Skip to main content
Invest4Kids
Book a consultation

Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a brief overview of what happens to your personal data when you visit this website. Personal data refers to any information that can be used to personally identify you. For detailed information on data protection, please refer to our Privacy Policy listed below.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator’s contact information in the “Information on the Data Controller” section of this Privacy Policy.

How do we collect your data?

Your data is collected, in part, because you provide it to us. This may include, for example, data that you enter into a contact form.

Other data is collected automatically or with your consent when you visit the website through our IT systems. This primarily consists of technical data (e.g., internet browser, operating system, or time of page view). This data is collected automatically as soon as you access this website.

What do we use your data for?

Some of the data is collected to ensure that the website functions properly. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to obtain, free of charge, information about the source, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to the processing of your data, you may withdraw this consent at any time with future effect. In addition, you have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to file a complaint with the competent supervisory authority.

Please feel free to contact us at any time regarding this matter or any other questions you may have about data protection.

Analytics tools and third-party tools

When you visit this website, your browsing behavior may be analyzed for statistical purposes. This is primarily done using so-called analytics tools.

You can find detailed information about these analytics programs in the following privacy policy.

2. Hosting

We host our website's content with the following provider:

Vercel

The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (hereinafter “Vercel”). Vercel is a cloud platform through which our website is delivered worldwide. When you visit our website, Vercel collects various log files including your IP address in order to provide the website and ensure its security.

For details, please refer to Vercel's privacy policy: https://vercel.com/legal/privacy-policy.https://www.hetzner.com/de/rechtliches/datenschutz.

Vercel is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable, fast and secure provision of our website possible. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. The company is certified under the “EU-US Data Privacy Framework” (DPF).

Order Processing

We have entered into a Data Processing Agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Sanity (content management system)

We manage the content and media of this website with the content management system Sanity (Sanity Inc., San Francisco, USA). Content is delivered via Sanity's content delivery network; the data is processed on servers within the EU. When content and images are retrieved, your IP address is transmitted to Sanity. This is done on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in the reliable provision of our content. We have concluded a data processing agreement (DPA) with Sanity.

3. General Information and Mandatory Disclosures

Privacy Policy

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy.

When you use this website, various types of personal data are collected. Personal data is information that can be used to identify you personally. This Privacy Policy explains what data we collect and how we use it. It also explains how and for what purpose this is done.

Please note that data transmission over the Internet (e.g., when communicating via email) may be subject to security risks. It is not possible to completely protect data from access by third parties.

Information about the responsible entity

The entity responsible for data processing on this website is:

Invest4Kids GmbH, Fabrikstraße 7, 24103 Kiel

Phone: +49 123 456789
Email: info@invest4kids.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).

Retention period

Unless a more specific retention period is stated in this Privacy Policy, we will retain your personal data until the purpose of the data processing no longer applies. If you submit a valid request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the data will be deleted once these grounds no longer apply.

General Information on the Legal Basis for Data Processing on This Website

If you have consented to the processing of your data, we process your personal data on the basis of Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, provided that special categories of data as defined in Article 9(1) of the GDPR are being processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g., via device fingerprinting), data processing is additionally carried out on the basis of Section 25(1) of the German Teleservices Data Protection Act (TTDSG). Consent may be revoked at any time. If your data is necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) of the GDPR. Furthermore, we process your data if it is necessary to comply with a legal obligation on the basis of Article 6(1)(c) of the GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR. The legal bases applicable in each individual case are described in the following sections of this Privacy Policy.

Recipients of personal data

As part of our business operations, we collaborate with various external parties. In some cases, this requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is necessary for the performance of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Article 6(1)(f) of the GDPR, or if another legal basis permits the disclosure of data. When using data processors, we only transfer our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. This also applies to profiling based on these provisions. The specific legal basis on which processing is based can be found in this Privacy Policy.
If you object, we will no longer process your personal data in question unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims (objection pursuant to Art. 21(1) GDPR).

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling, insofar as it is related to such direct marketing.If you object, your personal data will no longer be used for direct marketing purposes (objection pursuant to Art. 21(2) GDPR).

Right to file a complaint with the competent supervisory authority

In the event of a breach of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place where the alleged breach occurred. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to receive data that we process automatically based on your consent or in fulfillment of a contract, either directly or through a third party, in a commonly used, machine-readable format. If you request that the data be transferred directly to another controller, this will only be done to the extent that it is technically feasible.

Access, Correction, and Deletion

In accordance with applicable legal provisions, you have the right at any time to request, free of charge, information about your stored personal data, its source and recipients, and the purpose of the data processing, as well as the right to have this data corrected or deleted, if applicable. You may contact us at any time regarding this matter or any other questions you may have about personal data.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted. You may contact us at any time to do so. The right to restriction of processing applies in the following cases:

  • If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification process, you have the right to request that the processing of your personal data be restricted.
  • If the processing of your personal data was or is unlawful, you may request that the processing be restricted instead of having the data erased.
  • If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request that the processing of your personal data be restricted instead of deleted.
  • If you have lodged an objection under Article 21(1) of the GDPR, a balancing of your interests against ours must be carried out. Until it is determined whose interests prevail, you have the right to request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, such data may—apart from storage—be processed only with your consent, or for the purpose of establishing, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State.

4. Data Collection on This Website

Cookies

Our website uses so-called “cookies.” Cookies are small data packets that do not cause any harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or your web browser automatically deletes them.

Cookies may be set by us (first-party cookies) or by third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain third-party services into websites (e.g., cookies used to process payment transactions).

Cookies serve various purposes. Many cookies are technically necessary, as certain website features would not work without them (e.g., the shopping cart feature or the display of videos). Other cookies may be used to analyze user behavior or for advertising purposes.

Cookies that are necessary for the execution of the electronic communication process, for providing certain functions you have requested (e.g., the shopping cart function), or for optimizing the website (e.g., cookies for measuring website traffic) (necessary cookies), are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically flawless and optimized provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TTDSG); consent may be revoked at any time.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in certain cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

You can find out which cookies and services are used on this website in this Privacy Policy.

Consent via our consent banner (cookie settings)

This website uses our own self-developed, self-hosted consent banner to obtain your consent to the use of cookies and similar technologies (consent management). No external consent management providers are used. On your first visit you can choose to accept all categories, allow only technically necessary cookies, or make an individual selection. No consent-requiring cookies are set and no consent-requiring services are loaded before you have given your consent.

The services are grouped into the following categories: “Necessary” (core website functions, security and storage of your cookie decision), “Functional” (e.g. Google Tag Manager, Trustindex review widgets), “Analytics” (e.g. Google Analytics 4, PostHog, Hotjar, Mouseflow, Sentry and our traffic-source detection) and “Marketing” (e.g. Meta pixel, Hyros, Taboola and embedded YouTube and Vimeo videos). Services in a category are only loaded after you have consented to that category.

Your decision is stored in a first-party cookie (“i4k_consent”) on your device for a period of 12 months. You can withdraw or adjust your consent at any time with effect for the future by clicking the “Cookie settings” link in the website footer or the cookie icon at the bottom left of the screen.

To document the consent given (Art. 7(1) GDPR) we record the time of each decision, the selected categories, the version of the consent text and a randomly generated identifier. Your IP address and browser identifier (user agent) are stored exclusively in encrypted form and are readable only by us. The consent log is stored in our content management system Sanity (Sanity Inc., San Francisco, USA); the data is processed on servers within the EU. A data processing agreement (DPA) is in place with Sanity.

The consent banner is used so that we can obtain and document the legally required consent for the use of certain technologies. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Section 25(1) of the German TDDDG.

Contact and consultation enquiries (forms)

If you send us an enquiry via one of the forms on this website (e.g. for a free consultation, a job application or the delivery of an individual calculation result), we process the data you provide (e.g. name, e-mail address, telephone number and the details you enter in the form) in order to handle your enquiry. In addition, we store context data for each enquiry, such as the page from which the enquiry was sent and — where available — information about the traffic source (UTM parameters, advertising click IDs, LeadJourney identifier) so that we can understand through which channel your enquiry came about.

The processing is based on Art. 6(1)(b) GDPR insofar as your enquiry relates to the initiation or performance of a contract, and otherwise on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if requested.

The enquiry data is stored in our content management system Sanity (data processing on servers within the EU, data processing agreement in place) and transmitted to our workflow tool Zapier (Zapier Inc., 548 Market St #62411, San Francisco, CA 94104, USA) for further processing; data transfer to the USA is based on the standard contractual clauses of the EU Commission. The data you submit remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for storing the data no longer applies; mandatory statutory provisions — in particular retention periods — remain unaffected.

5. Analytics Tools and Advertising

Google Tag Manager

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Tag Manager is a tool that allows us to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any independent analyses. It only serves to manage and deploy the tools integrated via it. However, the Google Tag Manager records your IP address, which may also be transferred to Google's parent company in the United States.

The Google Tag Manager is only loaded after you have consented to at least one consent-requiring category via our consent banner. It is used on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time.

Google Analytics

This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows website operators to analyze the behavior of website visitors. In doing so, website operators receive various usage data, such as page views, time spent on the site, operating systems used, and the user’s location. This data is aggregated into a user ID and assigned to the website visitor’s respective device.

In addition, we use Google Analytics to track your mouse and scroll movements, clicks, and other actions. Google Analytics also uses various modeling techniques to supplement the collected data and employs machine learning technologies in its data analysis.

Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google regarding the use of this website is generally transmitted to a Google server in the United States and stored there.

Use of this service is based on your consent pursuant to Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. You may withdraw your consent at any time.

Data transfers to the United States are based on the European Commission’s standard contractual clauses. For more details, please click here: https://privacy.google.com/businesses/controllerterms/mccs/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id;=a2zt000000001L5AAI&status;=Active

IP anonymization

Google Analytics IP anonymization is enabled. This means that Google will truncate your IP address within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before transmitting it to the United States. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Browser plugin

You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

For more information on how Google Analytics handles user data, please see Google's Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=de.

Mouseflow

This website uses Mouseflow, a web analytics tool provided by Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark.

Mouseflow records randomly selected individual visits (using only anonymized IP addresses). This creates a log of mouse movements, mouse clicks, and keyboard interactions with the aim of playing back individual website visits on a random basis and deriving potential improvements for the website from them. The collected data is not personally identifiable and is not shared with third parties. The storage and processing of the collected data takes place within the EU.

Use of this service is based on your consent pursuant to Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. You may withdraw your consent at any time.

If you do not wish to be tracked, you can disable tracking globally for the browser you are currently using on all websites that use Mouseflow by clicking the following link: https://mouseflow.de/opt-out/

For more information about Mouseflow's privacy and data security policies, please click here: https://mouseflow.com/privacy/.

Hotjar

This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta. Hotjar is a tool for analysing your user behaviour on this website. With Hotjar we can record, among other things, your mouse and scroll movements and clicks, and determine where you linger with the mouse. This information is used to create so-called heatmaps, which show which areas of the website visitors prefer to look at.

This service is used exclusively on the basis of your consent to the “Analytics” category pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG; you can withdraw your consent at any time via the “Cookie settings”.

Further information can be found in Hotjar's privacy policy: https://www.hotjar.com/legal/policies/privacy.

PostHog

This website uses PostHog, a web analytics service provided by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. PostHog enables us to analyse how visitors use our website (e.g. pages viewed, clicks, time spent, traffic sources) in order to improve our offering and content. For this purpose, cookies may be set and pseudonymous usage profiles may be created. To reliably recognise returning visitors, we use a pseudonymous identifier assigned server-side.

This service is used exclusively on the basis of your consent to the “Analytics” category pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG; you can withdraw your consent at any time via the “Cookie settings”.

The data is processed on servers in the USA. The data transfer is based on the standard contractual clauses of the EU Commission.

Further information can be found in PostHog's privacy policy: https://posthog.com/privacy.https://www.jotform.com/privacy/.

Sentry

We use Sentry, a service provided by Functional Software Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, to automatically record and fix technical errors on our website. Technical information such as browser type, operating system and the time of the error may be processed.

Sentry is only activated after you have consented to the “Analytics” category (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); consent can be withdrawn at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Further information: https://sentry.io/privacy/.

LeadJourney (traffic-source and campaign attribution)

This website uses LeadJourney (leadjourney.io), a tool for detecting traffic sources and attributing enquiries to advertising campaigns (attribution). Information about the origin of your visit (e.g. search engine, advertisement, referring website, UTM parameters and advertising click IDs such as gclid or fbclid) as well as a pseudonymous identifier are processed and stored in cookies or in your browser's local storage. If you submit an enquiry via one of our forms, this identifier is linked to the enquiry so that we can understand through which channel you became aware of us. Tracking takes place via our own subdomain (t.invest4kids.de) and also covers cross-domain attribution to our consulting website invest4kids-beratung.de.

This service is used exclusively on the basis of your consent to the “Analytics” category pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG; you can withdraw your consent at any time via the “Cookie settings”.

Meta pixel (formerly Facebook pixel)

This website uses the Meta pixel for conversion measurement. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The data collected may also be transferred to the USA and other third countries.

This makes it possible to track the behaviour of site visitors after they have been redirected to this website by clicking on a Facebook or Instagram advertisement. This allows the effectiveness of the advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimised. The data collected is anonymous to us and does not allow us to draw any conclusions about the identity of the users. However, the data is stored and processed by Meta, so that a connection to the respective user profile is possible.

This service is used exclusively on the basis of your consent to the “Marketing” category pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. The company is certified under the “EU-US Data Privacy Framework” (DPF).

Further information can be found in Meta's privacy policy: https://www.facebook.com/about/privacy/.

Hyros

We use Hyros, a service provided by Hyros Inc. (USA), for cross-channel measurement and attribution of our advertising campaigns (ad attribution). For this purpose, Hyros processes information about your visit (e.g. pages viewed, origin of the visit, click IDs) and may set cookies in order to attribute enquiries and conversions to the respective advertising channels.

This service is used exclusively on the basis of your consent to the “Marketing” category pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Further information: https://hyros.com/privacy-policy.

Taboola

This website uses technologies provided by Taboola Inc. (Taboola Europe Limited, 25 Wilton Road, London SW1V 1LW, United Kingdom). Taboola enables us to measure the effectiveness of advertising campaigns in the Taboola network. For this purpose, cookies may be set and pseudonymous information about your visit (e.g. pages viewed) may be processed.

This service is used exclusively on the basis of your consent to the “Marketing” category pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time. Further information can be found in Taboola's privacy policy: https://www.taboola.com/policies/privacy-policy.

6. Plugins and Tools

YouTube with enhanced privacy settings

This website embeds videos from YouTube. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of these websites that includes YouTube, a connection is established with YouTube’s servers. In the process, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing activity directly with your personal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in enhanced privacy mode. According to YouTube, videos played in enhanced privacy mode are not used to personalize the user’s YouTube experience. Ads displayed in enhanced privacy mode are also not personalized. No cookies are set in enhanced privacy mode. Instead, however, so-called local storage elements are stored in the user’s browser; these contain personal data similar to cookies and can be used for recognition purposes. Details about enhanced privacy mode can be found here: https://support.google.com/youtube/answer/171780.

In some cases, playing a YouTube video may trigger additional data processing operations over which we have no control.

We use YouTube to ensure that our online content is presented in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time.

For more information about data protection on YouTube, please see their Privacy Policy at: https://policies.google.com/privacy?hl=de.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id;=a2zt000000001L5AAI&status;=Active.

Vimeo

This website embeds videos from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA. Videos are only loaded when you actively click on them and have previously consented to the “Marketing” category (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). When a video is played, Vimeo receives the information that you have visited our website as well as your IP address; this also applies if you do not have a Vimeo account.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Further information can be found in Vimeo's privacy policy: https://vimeo.com/privacy.

Trustindex (review widget)

On individual pages we embed a widget from the Trustindex service (Trustindex.io Kft., Budapest, Hungary) to display genuine customer reviews (e.g. from Google and Trustpilot). When the widget is loaded, a connection to the Trustindex servers is established and your IP address is transmitted.

The widget is embedded on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in a transparent presentation of customer reviews. Further information can be found in Trustindex's privacy policy: https://www.trustindex.io/privacy-policy/.

Google Fonts (local hosting)

This site uses so-called Google Fonts for the uniform display of fonts; they are installed locally on our server. No connection to Google servers is established.

7. Custom-developed plugins and integrations

Internal Tools and Services

Our website uses internally developed plugins and integrations to enhance the user experience and data security. These tools do not collect or process personal data for any purpose other than those specified in this Privacy Policy.

8. Whistleblower Program

Automatic enrollment

Once the contract is signed, we automatically enroll our customers in our referral program to provide them with a personalized referral link.

What data is processed?
  • Name
  • Email address
Purpose of processing
  • Creating and managing your personal referral link
  • Processing of recommendations and bonus payments
Legal basis

The processing is based on Article 6(1)(f) of the GDPR (legitimate interest in customer retention and referral marketing).

service provider

We use the software “Referral Rock” (Referral Rock Inc., headquartered in the U.S.) to handle the technical aspects of this process. The data mentioned above is used exclusively to generate and manage the referral link.
If data is transferred to the U.S., this is done in accordance with the current EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework to ensure an adequate level of data protection.

Voluntary Participation & Objection

Participation in the referral program is voluntary. Active use of the link is not required. Customers may opt out at any time. In this case, the data will be deleted immediately.

9. WhatsApp Communication and WhatsApp Chatbot

The controller named in this Privacy Policy is responsible for the processing of data in connection with WhatsApp communications.

9.1 General Information on Using WhatsApp

We use WhatsApp for customer communication, to send updates and special offers, and for customer support. We also offer a WhatsApp chatbot for certain events or services.

The service is provided via the official WhatsApp Business API in conjunction with the technology provider Superchat (SuperX GmbH, Prenzlauer Allee 242-247, 10405 Berlin, Germany, hereinafter referred to as “Superchat”).

Primary data processing takes place on servers located in Frankfurt am Main, Germany, ensuring that processing occurs within the EU and in accordance with the standards of the General Data Protection Regulation (GDPR). A link to the privacy policy is included in the description on the WhatsApp profile.

9.2 Categories of Data Processed

When you use our WhatsApp chatbot and WhatsApp services, we process the following personal data:

  • Your phone number
  • Your WhatsApp profile name
  • Your first name (if available)
  • Your communication and interaction data in the chat
  • Your clicking behavior within the chat
  • Publicly available information from your social media profiles (if applicable)
  • Your browsing activity on our website
  • Other information you provide during the chat interaction
  • Technical log data (e.g., IP address, browser used, etc.)

For more information about WhatsApp's data processing practices, please see WhatsApp's Privacy Policy at: https://www.whatsapp.com/legal/#privacy-policy.

9.3 Legal Basis for Data Processing

The processing of your personal data is based on different legal grounds depending on the context:

Art. 6(1)(a) GDPR – Consent:
If we process your data to send you information or marketing communications via WhatsApp, we will do so only with your explicit consent. You can give your consent via the chat by selecting the “START” button. You can withdraw your consent at any time by sending “STOP” in the chat.

Art. 6(1)(b) GDPR – Performance of a contract or taking steps to enter into a contract:
If you use WhatsApp for customer service or contract processing (e.g., for support requests or order processing), your data is processed for the purpose of fulfilling a contract or taking steps prior to entering into a contract.

Art. 6(1)(f) GDPR – Legitimate interests:
In certain cases, processing may be based on our legitimate interest in effective customer communication. This applies, for example, when we analyze how our chatbot is used in order to improve it.

Section 25(1) of the TTDSG – Consent for cookies or access to end devices:
If the processing involves tracking technologies such as cookies or device fingerprinting, this will only take place with your separate consent in accordance with Section 25(1) of the TTDSG. You may revoke this consent at any time.

9.4 Retention Period and Data Deletion

We store your data only for as long as is necessary for the respective processing purposes:

  • If you withdraw your consent (by typing “STOP” in the chat), your personal data will no longer be used for the WhatsApp service and will be anonymized.
  • Communication records are deleted after 12 months at the latest, unless there is a legal obligation to retain them.
  • If the data is necessary for contract processing, it will be stored in accordance with the statutory retention periods, in particular Section 147 of the German Fiscal Code (AO) (6 years) or Section 257 of the German Commercial Code (HGB) (10 years).

9.5 Data Disclosure and Potential Transfers to Third Countries

Your phone number and communication data will be shared with the following companies when you use WhatsApp:

9.5.1 Processing within the EU (Germany)

Your data is primarily processed on servers in Frankfurt am Main, Germany, which are hosted by Superchat. This means that your data is processed within the EU and is subject to the strict data protection requirements of the GDPR.

9.5.2 Possible transfer to third countries (in particular the United States)

Although the primary processing takes place within the EU, data may be transferred to third countries (in particular the United States) in the following cases:

  • Support requests or system maintenance by Superchat, Inc.: If technical support from Superchat is required, Superchat, Inc. employees in the United States may access personal data.
  • Data transfer via WhatsApp to Meta (U.S.): WhatsApp Ireland Limited processes data within the EU, but may transfer data to Meta Platforms, Inc. (U.S.).

9.5.3 Data Protection Measures for Transfers to Third Countries

If data is transferred to the United States, the following safeguards are in place:

  • EU-US Data Privacy Framework: Superchat participates in the EU-US Data Privacy Framework, which is designed to ensure an adequate level of data protection.
  • EU Standard Contractual Clauses (SCCs): Superchat and WhatsApp use the European Commission’s standard contractual clauses to ensure a level of data protection that complies with the GDPR.

9.6 Withdrawal and Data Subject Rights

You have the right to:

  • To withdraw your consent at any time (by typing “STOP” in the chat or by emailing info@invest4kids.de)
  • To obtain information about your stored data in accordance with Article 15 of the GDPR
  • To request the rectification of inaccurate data in accordance with Article 16 of the GDPR
  • To request the erasure of your data in accordance with Article 17 of the GDPR, provided that there are no legal obligations to retain the data
  • To request the restriction of processing pursuant to Article 18 of the GDPR
  • To object to data processing under Article 21 of the GDPR if it is based on our legitimate interest

You can send inquiries regarding your data protection rights to the following email address: info@invest4kids.de.

9.7 Changes to this section

We reserve the right to update this section of the Privacy Policy at any time to reflect new legal requirements or changes to our WhatsApp services. You can find the most current version at the bottom of the Privacy Policy on our website.

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy from time to time to ensure that it remains in compliance with current legal requirements or to reflect changes to our services. The updated Privacy Policy will then apply to your next visit.