1) Who we are (Controller) Allbound Solutions GmbH Marienburger Straße 74 53340 Meckenheim, Germany Commercial Register: HRB 29584, Amtsgericht Bonn VAT ID: DE453400567 Authorized Representatives: Florian Ulrich, André Leutert, Duc Ha Email: info@outreach-autopilot.de Phone: +49 1573 4227494 For GDPR, we act as the controller for the processing described here. If you contact us about privacy, we’ll respond without undue delay. 2) What data we collect & why We process personal data you provide directly and data collected automatically when you use our site. A. Data you provide Contact & inquiry data (e.g., name, email, phone, company, role, message) when you submit forms or book meetings (e.g., via Calendly). Newsletter data (email address and proof of consent). Customer & contract data when we deliver our services. Purposes / legal bases (GDPR): Responding to inquiries and pre-contract steps (Art. 6(1)(b)), Contract performance and customer management (Art. 6(1)(b)), Legitimate interests such as efficient communication and service quality (Art. 6(1)(f)), Your consent where required (e.g., marketing emails) (Art. 6(1)(a)). B. Data collected automatically Technical usage data (IP address, device info, browser type/version, OS, referrer URL, time of request, pages visited) in server logs for security and performance (Art. 6(1)(f) GDPR – legitimate interest in operating a secure, reliable site). Cookies & similar tech for essential functionality; with your consent for analytics/marketing (see Section 5). We do not intentionally collect sensitive data (as defined by GDPR/CPRA). Please do not submit such data through our forms. 3) Where the data comes from Directly from you (forms, bookings, emails, calls). Automatically via your device/browser. From service providers acting on our behalf (e.g., analytics, hosting). We do not purchase third-party marketing lists. 4) With whom we share data (categories of recipients) We only share personal data when necessary and subject to appropriate safeguards: Hosting & infrastructure: do.de (Greenmark IT GmbH), Onepage (site builder/hosting). Consent & cookies: Onepage’s integrated consent tools. Scheduling & meetings: Calendly; Google Calendar/Meet; Zoom. Forms: Typeform and/or Google Forms (as used). CRM/communications/marketing: HubSpot CRM; WhatsApp Business (business messaging). Analytics & product improvement: Google Analytics, Hotjar, Google Optimize (where enabled via consent). Advertising & measurement (only with consent): Google Ads/Remarketing/Conversion Tracking, Google AdSense, Meta Pixel (Facebook), LinkedIn Insight Tag. Media & embeds (only when loaded): YouTube, Google Maps, Google Fonts. Storage/collaboration: Microsoft OneDrive, Google Drive. We may disclose data if required by law or to protect rights, safety, or security. We do not sell your personal information for money. For US law, some analytics/ads disclosures can be treated as “sharing” or “sales” for cross-context behavioral advertising. See Your US privacy choices below. 5) Cookies, consent, and preference management We use cookies and similar technologies: Essential (always on): security, load balancing, core functionality (e.g., session, consent log). Analytics (opt-in in EU/UK): to understand site usage and improve our site. Functional (opt-in in EU/UK): to enable embedded tools (e.g., scheduling widgets, videos). Marketing/Advertising (opt-in in EU/UK): to measure campaigns and show relevant ads. In the EU/UK, non-essential cookies only load with your consent. In the US, we present a notice and provide opt-out controls, including a “Do Not Sell or Share My Personal Information” link (footer). You can change your choices anytime via “Cookie Settings” in the footer. Blocking cookies may limit certain features. 6) Legal bases (GDPR) and TTDSG Depending on processing, we rely on: Contract / pre-contract (Art. 6(1)(b) GDPR), Consent (Art. 6(1)(a) GDPR; and §25(1) TTDSG for storing/reading on devices), Legitimate interests (Art. 6(1)(f) GDPR) — e.g., site security, performance, communication, analytics improvements (where allowed), Legal obligations (Art. 6(1)(c) GDPR) — e.g., record-keeping. You may withdraw consent at any time with future effect. 7) International transfers We operate from Germany. Some providers process data in the USA and other countries. Where required, we use appropriate safeguards such as: EU–US Data Privacy Framework (DPF) certification (if the recipient is certified), and/or Standard Contractual Clauses (SCCs) and additional measures. Details are available on request. 8) Retention We keep personal data only as long as needed for the purposes described, to comply with law (e.g., tax/commercial retention), or to establish/defend legal claims. Server logs are kept for a limited period for security and troubleshooting. Newsletter data is kept until you unsubscribe. 9) Security We use technical and organizational measures to protect personal data (including TLS/SSL). No method of transmission or storage is 100% secure. 10) Your privacy rights A. EU/EEA/UK (GDPR) You have the right to: Access, rectification, erasure, restriction, and portability, Object to processing based on legitimate interests, Withdraw consent at any time, Lodge a complaint with a supervisory authority (e.g., in Germany or your EU country of residence). B. US (incl. California CCPA/CPRA) Depending on your state, you may have the right to: Know/Access the categories and specific pieces of personal information we collected about you, Delete personal information, Correct inaccuracies, Opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising, Limit use/disclosure of sensitive personal information (we do not use SPI to infer characteristics), Non-discrimination for exercising your rights. We do not knowingly sell personal information of minors under 16. How to exercise your rights (all regions): Email us at info@outreach-autopilot.de with the subject “Privacy Request” and tell us which right you wish to exercise. We may need to verify your identity (e.g., via email confirmation or additional details). You may use an authorized agent; we may require proof of authorization and identity verification. US opt-out: Use the footer link “Do Not Sell or Share My Personal Information” or email us with “Do Not Sell or Share” in the subject. Browser Global Privacy Control (GPC) signals will be honored where legally required. 11) Children’s privacy Our services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will delete it. 12) Service-specific notes (stack you listed) Below are short descriptions of common tools we may use. Exact usage can vary over time; the cookie banner and this Policy control. Hosting & Site Builder: do.de (Greenmark IT GmbH) and Onepage GmbH host and operate our website. They process server logs and essential cookies for availability, security, and performance (legitimate interests; consent where local law requires device access). Onepage also provides consent management; your choices are stored locally and can be changed at any time. Scheduling & Meetings: Calendly (USA) for booking calls; Google Calendar/Meet and/or Zoom for meetings. Data you submit (name, email, company, time zone, message) is used to schedule and conduct the meeting. Transfers to the US use DPF and/or SCCs as applicable. Forms: Typeform (EU) and/or Google Forms to collect inquiries. Typeform/Google may set cookies (consent where required). Messaging: WhatsApp Business for fast communication with customers/partners. Content is end-to-end encrypted; metadata may be processed by WhatsApp/Meta. See WhatsApp’s privacy policy for details. We configure WhatsApp to avoid automatic address-book syncing. CRM & Marketing Automation: HubSpot CRM to manage contacts and interactions (emails, forms, site behavior where consented). Analytics & Experience: Google Analytics (incl. modeling/GA features), Hotjar (heatmaps/feedback), Google Optimize (A/B tests). These load only with your consent in regions where required. Advertising & Measurement (only with consent): Google Ads (incl. Remarketing/Conversion), Google AdSense, Meta Pixel (Facebook), LinkedIn Insight Tag for campaign measurement and retargeting. You can withdraw consent anytime and/or opt out via “Do Not Sell or Share”. Media/Embeds: YouTube, Google Maps, Google Fonts may load when you visit pages that include them. Non-essential elements only load with consent in regions where required. Storage/Collaboration: Microsoft OneDrive, Google Drive for receiving and storing files shared with us. For each provider, transfers outside the EU/EEA are protected by DPF certification and/or SCCs (as applicable). Links to their privacy information are available on their sites. 13) Payments If we process payments on our site, payment details are transmitted via encrypted connections to the respective payment service providers and are not stored by us beyond what is necessary for accounting/legal obligations. 14) Do Not Track / Global Privacy Control Some browsers offer “Do Not Track” or Global Privacy Control (GPC). Where required by law, we treat GPC signals as an opt-out of sale/sharing. 15) Changes to this Policy We may update this Policy from time to time. The latest version is posted here with the effective date. Material changes will be highlighted where appropriate. 16) How to contact us Questions or requests about this Policy or your personal data? Email: info@outreach-autopilot.de Postal address: Allbound Solutions GmbH, Marienburger Straße 74, 53340 Meckenheim, Germany