Privacy Policy

Introduction

Thank you for visiting our website and for your interest in our services.

When you visit our website, use our online offering or enter into (or express interest in) a contractual relationship with us, your personal data may be processed. The protection of your data is important to us. With this privacy policy we inform you, pursuant to Art. 13 and 14 of the General Data Protection Regulation ("GDPR"), how we handle your personal data (also referred to as "data" below).

A. General

I. Definitions

We want this privacy policy to be easy to read and understand for our website visitors and users as well as our customers, business partners and prospects. To that end, we explain the most important terms:

• "Personal data" means any information relating to an identified or identifiable natural person (e.g. name, address, email address, user behaviour).
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means — collection, recording, storage, alteration, retrieval, disclosure, erasure, etc.
• "Controller" means the natural or legal person which alone or jointly with others determines the purposes and means of the processing.
• "Processor" means a natural or legal person which processes personal data on behalf of the controller.
• "Consent" means any freely given, specific, informed and unambiguous indication of the data subject's wishes.
• "Profiling" means any form of automated processing of personal data used to evaluate certain personal aspects relating to a natural person.

II. Controller

Unless otherwise specified in this privacy policy, the controller within the meaning of Art. 4 (7) GDPR is:

kolum GmbH
Linienstraße 214
10119 Berlin, Germany
Email: info@kolum.earth

For specific questions about the processing of your personal data and to exercise your rights under the GDPR, you can contact us at any time using the contact details above.

B. Processing activities

I. Visiting our website

1. Log files

When you use the website for informational purposes, we process the following personal data that your browser transmits to our server:

• IP address
• date and time of the request
• time zone difference to Greenwich Mean Time (GMT)
• content of the request (page visited)
• access status / HTTP status code
• amount of data transferred
• website previously visited
• browser type
• operating system used
• language and version of the browser software
• hostname of the accessing device

2. Data security

For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar switching from "http://" to "https://" and the lock symbol in the browser bar. While encryption is active, the data you transmit to us cannot be read by third parties.

The legal basis for the processing described above is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in the secure, stable and efficient operation of our website and protection against misuse).

3. Cookies

We use cookies in some areas of our website. Cookies are small text files stored by the browser on your device when you visit a website and which can be read by us or by a third party. They are used to identify your device for a limited period of time.

Some cookies we use are session cookies that are deleted automatically when you leave our site; others remain on your device until you delete them.

Strictly necessary cookies are set on the basis of Art. 6 (1) sentence 1 lit. f GDPR and § 25 (2) no. 2 TDDDG. In addition, we use cookies that are not strictly necessary based on your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR and § 25 (1) TDDDG. You can withdraw your consent at any time via the Cookie Settings.

II. Contractual partners

Where you have a contractual, quasi-contractual or pre-contractual business relationship with us ("contractual partners"), we process the following data as required:

• Master data (e.g. first and last name, address, company, location)
• Contact data (e.g. email address, phone number)
• Payment data (e.g. bank details, invoice information, payment history)

We process this data in particular to communicate with you, to respond to your inquiries, to fulfil our contractual or statutory obligations and to safeguard our rights. Legal basis is Art. 6 (1) sentence 1 lit. b GDPR (performance of a contract or pre-contractual measures). Where we are legally required to do so (e.g. retention obligations under the German Commercial Code (HGB) and Fiscal Code (AO)), we process your data on the basis of Art. 6 (1) sentence 1 lit. c GDPR. We also process your data on the basis of our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR (e.g. for legal enforcement and defence).

III. Use of our online offering

1. Contacting us

When you contact us (e.g. via online contact form, chat, email, telephone or social media) or as part of an existing business relationship, your data is processed to the extent necessary to respond to your request. We collect the content of your request (e.g. name, email address).

Legal basis is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in responding to inquiries appropriately). Where you are inquiring about an upcoming or existing contractual relationship, processing takes place pursuant to Art. 6 (1) sentence 1 lit. b GDPR.

2. Booking a meeting

When you book a meeting with us through our website, we collect the personal data you provide (in particular first name, last name, business address) in order to process your request and conduct the meeting.

Processing takes place to carry out pre-contractual measures pursuant to Art. 6 (1) sentence 1 lit. b GDPR and on the basis of our legitimate interest in the efficient handling of inquiries and scheduling pursuant to Art. 6 (1) sentence 1 lit. f GDPR.

3. Newsletter and marketing

You can sign up for our newsletter. To do so, you need to provide your email address. After signing up, you will receive a confirmation email ("double opt-in").

The newsletter is sent on the basis of your prior express consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR. You can unsubscribe at any time using the contact options described in this privacy policy or via an unsubscribe link contained in each marketing email.

IV. Use of service providers; transfers to third countries

In the course of our business activity — in particular to operate our website and online offering and to support our internal business processes — we use carefully selected service providers. Where these providers process personal data on our behalf, we have concluded data processing agreements with them pursuant to Art. 28 GDPR.

Where personal data is transferred to third countries outside the EU/EEA, we ensure an adequate level of data protection by means of (i) an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework for certified US companies), (ii) Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures, or (iii) — where exceptionally required — based on your express consent pursuant to Art. 49 (1) lit. a GDPR.

For our internal business processes we use, in particular, providers of communication and collaboration tools, development and productivity solutions, CRM systems, and finance, compliance and AI services. For the operation of our website and online offering we use the following service providers:

• Google Analytics (GA4) — Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland (privacy policy). Purpose: analysis of website usage and user behaviour to optimise the website and advertising activities. Data: online identifiers (cookie/client ID), usage and event data, device/browser information, log data, derived location information. Location: processing within the EU; transfers to the USA may occur, certified under the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses (Art. 46 GDPR). Legal basis: Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG (consent).
• Google Tag Manager — Google Ireland Limited, Dublin, Ireland (privacy policy). Purpose: management and delivery of tracking tags and integration of analytics and marketing services. Data: the service itself does not process personal data for analytics or advertising, but may collect technical data (e.g. IP address). Location: EU/USA under the EU-U.S. Data Privacy Framework and SCCs. Legal basis: consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).
• Google Ads — Google Ireland Limited, Dublin, Ireland (privacy policy). Purpose: conversion tracking and campaign performance measurement. Data: IP address, device information, click and conversion data, interaction data. Location: EU/USA under the EU-U.S. Data Privacy Framework and SCCs. Legal basis: consent.
• LinkedIn Insight Tag — LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (privacy policy). Purpose: analysis of user behaviour in a professional context, conversion tracking and campaign optimisation. Data: IP address, device information, professional profile data, usage and interaction data, referrer URL. Location: EU/USA under the EU-U.S. Data Privacy Framework and SCCs. Legal basis: consent. With advertising consent, we also send a completed demo-booking event to LinkedIn for conversion measurement and advertising optimisation, together with the technical data collected by the Insight Tag. We do not include your booking-form name or email in this event. Your consent choice, timestamp and notice version are stored in your browser; you can withdraw consent through Cookie settings at any time.
• Ahrefs — Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581 (privacy policy). Purpose: analysis of website performance and SEO. Data: IP address, usage data, pages visited, referrer data, technical browser and device information. Location: Singapore; transfers based on Standard Contractual Clauses (Art. 46 GDPR). Legal basis: consent.
• HubSpot (Marketing) — HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA (privacy policy). Purpose: marketing automation and analysis of user behaviour and lead origin. Data: IP address, device information, usage and interaction data, click behaviour, form contents, tracking data. Location: USA; certified under the EU-U.S. Data Privacy Framework and, where applicable, SCCs. Legal basis: consent.
• HubSpot (Forms & Meetings) — HubSpot, Inc., Cambridge, MA, USA (privacy policy). Purpose: meeting scheduling and communication via forms and chat functions. Data: name, email address, meeting details, communication content and other voluntarily provided data. Location: USA; EU-U.S. Data Privacy Framework and SCCs where applicable. Legal basis: Art. 6 (1) lit. b GDPR (pre-contractual measures) and Art. 6 (1) lit. f GDPR (legitimate interest in efficient customer communication and CRM).
• Vercel — Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (privacy policy). Purpose: hosting and delivery of the website via a Content Delivery Network (CDN) infrastructure. Data: IP address, server log data, technical connection data. Location: USA; EU-U.S. Data Privacy Framework and SCCs where applicable. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the secure and efficient operation of the website).
• Hygraph — Hygraph GmbH, Dircksenstraße 47, 10178 Berlin, Germany (privacy policy). Purpose: content management system; storage and further processing of personal data submitted via forms. Data: personal data from forms (e.g. name, email address, content of inquiries) and, where applicable, technical access data. Location: processing within the EU. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the storage and purpose-bound processing of personal data entered in forms).

V. Online presences on social media

We maintain publicly accessible profiles on social networks in order to communicate with prospects and users and to inform them about our services. The respective platform operators may process personal data in this context.

When you visit our profiles, the operators of the social networks generally use cookies and similar technologies to analyse your usage behaviour. This applies even if you do not have a profile on the respective social network or are not logged in.

Processing takes place on the basis of our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR, in particular for effective information and communication with users.

Details on the collection and storage of your personal data and the nature, scope and purpose of its use by the operator of the relevant social network can be found in the privacy policy of the respective operator:

• LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; website: linkedin.com; privacy policy: linkedin.com/legal/privacy-policy

C. Storage and deletion of data

We delete the data we process in accordance with statutory provisions as soon as you withdraw your consent to processing or the purpose of processing no longer applies or the data is no longer required for that purpose. We only store your personal data for as long as is necessary for the respective processing purpose and limit storage to the necessary minimum. Beyond that, we only store your data where we are entitled or required to do so under statutory retention periods.

D. Your data subject rights

You have the right to:

• access pursuant to Art. 15 GDPR,
• rectification pursuant to Art. 16 GDPR,
• erasure pursuant to Art. 17 GDPR,
• restriction of processing pursuant to Art. 18 GDPR,
• data portability pursuant to Art. 20 GDPR, and
• object pursuant to Art. 21 GDPR (see below).

You can also withdraw any consent given to the processing of personal data at any time. The withdrawal takes effect for the future only; processing carried out before the withdrawal is not affected.

You also have the right to lodge a complaint with the data protection supervisory authority pursuant to Art. 77 GDPR.

E. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) sentence 1 lit. e or f GDPR; this also applies to profiling based on those provisions within the meaning of Art. 4 (4) GDPR.

In the event of an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

F. Data processing when accessing linked content

This website may contain external links or hyperlinks to websites of other providers. These are to be distinguished from our own content. We have no influence over the content of third-party pages. If you are forwarded to other pages via links on this website, please refer to those websites for information on how they handle your data.

G. Automated decision-making / profiling

No automated decision-making or profiling takes place.

H. Changes to this privacy policy

As our website and online offering evolve, or due to changes in legal or regulatory requirements, it may become necessary to update this privacy policy from time to time. If you have any questions about the processing of your data, you can contact us at any time using the contact details provided above.