-essential cookies and services to allow. “Reject” and “Accept” are presented as equally prominent options on the first level. Your selection is stored and logged so that we can demonstrate consent pursuant to Art. 7(1) GDPR.

You can change or withdraw your selection at any time via the “Cookie Settings” link in the footer of this website.

We use the consent management tool Enzuzo for consent management. The provider is Enzuzo, based in Waterloo, Ontario, Canada.

In particular, the following data is processed: consent status and timestamp, a consent ID, truncated IP address, device and browser information, and details of changes to your selection. This information is only transmitted when you make or change a selection or close the banner. The banner itself is loaded from the provider's servers when the page is accessed; your IP address is transmitted in the process. This is necessary so that we can obtain and document your consent in the first place.

The legal basis is Art. 6(1)(c) GDPR (fulfilling the documentation obligation under Art. 7(1) GDPR) and Art. 6(1)(f) GDPR (legitimate interest in lawful and user-friendly consent management). Storing your selection on your device is technically necessary pursuant to § 25(2) no. 2 TDDDG.

An adequacy decision by the European Commission exists for Canada for organizations subject to the Canadian PIPEDA; the transfer to Enzuzo is therefore permissible under Art. 45 GDPR. However, Enzuzo does not process the data only in Canada: according to the data processing agreement, it is also processed in the USA, including by the subprocessors Amazon Web Services (hosting), Cloudflare (content delivery network), and Google (Google Cloud). These companies are certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision by the European Commission also exists (Art. 45 GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Enzuzo. Further information: https://www.enzuzo.com/privacy-policy and https://www.enzuzo.com/data-processing-agreement

We retain proof of consent for the duration of the documentation obligation and beyond, until any applicable limitation periods expire, for no longer than three years after withdrawal or the last change to your selection.

4. Processing When You Visit This Website

4.1 Hosting by Webflow

This website is hosted by Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Webflow provides the infrastructure, computing and storage capacity, and a content delivery network (CDN) for delivering the page content. For delivery, Webflow uses its own infrastructure as well as the CDN services of Amazon Web Services and Fastly, which are engaged as Webflow's subprocessors.

When you access the website, all data transmitted by your browser or entered into our forms is processed — in particular your IP address.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and high-performance provision of our website. We have entered into a data processing agreement with Webflow pursuant to Art. 28 GDPR.

Since Webflow is based in the USA, processing may occur there. Webflow, Inc. is certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses of the EU Commission agreed in the data processing agreement also apply. Further information: https://webflow.com/legal/privacy

4.2 Server Log Files

Each time this website is accessed, access data is automatically recorded in what are known as server log files. This includes, in particular:

• the page or file accessed
• date and time of access
• amount of data transferred and notification of successful retrieval
• browser type and version
• operating system used
• referrer URL (the previously visited page)
• IP address and requesting provider

We process this data to technically enable delivery of the website, ensure system stability and load management, and defend against attacks (such as DDoS attacks). The legal basis is Art. 6(1)(f) GDPR. We do not merge this data with other data sources. Log files are deleted after seven days unless a security-related analysis is required.

4.3 Fonts and Embedded Content

The Poppins font used on this website is hosted locally and delivered via our hosting provider Webflow's infrastructure. No connection to third-party servers — in particular Google Fonts — is made in the process.

Simply visiting our pages does not load any content from third-party servers other than the consent banner (section 3.2). The spam protection for forms is only loaded when you use a form (section 4.4). Analytics and advertising services are only loaded after your consent (sections 7 and 8), and embedded YouTube videos only after you click them (section 4.5). Your newsletter sign-up is only transmitted to Brevo when you submit the form (section 6.2).

4.4 Spam Protection for Forms (Cloudflare Turnstile)

To protect our forms from automated submissions and misuse, our hosting provider Webflow uses the Turnstile service. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and for users in the EEA, Cloudflare Germany GmbH, Rosental 7, 80331 Munich.

Turnstile uses technical characteristics of your browser to check whether a request comes from a human or an automated program. In particular, this processes your IP address, browser and operating system information, language settings, and interaction patterns. The service is only loaded when you use a form, for example when you click into a field of the contact form; simply visiting our pages does not establish a connection to Cloudflare. Turnstile is not used for the newsletter sign-up. The service does not use cookies or behavioral profiles.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms against spam and automated misuse, as well as the security of our systems. Access to your device is technically necessary for this protective function and is therefore exempt from consent under § 25(2) no. 2 TDDDG.

A transfer to the USA cannot be ruled out. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses of the EU Commission also apply. Further information: https://www.cloudflare.com/de-de/privacypolicy/

4.5 Embedded YouTube Videos

On certain pages, in particular our tutorials, we embed videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are not loaded automatically. At first, you only see a preview image delivered from our own server; no connection to YouTube is made when the page is accessed. Only when you click the video is it loaded in privacy-enhanced mode via youtube-nocookie.com and a connection to YouTube's servers established. In the process, in particular your IP address, device and browser information, the referring page, and your interactions with the video are transmitted to YouTube, and YouTube may store cookies or comparable technologies on your device. If you are signed in to your Google account, YouTube may associate the view with your account.

The legal basis is the consent you give by clicking, pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG; we inform you of this directly at the video. Google itself is responsible for processing after the video has been loaded.

A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses of the EU Commission also apply. Further information: https://policies.google.com/privacy

5. Contacting Us and Forms

5.1 Contact Form, Email, and Phone

If you contact us via a form on this website, by email, or by phone, we process the data you provide in order to handle and respond to your inquiry. This includes master data, contact data, and content data, as well as the technical connection data of the sending process.

In the contact form, all fields not explicitly marked “optional” are required; without this information, we cannot process your request. Fields marked as optional are voluntary.

The legal basis is Art. 6(1)(b) GDPR, insofar as your inquiry is directed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

We delete your inquiry once it has been fully processed and no statutory retention obligations apply. We delete inquiries not related to a contract after twelve months at the latest. Forms on this website are technically processed via Webflow (see section 4.1); the form entries are stored there and delivered to us by email.

5.2 Customer Management with monday.com

We manage prospect and customer data in our CRM system monday.com. The provider is monday.com Ltd., 6 Yitzhak Sadeh St., Tel Aviv 6777506, Israel.

Entries in the forms on this website are not transferred to monday.com automatically. We only manually transfer information from inquiries into our CRM if it results in a business relationship or ongoing contact. If you register for our software, we transfer information from your registration (such as contact and company details and the time of registration) into our CRM, together with information on the origin of the registration (campaign parameters, ad ID, platform, and landing page; see section 9.1). We do not transfer Meta's click ID (fbclid) into our CRM. This includes master data, contact data, where applicable the content of your inquiry, and the time and source of contact. The purpose is to document the history of contact, to manage prospects and customers, and to evaluate which campaigns lead to registrations.

The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries, and otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient and traceable management of customers and prospects).

A data processing agreement pursuant to Art. 28 GDPR is in place with monday.com. An adequacy decision by the European Commission exists for Israel, so the transfer is permissible under Art. 45 GDPR; the standard contractual clauses agreed in the data processing agreement also apply. Further information: https://monday.com/l/privacy/privacy-policy/

We delete data of prospects with whom no contract is concluded after 24 months from the last contact at the latest.

5.3 Webinars with Microsoft Teams

For our free webinars, we use the webinar feature of Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Its parent company is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

Registration. Registration does not take place on this website but on a registration page provided by Microsoft at events.teams.microsoft.com. Our website merely links to it; simply visiting our pages does not transmit any data to Microsoft. Only when you follow the link does Microsoft process your connection data (in particular your IP address and device and browser information) and may set its own cookies on the registration page. Microsoft's privacy information applies in addition.

Data processed. When you register, we process the data you provide, in particular your first and last name and email address, and, where applicable, your company and any further voluntary information in the registration form. On our behalf, Microsoft sends the registration confirmation, the access link, and event reminders by email. When you attend, attendance data is also processed (display name, time of joining and leaving, duration of attendance), as well as your contributions in chat and Q&A and your video and audio if you turn on your camera or microphone.

Recording. If we record a webinar, we will expressly point this out before it begins. As a rule, the presentation and the contributions of the speakers are recorded. If you do not wish to appear in the recording, keep your camera and microphone turned off and refrain from contributing in chat and Q&A. The legal basis for the recording is Art. 6(1)(f) GDPR; our legitimate interest lies in making the webinar content available afterwards.

Purpose and legal basis. We process this data to organize and hold the webinar, to send you access details and information about the event, and to keep track of attendance. The legal basis is Art. 6(1)(b) GDPR (holding the event following your registration). Insofar as we transfer registration and attendance data into our CRM monday.com (see section 5.2), this is based on Art. 6(1)(f) GDPR; our legitimate interest lies in the traceable management of prospects. You will only receive our newsletter if you have separately consented to it (see section 6).

Data processing agreement and third country. A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft (Microsoft Products and Services Data Protection Addendum). A transfer to the USA cannot be ruled out. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses of the EU Commission also apply. Further information: https://privacy.microsoft.com/en-us/privacystatement

Retention period. We delete registration and attendance data once it is no longer required for holding and following up on the webinar, and at the latest twelve months after the event. For data we have transferred into our CRM, the deletion period set out in section 5.2 applies.

6. Newsletter via Brevo

6.1 Content and Sign-Up

With your consent, we send you our newsletter containing information about our services, product updates, events, and offers relating to AI-powered social media management.

Your email address is all we need for sign-up; we do not ask for any further information.

Sign-up uses the double opt-in procedure: after you sign up, you receive an email with a confirmation link. We only add you to the mailing list after you confirm. This ensures that no one signs up using someone else's email address.

To document your consent, we log the time of sign-up, the time of confirmation, and the IP address used. The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 7(2) no. 3 UWG (German law), and for logging, our legitimate interest in demonstrating consent pursuant to Art. 6(1)(f) GDPR.

6.2 Delivery Provider Brevo and Embedding of the Sign-Up Form

We use the Brevo platform to send the newsletter. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, a subsidiary of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France.

The sign-up form in the footer area of our website is part of our own website; no connection to Brevo is made when a page is loaded. Only when you submit the form are your email address, your consent, and the page language transmitted directly to Brevo; for technical reasons, Brevo also receives your IP address in the process. The entries are not stored by our hosting provider Webflow. Brevo then sends the confirmation email for the double opt-in procedure. The legal basis for the transmission is your consent pursuant to Art. 6(1)(a) GDPR, which you give by submitting the form.

On our behalf, Brevo processes your email address, the sign-up and confirmation logs, and the technical delivery data. Processing takes place on servers within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with Brevo. The legal basis for using a delivery service provider is Art. 6(1)(f) GDPR (legitimate interest in a secure and efficient delivery system). Further information: https://www.brevo.com/de/legal/privacypolicy/

6.3 Performance Measurement

Our newsletters contain what is known as a tracking pixel as well as personalized links. This allows us to see whether and when an email was opened and which links were clicked. We associate this information with your email address and store it in a usage profile in order to tailor the newsletter to our recipients' interests.

Performance measurement is part of your consent; the legal basis is Art. 6(1)(a) GDPR. A separate objection to performance measurement is not technically possible — this requires unsubscribing from the newsletter.

6.4 Unsubscribing and Deletion

You can unsubscribe from the newsletter at any time and withdraw your consent with effect for the future. Use the unsubscribe link at the end of each newsletter email, or send us an informal message at info@viralspoon.de.

After you unsubscribe, we delete your data from the newsletter distribution list. We may keep your email address on a suppression list for up to three years in order to demonstrate previously given consent and to prevent renewed unwanted mailings. The legal basis is Art. 6(1)(f) GDPR.

7. Google Tag Manager

To manage the analytics and advertising services described below, we use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a management tool that itself does not evaluate any personal data and does not set cookies for analytics or advertising purposes. It serves to centrally manage the integrated services.

Google Tag Manager is only loaded on this website after you have given consent via our consent banner. As long as you have not consented or have declined, it is not loaded and no connection to Google's servers is made.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time via “Cookie Settings” in the footer. Further information on data protection at Google: https://policies.google.com/privacy

8. Traffic Measurement and Advertising

8.1 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). For users outside the EEA, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is responsible.

Purpose. Google Analytics 4 helps us understand how our website is used — which pages are viewed, which channels bring visitors to us, and how our content and campaigns are performing. We use this to improve our offering.

Data processed. Google Analytics 4 uses cookies and comparable technologies and processes, in particular: a randomly generated user and session identifier, pages viewed and events, time and duration of use, referrer URL and campaign parameters, approximate location (derived from the IP address), device, browser, and operating system information, and language setting.

Events tracked. In addition to page views, we track the following interactions: submitting the contact form, requesting a demo, signing up for the newsletter, clicking to register for a webinar, clicking to sign up for our software, clicks on calls to action, and visits to our pricing page.

IP addresses. In Google Analytics 4, IP addresses are used solely to derive approximate location data and are not stored permanently. IP addresses of users from the EEA are shortened or discarded before storage. No merging with other data stored by us takes place.

Legal basis. This service is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without your consent, Google Analytics is not loaded and no data is transmitted to Google — not even anonymized measurement signals. You give consent via our consent banner and can withdraw it at any time with effect for the future via “Cookie Settings” in the footer.

Data processing agreement and third country. A data processing agreement pursuant to Art. 28 GDPR is in place with Google. A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses of the EU Commission also apply.

Retention period. Data collected at the user and event level is automatically deleted after two months. Aggregated reporting data is not affected by this.

Objection. You can additionally prevent data collection by installing the browser add-on for disabling Google Analytics: https://tools.google.com/dlpage/gaoptout. Further information on data protection at Google: https://policies.google.com/privacy

8.2 Google Ads — Conversion Measurement and Remarketing

Insofar as we place ads via Google Ads, we use its conversion measurement and remarketing features. Google Ads is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Purpose. We want to determine whether an ad led you to take one of the following actions on our website (conversion measurement): submitting the contact form, requesting a demo, signing up for the newsletter, clicking to register for a webinar, or clicking to sign up for our software. We can also show ads again to visitors of our website (remarketing); for this purpose, you are kept on our remarketing lists for no more than 30 days. We use this to manage our advertising spend.

Data processed. Google Ads uses cookies and comparable technologies — in particular the _gcl_au cookie for attributing ad clicks (retention period 90 days) and the _gcl_ls entry in your browser's local storage (90 days) — and processes a pseudonymous identifier, the page visited, the time and type of interaction, campaign parameters, device and browser information, and the IP address. If you are signed in to a Google account, Google may associate this information with your account.

Legal basis. This service is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google Ads is only loaded via Google Tag Manager after you have consented to marketing cookies; without this consent, no cookies are set and no data is transmitted to Google for Google Ads. You can withdraw your consent at any time with effect for the future via “Cookie Settings” in the footer.

Third country. A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses of the EU Commission also apply.

Ad settings. Independently of our website, you can disable personalized advertising at Google: https://myadcenter.google.com

8.3 Meta Pixel and Conversions API

We place ads on Facebook and Instagram. To measure and optimize these ads, we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

Purpose. We want to determine whether an ad on Facebook or Instagram led you to visit our website, view content, or sign up for our software (conversion measurement). We can also show ads again to visitors of our website (Custom Audiences) and have Meta optimize the delivery of our ads.

Meta Pixel. The Meta Pixel is only loaded via Google Tag Manager after you have consented to marketing cookies. It sets the _fbp cookie (pseudonymous browser ID, retention period 90 days) and, if you come to us via an ad, the _fbc cookie (click ID, 90 days). It also creates the entries multiFbc (click ID) as well as lastExternalReferrer and lastExternalReferrerTime (most recent referring website and time) in your browser's local storage. In particular, page views, viewing of certain content, and clicks to sign up for our software are recorded, each with the URL accessed, timestamp, IP address, device and browser information, and the pseudonymous ID. If you are signed in to Facebook or Instagram, Meta may associate this information with your account.

Conversions API. If you have separately consented to the transfer to Meta when registering for our software, we additionally report the registration after you confirm your email address, as well as the first purchase of a paid subscription (with amount and currency), directly from our servers to Meta. This includes the timestamp, the ad click ID (fbc, derived from the fbclid), the pseudonymous browser ID (fbp), your email address and an internal user ID in hashed, i.e. pseudonymized, form, as well as your IP address and browser information at the time of registration. We do not transmit campaign parameters to Meta. Meta matches this information against its own user data in order to attribute the registration or purchase to an ad.

Joint controllership. We and Meta are joint controllers for the collection of the data and its transmission to Meta (Art. 26 GDPR). We have concluded an agreement with Meta for this purpose (Controller Addendum: https://www.facebook.com/legal/controller_addendum). It stipulates that we inform you about the processing and that Meta is responsible for fulfilling your rights with regard to the data stored by Meta. However, you can also exercise your rights against us. Meta is solely responsible for any further processing by Meta. Further information: https://www.facebook.com/privacy/policy/

Legal basis. This service is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without your consent, the Meta Pixel is not loaded and no connection to Meta is made. For the Conversions API, we obtain your consent separately during registration; without this consent, we do not transmit any data to Meta. You can withdraw your consent at any time with effect for the future: for the Meta Pixel via “Cookie Settings” in the footer, in which case we delete the _fbp and _fbc cookies and the local storage entries mentioned above, and for the Conversions API informally by email to info@viralspoon.de.

Third country. A transfer to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA, cannot be ruled out. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; the standard contractual clauses of the EU Commission also apply.

Ad settings. Independently of our website, you can control in your Facebook or Instagram account which ads are shown to you and whether Meta uses information from other websites for this purpose: https://accountscenter.facebook.com/ad_preferences

9. Using the ViralSpoon Software

A separate privacy policy applies to the use of our software. It is provided to you during registration and is available at any time within the application. There you will find details on registration and customer accounts, payment processing, AI-powered features, the service providers we use, retention periods, and your rights. Apart from that, this privacy policy applies exclusively to this website. An exception applies to the following processing because it begins on this website:

9.1 Registration and Customer Account

Creating a user account is required to use our software. This involves processing master, contact, contract, and usage data, as well as the content you and your users enter. The purpose is to provide the contractually agreed services, manage user accounts, and handle billing. The legal basis is Art. 6(1)(b) GDPR.

Where we process personal data on your behalf, this occurs on the basis of the data processing agreement pursuant to Art. 28 GDPR, which applies once the contract takes effect.

9.2 Payment Processing

Payments are processed exclusively within our software, not via this website. The payment data you enter during checkout is processed and stored solely by the respective payment service provider; we do not receive complete account or credit card details, only information confirming or declining the payment. The legal basis is Art. 6(1)(b) GDPR. Details on the payment service providers used can be found in the privacy notices within the application.

9.3 AI-Powered Features

A core part of our software is AI-powered features for planning, creating, and publishing social media content. For this, we rely on language and image models from external providers. Content processed in this way is not used to train these providers' models. Details, including the providers used, the legal bases, and third-country safeguards, can be found in the privacy notices within the application.

9.1 Attributing Registrations to Campaigns

If you come to our website via an ad or a campaign link, the URL often contains campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id), an ad ID (vs_ad_id, vs_platform), or a Meta click ID (fbclid). If you then click a link to our software, we append the campaign parameters, the ad ID, and the path of the landing page (vs_lp) to the link. We only pass on Meta's click ID and the time of the ad click (vs_fbclid_ts) if you have consented to marketing cookies. This allows us to attribute a later registration to the campaign through which you came to us.

Without consent to marketing cookies, we do not store anything on your device for this purpose; only the campaign parameters and the ad ID of the URL currently being accessed are passed on when you click, not Meta's click ID. With your consent, we additionally remember the most recently used campaign in your browser's local storage (“vs_attribution”, for no more than 90 days) and the first page of your visit in session storage (“vs_landingpage”, until the tab is closed), so that attribution also works across multiple page views or on a later visit. If you withdraw your consent, both entries are deleted the next time a page is loaded. We do not pass on any parameters in links for existing customers to log in.

In our software, we store the campaign parameters, the ad ID, the platform, and the landing page together with your user account and transfer them into our CRM (section 5.2). We only receive Meta's click ID (fbclid) and the time of the ad click with your consent to marketing cookies. We only store them if you have additionally consented to the transfer to Meta when registering; only then are they transmitted to Meta for conversion measurement (section 8.3). Without this consent, we discard them. We store the campaign data for as long as your user account exists; if no contract is concluded, we delete it no later than 24 months after the last contact.

The legal basis for storage on your device and for passing on Meta's click ID is your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR. We base the passing of the other parameters to our software without storage on your device on our legitimate interest in evaluating the success of our advertising (Art. 6(1)(f) GDPR). You can object to this at any time in accordance with section 11.

10. Our Profiles on Social Networks

We maintain profiles on social networks to communicate with prospects, customers, and job applicants and to inform them about our services. When you visit these profiles, your data is processed by the respective platform operator, often outside the EU and for the operator's own purposes (such as usage profiles and advertising). We have no determining influence over this processing.

Where we jointly determine the purposes and means of processing together with the operator — for example, for page insights — joint controllership exists pursuant to Art. 26 GDPR on the basis of the respective provider's agreement. You can exercise your data subject rights both against us and against the respective operator; for information about data stored there, the operator is the more effective point of contact.

The legal basis for our presence is Art. 6(1)(f) GDPR (legitimate interest in public relations and communication). We are represented on:

• Instagram — Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Privacy policy: https://privacycenter.instagram.com/policy — Key points of the joint controllership agreement: https://www.facebook.com/legal/terms/page_controller_addendum
• LinkedIn — LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy — Key points of the joint controllership agreement: https://legal.linkedin.com/pages-joint-controller-addendum
• YouTube — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy

Links to these profiles on our website are simple hyperlinks; merely visiting our website does not transmit any data to these networks.

11. Right to Object under Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Where your data is processed for direct marketing purposes, you have the right to object at any time; this also applies to related profiling. If you object, your data will no longer be processed for direct marketing purposes.

An informal message to info@viralspoon.de is sufficient to object.

12. Your Further Rights as a Data Subject

If personal data concerning you is processed, you have the following rights. An informal message to the contact details given in section 1 is sufficient to exercise them.

12.1 Right of Access (Art. 15 GDPR)

You can request confirmation as to whether we process personal data concerning you. If so, you have a right to access this data and to the following information:

• the purposes of processing,
• the categories of data processed,
• the recipients or categories of recipients,
• the planned retention period or the criteria for determining it,
• the existence of a right to rectification, erasure, restriction of processing, or objection,
• the existence of a right to lodge a complaint with a supervisory authority,
• all available information on the origin of the data, if it was not collected from you,
• the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR, and meaningful information about the logic involved and the intended effects,
• the appropriate safeguards pursuant to Art. 46 GDPR, if data is transferred to a third country or an international organization.

12.2 Right to Rectification (Art. 16 GDPR)

You have the right to have inaccurate personal data corrected without undue delay and to have incomplete personal data completed.

12.3 Right to Restriction of Processing (Art. 18 GDPR)

You can request the restriction of processing if you dispute the accuracy of the data (for the duration of the verification), if the processing is unlawful and you request restriction instead of erasure, if we no longer need the data but you need it to assert, exercise, or defend legal claims, or if you have objected pursuant to Art. 21(1) GDPR and it is not yet clear whether our grounds override yours.

Restricted data may — apart from being stored — only be processed with your consent, to assert legal claims, to protect the rights of others, or for reasons of important public interest. We will inform you before the restriction is lifted.

12.4 Right to Erasure (Art. 17 GDPR)

You can request the immediate erasure of your data if one of the following grounds applies:

• the data is no longer necessary for the purposes for which it was collected,
• you withdraw your consent and there is no other legal basis,
• you object pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds, or you object pursuant to Art. 21(2) GDPR,
• the data was processed unlawfully,
• erasure is required to comply with a legal obligation,
• the data was collected in relation to information society services offered pursuant to Art. 8(1) GDPR.

If we have made the data public, we take reasonable measures, taking into account available technology and the cost of implementation, to inform other controllers of your erasure request.

The right to erasure does not apply insofar as processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving, research, or statistical purposes in the public interest, or for the assertion, exercise, or defense of legal claims.

12.5 Right to Notification (Art. 19 GDPR)

If you have requested rectification, erasure, or restriction of processing, we will notify all recipients to whom your data was disclosed — unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.

12.6 Right to Data Portability (Art. 20 GDPR)

You have the right to receive the data concerning you that you provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller, provided the processing is based on consent or a contract and is carried out by automated means. Where technically feasible, you may request direct transmission. This must not adversely affect the rights and freedoms of others.

12.7 Right to Withdraw Consent (Art. 7(3) GDPR)

You can withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal remains unaffected. Withdrawal can be made informally, for example by email. You can withdraw consent to cookies and services fastest via the “Cookie Settings” link in the footer of this website.

12.8 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority responsible for us is:

Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit)
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
https://datenschutz.hessen.de

13. Automated Decision-Making

We do not use decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

14. Obligation to Provide Data

Providing personal data is neither legally nor contractually required. However, we need certain information to conclude a contract, respond to an inquiry, or send you our newsletter. Without this information, we cannot provide the respective service.

15. Changes to This Privacy Policy

We update this privacy policy when the legal situation, our services, or the services we use change. The version published on this page always applies. Please check back regularly to stay informed of the current version.