Datenschutzerklärung

This Privacy Policy explains how personal data is processed when you use the public corporate and marketing website www.yourbubble.app or contact The Bubble GmbH through the contact options provided on the website.It applies in particular to publicly accessible corporate, information, contact and careers pages. It does not apply to app.yourbubble.app, Bubble Studio, customer accounts, customer dashboards, published Bubble experiences, competitions, rewards, coupons, wallet passes or customer-specific campaigns. Separate privacy notices apply to those services.

The controller within the meaning of the General Data Protection Regulation is:The Bubble GmbH
Königstraße 40
70173 Stuttgart
GermanyRepresented by the Managing Directors:
Kai Noebel and Atacan AtasayPhone: +49 711 93965277
Email: kai@yourbubble.appWebsite: www.yourbubble.app

Privacy-related requests may be addressed to:Kai Noebel
The Bubble GmbH
Königstraße 40
70173 Stuttgart
Germany
Email: kai@yourbubble.app
Phone: +49 711 93965277No Data Protection Officer has currently been appointed.

We process personal data only where this is necessary to provide a secure and functional website, respond to requests, take steps prior to entering into a contract, perform a contract, comply with legal obligations or pursue legitimate interests, or where valid consent has been given.Depending on the processing activity, the following legal bases may apply in particular:• Article 6(1)(a) GDPR where you have given voluntary consent;• Article 6(1)(b) GDPR where processing is necessary for a contract or pre-contractual measures;• Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation;• Article 6(1)(f) GDPR where processing is necessary for our legitimate interests or those of a third party and such interests are not overridden by your interests, rights or freedoms.Where we rely on legitimate interests, the relevant interest is explained in the applicable section below.

When you access our website, the systems used to provide it may automatically process information transmitted by your browser or device. This may include in particular:• IP address;• date and time of access;• page or file requested;• referring page or referrer URL;• browser type and version;• operating system;• language setting;• device and display characteristics;• amount of data transferred;• HTTP status code;• technical error, security and diagnostic information.This processing is necessary to deliver the website, ensure its stability and security, identify technical errors, prevent abusive or automated access and maintain the functionality of the technical infrastructure.The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, stable and efficient operation of our website, protection against attacks and technical troubleshooting.Log data is deleted or anonymised when it is no longer required for these purposes. In the event of a specific security incident, suspected misuse or the establishment, exercise or defence of legal claims, relevant data may be retained for a longer period to the extent necessary.

Our public website is created and delivered using Framer.Provider:
Framer B.V.
Rozengracht 207B
1016 LZ Amsterdam
The NetherlandsIn connection with website delivery, Framer may process technical access, communications, security and diagnostic information. Where Framer processes personal data on our behalf, such processing is governed by a data processing agreement.We use Framer to provide the website securely, efficiently and professionally. The legal basis on our side is Article 6(1)(f) GDPR. Our legitimate interests are reliable delivery, technical security, scalability and maintainability of our website.Where subcontractors or systems outside the European Union or European Economic Area are involved, the information in the section "International data transfers" also applies.

We use the analytics function integrated into Framer in order to understand the use of our website in aggregated form and to improve our technical and editorial content.According to Framer, its integrated analytics does not use cookies and does not generate persistent visitor identifiers. To calculate daily visitor numbers, technical characteristics are processed together with a value that changes daily and are converted into an identifier that cannot be reused on a lasting basis. The resulting information may include page views, daily visitor numbers, pages viewed, referral sources and technical performance values.We do not receive cross-service visitor profiles from this function and do not use it to identify individuals across websites or days.The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are audience measurement, the detection of technical issues and needs-based optimisation of the website.This description applies only for as long as Framer’s integrated analytics is used without additional analytics, advertising or tracking services. If other services are added, this Privacy Policy will be updated before they are activated and consent will be obtained where required.

If you use our contact form, we process the information you provide and the data generated in connection with the transmission. This may include in particular:• name;• email address;• company and job function, where requested;• telephone number, where provided voluntarily;• content and time of the message;• files or other information submitted by you;• technical information required for transmission and abuse prevention.We process this information to review and answer your request, ask follow-up questions, arrange a meeting, prepare a proposal or initiate or perform a business relationship requested by you.Where your request concerns entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR. For other business or general enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is efficient, organised and traceable communication.Under the intended initial configuration, the form is a native Framer form and sends the message to kai@yourbubble.app. Additional recipients, webhooks, spreadsheets, automation services or CRM systems are not used unless expressly identified in an updated version of this Privacy Policy.The integrated spam-protection function may be used to protect the form against automated or abusive submissions. Technical information relating to the transmission and interaction with the form may be processed to the extent necessary to identify automated submissions. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting our communication channels and systems against spam, malicious messages and automated misuse.

If you contact us by email, telephone or another business communication channel, we process the contact details, communication content, timestamps and any additional information you provide that is required to deal with your request.The processing is carried out in order to answer your request, document the communication and, where relevant, initiate or perform a business relationship.The legal basis is Article 6(1)(b) GDPR where the communication serves pre-contractual or contractual purposes. Otherwise, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is efficient and traceable business communication.

Where a meeting is arranged directly by email or telephone, we process the information required for this purpose, such as name, contact details, company, requested time, subject of the meeting and attendees.The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual meetings and Article 6(1)(f) GDPR in other cases.An external scheduling service is not embedded without blocking under the intended initial configuration. If such a service is introduced, the provider, processing activities, legal basis, retention and any international transfer will be added to this Privacy Policy before activation.

If you apply for a vacancy published on our website or submit an application by email or through another expressly identified channel, we process the application information you provide. This may include in particular:• name and contact details;• curriculum vitae;• cover letter;• certificates and proof of qualifications;• employment history;• information about skills, availability and salary expectations;• communications and interview information;• other information provided voluntarily.Processing is carried out in order to decide whether to establish an employment relationship. The legal basis is Section 26(1) of the German Federal Data Protection Act in conjunction with Article 6(1)(b) GDPR. Where consent is obtained for additional processing, the legal basis is Article 6(1)(a) GDPR. Where processing is necessary for the establishment, exercise or defence of legal claims, it may be based on Article 6(1)(f) GDPR.Special categories of personal data should only be submitted where they are necessary for the application process. Where such information is provided voluntarily, processing is subject to the applicable legal requirements.Application data is deleted after the process has been completed once it is no longer required and no legal retention obligation or legitimate reason requires further storage. Inclusion in a candidate pool for a longer period takes place only on the basis of separate voluntary consent.

No active newsletter is offered through the website under the intended initial configuration. Visible newsletter fields must be removed or disabled before publication.If a newsletter is introduced in the future, the specific delivery provider, double opt-in procedure, consent logging, unsubscribe function, retention period and any data transfers will be described before activation. The newsletter will only be sent on an appropriate legal basis. Subscription will not be a condition for contacting us.

Our website may contain links to external websites or social-media profiles. Displaying a normal link does not in itself automatically transmit data to the linked provider. When you choose to follow the link, you leave our website and the privacy information of the external provider applies.Under the intended initial configuration, we do not use automatically loaded social-media feeds, like buttons or comparable plugins that transmit data to social networks when our website is loaded.

Under the intended initial configuration, no consent-based external videos, maps, calendars, chat services or other third-party content is loaded without prior blocking.If such content is introduced in the future, it will only be activated after the specific processing has been assessed. Where prior consent is required, the content will remain technically blocked until consent has been given. This Privacy Policy and the Cookies & Technologies notice will be updated before activation.Fonts should, where possible, be served locally or through the website infrastructure. Externally loaded font services may only be introduced after a documented review.

Where we communicate with prospects, customers, partners, suppliers or other business contacts, we process the master, contact, contractual, proposal, project and communication information required for this purpose.Processing is carried out to initiate and perform contractual relationships, coordinate projects, comply with legal obligations and maintain existing business contacts. Depending on the circumstances, the legal bases are Article 6(1)(b), (c) or (f) GDPR.Contact information is used for electronic advertising only where a sufficient legal basis exists. You may object to processing for direct marketing at any time.

Within The Bubble GmbH, access to personal data is limited to individuals who require it for the relevant task.Personal data may also be disclosed to the following categories of recipients to the extent necessary:• hosting, website, IT and security providers;• email and communications providers;• professional advisers, in particular legal and tax advisers;• individuals involved in recruitment and, where applicable, recruitment providers engaged by us;• public authorities, courts or other public bodies where disclosure is legally required;• other recipients where you have given consent or another legal basis permits disclosure.Providers that process personal data on our behalf are contractually bound in accordance with the applicable legal requirements. Data is disclosed only to the extent required for the relevant purpose.

Some technical providers or their subprocessors may be established outside the European Union or European Economic Area or may process data there.Such a transfer takes place only where the applicable legal requirements are met. The transfer mechanism may include in particular:• an adequacy decision of the European Commission;• valid participation in a data-protection framework recognised by the European Commission;• Standard Contractual Clauses adopted by the European Commission;• supplementary technical and organisational safeguards;• an exception provided by law.We assess the transfer mechanism used for the relevant provider and processing activity. Where provided by law, you may request further information about the safeguards by using the contact details above.

We retain personal data only for as long as it is required for the relevant purpose or applicable statutory retention and evidence obligations.In particular, the following principles apply:• technical log data is deleted or anonymised when it is no longer required for operation, security and troubleshooting;• contact and enquiry data is deleted once the enquiry has been conclusively dealt with, unless a business relationship, statutory obligation or legitimate reason requires further retention;• contractual and business records are retained for the duration of the business relationship and subsequently in accordance with applicable commercial, tax and civil-law retention and limitation periods;• application data is deleted after completion of the recruitment process once no legal obligation or legitimate reason requires further storage;• evidence of consent is retained for as long as this is necessary to demonstrate lawful processing;• data relating to legal claims or security incidents may be retained until the matter has been resolved and applicable limitation periods have expired.Where several periods apply, deletion takes place after expiry of the longest required period. Processing may be restricted instead of deletion where deletion is prohibited by a legal obligation.

You are generally not required to provide personal data to us. However, certain information may be necessary so that we can respond to your request, arrange a requested meeting, take pre-contractual measures or assess an application.Without the required information, we may not be able to deal with the relevant request or provide the requested service. Voluntary fields are treated as voluntary.

The public website does not use solely automated decision-making that produces legal effects concerning you or similarly significantly affects you.We do not use the public website to create personal profiles for automated individual decisions. Technical systems may automatically assess access or form submissions for spam and security purposes. Such assessments protect the website and communication channels and do not constitute a legally significant automated decision about an individual.

We apply appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access, unauthorised disclosure and other unlawful processing.Such measures may include in particular:• encrypted transmission;• role-based and need-to-know access controls;• secure authentication;• regular updates of systems used;• protection against automated and abusive form submissions;• logging of security-relevant events;• backup and recovery procedures;• review and contractual commitment of providers;• procedures for detecting and handling security incidents.Absolute protection against every risk associated with electronic data processing cannot be guaranteed.

Subject to the applicable legal requirements, you have in particular the right to:• request access to personal data processed by us;• request correction of inaccurate and completion of incomplete data;• request erasure of your data;• request restriction of processing;• receive certain data provided by you in a structured, commonly used and machine-readable format and request its transmission;• object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR;• object to processing for direct marketing at any time;• withdraw consent at any time with effect for the future;• lodge a complaint with a data protection supervisory authority.To exercise your rights, contact Kai Noebel at kai@yourbubble.app or use the postal address above. We may request additional information where this is necessary to verify your identity and prevent unauthorised disclosure of personal data.

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.We will then no longer process the relevant data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims.Where personal data is processed for direct marketing, you may object at any time without having to give reasons. The data will then no longer be used for direct marketing.

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.Withdrawal may be made using the method stated in the relevant consent wording or by emailing kai@yourbubble.app.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.The supervisory authority generally responsible for The Bubble GmbH is:The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
GermanyPhone: +49 711 615541-0

We do not sell personal data collected through the public website. Data is disclosed to third parties only where this is necessary for the relevant purpose, legally required or permitted on another legal basis.Contact enquiries are not automatically passed to advertising partners, sponsors or other external businesses.

We may update this Privacy Policy where legal requirements, our website, forms, technical providers or processing activities change.The version published on this website applies. The revision date will be updated where material changes are made. Where renewed consent is required, an existing consent will not be replaced merely by changing this Privacy Policy.