Privacy Policy

PEDIF / pedif.digital

As of: 30 October 2026

1. Controller and Data Protection Officer

Controller

The controller responsible for the processing of personal data on this website and in the course of our business activities is:

Supedio GmbH
Tatzberg 47
01307 Dresden
Germany
Phone: 0351-41881686
Email: info@supedio.com

Data Protection Officer

Andrea Prinz
Datenschutz Prinz GmbH
Industriestraße 10
91154 Roth
Germany
Email: info@datenschutz-prinz.de

2. General information

We process personal data only insofar as this is necessary for the operation of our website, the handling of enquiries, the performance and initiation of business relationships, the analysis and improvement of our online offering, and our sales and marketing activities. Personal data means any information relating to an identified or identifiable natural person.

3. Retention period

We store personal data only for as long as is necessary for the respective processing purpose. Data may also be stored where statutory retention obligations apply or where storage is necessary for the establishment, exercise or defence of legal claims. Where specific retention periods apply to individual services, these are stated below.

If you object to the processing of your data for direct marketing purposes, we will no longer use your data for this purpose. To ensure that such an objection is permanently respected, we may retain the minimum information required for this purpose on a suppression list.

4. Your rights

Subject to the applicable legal requirements, you have in particular the following rights:

• Right of access to your personal data (Art. 15 GDPR),
• Right to rectification of inaccurate data (Art. 16 GDPR),
• Right to erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability, where the legal requirements are met (Art. 20 GDPR),
• Right to object to processing based on legitimate interests (Art. 21(1) GDPR),
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR),
• Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Automated decisions

No decision-making based solely on automated processing, including profiling within the meaning of Art. 22 GDPR, takes place via this website.

5. Hosting and server log files

Hosting

Our website is hosted by an external hosting service provider. In this context, IP addresses, technical connection data, server log files and other data generated when a website is accessed may in particular be processed. The hosting service provider generally processes this data on our behalf on the basis of a data processing agreement, where the legal requirements for this are met.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our online offering.

Server log files

When you access our website, technical data may be processed automatically in server log files. This may include, in particular, the IP address, date and time of access, page or file accessed, referrer URL, browser type and browser version, operating system, and host name of the accessing device. The processing serves the technical provision of the website, error analysis and IT security and is based on Art. 6(1)(f) GDPR.

The log data is stored only for the period required for technical provision, error analysis and IT security and is then deleted or anonymised. The specific retention period configured in the hosting environment forms part of our technical data protection documentation.

6. Cookies, localStorage and consent management

Our website uses cookies and comparable technologies. Technically necessary storage of, or access to, information on your terminal device, insofar as this is strictly necessary to provide a digital service expressly requested by you, is carried out on the basis of Section 25(2) TDDDG. The associated processing of personal data is based on Art. 6(1)(f) GDPR or, insofar as processing is necessary to take steps prior to entering into a contract, on Art. 6(1)(b) GDPR.

Non-essential cookies, localStorage entries and comparable technologies for analytics, audience measurement, conversion or marketing purposes are used only after you have given your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future via the cookie settings. Following withdrawal, services requiring consent are deactivated and associated storage controlled by us is removed or no longer used.

First-party analytics storage

For the purpose of analysing the use of our website, first-party localStorage entries may be set after analytics consent has been given. These entries are not created before the required consent has been obtained:

7. Contacting us

Contact form

If you contact us via a contact form, we process the data you enter in order to handle your enquiry and any follow-up questions. This includes, in particular, your name, business contact details, company, the content of your message and any information you provide voluntarily.

If your enquiry relates to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. In other cases, processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in the appropriate handling of incoming enquiries. Separate consent to the Privacy Policy is not required in order to process a general contact enquiry.

Email and telephone

If you contact us by email or telephone, we process the contact details you provide and the content of the communication in order to handle your request. Depending on the reason for the contact, processing is based on Art. 6(1)(b) or (f) GDPR. Enquiries are deleted once the matter has been concluded and no statutory retention obligations or other legitimate reasons for further storage apply.

8. Newsletter

If you subscribe to a newsletter via our website, we process your email address and, where applicable, other information provided voluntarily in order to send you the newsletter. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with the applicable rules of competition law.

You may withdraw your consent at any time with effect for the future. In particular, you may use the unsubscribe link in our newsletter and confirmation emails or contact us at info@supedio.com. After unsubscribing, we will no longer process your address for the newsletter. Where necessary, evidence of consent given or withdrawn may be retained for the duration of statutory limitation and evidence periods.

9. Appointment booking via Microsoft Bookings

We use Microsoft Bookings, a service within Microsoft 365, to arrange appointments for discussions. The Bookings calendar module is not loaded automatically when the page is accessed. A connection to Microsoft is established only after you activate it.

When the calendar is loaded, technical data such as the IP address, browser and device information, the page accessed, time and connection data may be transmitted to Microsoft. If you then book an appointment, in particular your name, email address, where applicable telephone number, as well as appointment and communication data are processed in order to schedule, confirm and conduct the appointment.

The provider in the European contractual context is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We base the technical provision of the calendar expressly requested by you on Art. 6(1)(f) GDPR; our legitimate interest lies in providing a user-friendly appointment booking process. Insofar as the appointment booking serves to initiate or perform a contract, the legal basis is Art. 6(1)(b) GDPR. Where Microsoft transfers data to third countries, the mechanisms provided by Microsoft under Arts. 44 et seq. GDPR apply, in particular adequacy decisions or appropriate safeguards.

10. Analytics, audience measurement and online advertising

10.1 Google Analytics

We use Google Analytics for the statistical analysis of the use of our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In particular, information about page views, interactions, the source of the visit, approximate location, browser and device information, and pseudonymous identifiers may be processed.

Google Analytics is activated only after you have given analytics consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent via the cookie settings. Retention at user and event level is governed by the retention settings configured in Google Analytics. Where Google LLC in the USA is a recipient, the transfer may be based on an applicable adequacy decision, in particular certification under the EU-U.S. Data Privacy Framework; appropriate safeguards may also be used.

10.2 Microsoft Clarity

We use Microsoft Clarity to understand how our website is used and where usability or content can be improved. Clarity may process technical data and interactions such as page views, clicks, scrolling, mouse movements, window sizes, loading and error events, and information about how the page is displayed. Privacy-sensitive input fields are masked in accordance with the service specifications.

Clarity is used only after you have given analytics consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. The provider in the European contractual context is Microsoft Ireland Operations Limited. Where data is processed outside the EEA, the transfer mechanisms provided by Microsoft under Arts. 44 et seq. GDPR apply.

10.3 Google Ads, Conversion Linker and Google Tag Manager

We use Google Ads, including conversion measurement and Conversion Linker, to measure the effectiveness of our advertising activities and to determine whether an advertisement has led to a desired action on our website. The technical integration is implemented via Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads and Conversion Linker are activated only after you have given marketing consent. Depending on the configuration, page URL and referrer, event and conversion data, browser and device information, IP address, as well as cookie, click or advertising identifiers may be processed. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Where Google LLC in the USA is a recipient, the transfer may be based on an applicable adequacy decision, in particular certification under the EU-U.S. Data Privacy Framework; appropriate safeguards may also be used.

10.4 Meta/Facebook Pixel

We use the Meta Pixel to measure the effectiveness of our advertisements on Facebook and Instagram, attribute conversions and optimise campaigns. The provider for users in the European Region is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel is activated only after you have given marketing consent. In particular, information about page views and events triggered by you, URL and referrer, browser and device information, IP address, and cookie or advertising identifiers may be processed and transmitted to Meta. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Where Meta transfers data to third countries, the mechanisms provided by Meta under Arts. 44 et seq. GDPR apply.

10.5 OpenAI / ChatGPT Ads Pixel

We use the OpenAI Pixel as a conversion measurement tool for advertising in ChatGPT. The Pixel is used to determine whether certain events or conversions take place on our website after a user clicks on an advertisement, and to evaluate and optimise the results of our campaigns.

The OpenAI Pixel is activated only after you have given marketing consent. Depending on the configuration, website and conversion events, technical browser and device information, and cookie, click or other measurement identifiers may in particular be transmitted to OpenAI. The provider for the European Economic Area is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Where data is processed outside the EEA, the applicable transfer mechanisms under Arts. 44 et seq. GDPR apply.

11. Embedded media

11.1 YouTube videos

Videos from YouTube may be embedded on our website. The provider for users in the European Economic Area is Google Ireland Limited. When an embedded video is activated, data may be transmitted to Google or YouTube, in particular the IP address, device and browser information, the page accessed and, where applicable, cookie or account information.

YouTube content is loaded only after you activate it or provide the required consent. Until then, we only show a preview image that is loaded from our own server; no data is transmitted to YouTube. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent can be withdrawn via the cookie settings. Where Google LLC in the USA is a recipient, the transfer may be based on an applicable adequacy decision; appropriate safeguards may also be used.

11.2 Synthesia videos and technical video services

Videos from Synthesia may be embedded on our website. The provider is Synthesia Limited, 20 Triton Street, London NW1 3BF, United Kingdom. Before activation, we only show a preview image that is delivered from our own server; no data from your device is transmitted to Synthesia or its service providers.

The actual video player is loaded only after you activate it. In connection with the player, in addition to Synthesia, the following technical service providers may in particular be contacted: LaunchDarkly (Catamorphic Co., USA) for functionality and feature control, Mux, Inc. and Litix for video delivery and video analytics, and Datadog for technical telemetry and error analysis. In particular, IP address, browser and device information, the page accessed, technical playback and performance information, and pseudonymous identifiers may be processed.

Where these services use cookies, localStorage or comparable technologies, or process data for analytics purposes, they are activated only after you have given consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent via the cookie settings. For transfers to the USA, the respective providers state that they rely on applicable adequacy decisions or appropriate safeguards such as Standard Contractual Clauses.

12. Social media presences

We maintain corporate presences on social networks, in particular LinkedIn and YouTube, in order to provide information about our services and communicate with interested parties, customers and business partners. If you contact us directly there, we process the data you provide for communication and business development on the basis of Art. 6(1)(b) or (f) GDPR. Our legitimate interest lies in corporate communication and the maintenance of business contacts.

When you visit our profiles, the platform operators process personal data in accordance with their own privacy policies. They may also provide us with aggregated statistics or insights about the use of our presences. Where joint controllership exists in connection with such functions, the agreements and information provided by the respective platform apply. For LinkedIn, the provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. For YouTube, the relevant provider in the EEA is Google Ireland Limited. Information on third-country transfers is set out in the privacy information of the respective platform providers.

13. Outreach and direct marketing

13.1 Purpose of processing

We process professional contact data in order to identify potentially relevant contacts at companies, initiate business contacts and maintain existing business relationships. Our outreach activities are directed at companies and individuals acting in a professional capacity.

13.2 Data processed

• Name, company and professional role,
• business contact details,
• publicly available professional information,
• source and assignment to an outreach campaign,
• communication history and, where applicable, delivery, response and interaction status,
• information about an objection to further contact.

13.3 Sources of the data

Where we have not obtained the data directly from you, it may in particular originate from publicly accessible business sources, for example company websites, professional profiles, public directories or registers. We may also obtain data from B2B research and data providers. We process only data that is necessary for business contact and its documentation.

13.4 Legal basis

The processing of personal data for the initiation and maintenance of business contacts is generally based on Art. 6(1)(f) GDPR. Our legitimate interest consists in business development, marketing our services to companies and maintaining existing business relationships. Where processing is based on your consent, Art. 6(1)(a) GDPR is the legal basis. The data protection lawfulness of the processing and the lawfulness of the respective contact channel must be assessed separately; the applicable rules of competition law also apply to the contact itself.

13.5 Service providers used

• Smartlead / 521 Products Pty Ltd - technical implementation and management of email outreach.
• HeyReach Inc OÜ - technical implementation and management of LinkedIn outreach.
• Pipedrive OÜ - management of contacts, communications and sales processes in our CRM system.

Additional technical service providers and B2B research and data providers may be used where this is necessary for research, operations, automation or the secure provision of our sales processes. Where such providers process personal data on our behalf, this is carried out on the basis of the data protection agreements required by law. Transfers to third countries are made only under the conditions of Arts. 44 et seq. GDPR.

13.6 Retention period and right to object

We store personal data only for as long as this is necessary for business development, communication, documentation and the protection of legitimate interests, or where statutory retention obligations apply. If you object to the processing of your data for direct marketing purposes, we will no longer use your data for this purpose. To ensure that such an objection is permanently respected, we may retain the minimum information required for this purpose on a suppression list. An informal notification to info@supedio.com is sufficient to exercise the right to object.

13.7 Information where data has not been obtained directly

This section also contains the essential information for cases in which we have not obtained professional contact data directly from the data subject: purposes and legal bases of processing, categories of data, possible sources, recipients or categories of recipients, criteria for the retention period, and the right to object to direct marketing.

14. Changes to this Privacy Policy

We update this Privacy Policy when our data processing activities, the services we use or the legal framework change. The current version published on our website applies.