This statement was written in German. If you are facing inconsistencies between the translated version of this statement compared to the German version, always the German version shall prevail.
Last modified: October 14, 2026
We – the Conceptboard Cloud Service GmbH, Mansfelder Str. 56, 06108 Halle (Saale), Germany – develop and operate the service Conceptboard for a better online collaboration between computer users. With the following privacy policy we would like to inform you which types of your personal data (hereinafter also abbreviated as “data”) we process in the context of Conceptboard, for which purposes, and in which scope.The terms used are not gender-specific.
Controller and Roles
Controller:
Conceptboard Cloud Service GmbH
Mansfelder Straße 56
06108 Halle (Saale)
Germany
Email: support@conceptboard.com
Data Protection Officer: dataprotectionofficer@conceptboard.com
Your Rights as a Data Subject
Your rights under Articles 15–22 GDPR include the following, in each case subject to the statutory requirements:
• Access (Article 15 GDPR)
• Erasure (Article 17 GDPR)
• Rectification (Article 16 GDPR)
• Data portability (Article 20 GDPR)
• Withdrawal of consent given, with effect for the future (Article 7(3) GDPR)
• Restriction of processing (Article 18 GDPR)
• Objection to processing (Article 21 GDPR)
To exercise your rights, please contact us using one of the methods below, preferably by email at dataprotectionofficer@conceptboard.com or support@conceptboard.com.
You also have the right to lodge a complaint with a data protection supervisory authority (in particular, at your place of residence, your place of work, the place of the alleged infringement, or the registered office of the Controller).
Competent supervisory authority for Conceptboard Cloud Service GmbH:
State Commissioner for Data Protection of Saxony-Anhalt, Otto-von-Guericke-Straße 34a, 39104
Magdeburg, Germany, Website: https://datenschutz.sachsen-anhalt.de/
Right to Object
If we process data to safeguard legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the personal data unless there are compelling legitimate grounds for the processing or the processing serves the establishment, exercise or defence of legal claims.
Purposes and Legal Bases of Data Processing (Website)
We process personal data in order to provide our website, ensure security, enable communication and—if you consent—carry out online marketing/statistics.
Legal bases:
• Article 6(1)(f) GDPR (secure and cost-effective provision of the website; IT security; responding to general enquiries),
• Article 6(1)(b) GDPR (pre-contractual/contractual communication, e.g. requests for quotations; insofar as relevant via the website),
• Article 6(1)(c) GDPR (legal obligations),
• Article 6(1)(a) GDPR (consent, e.g. for marketing cookies, embedded videos, optional surveys).
We do not process special categories of personal data (Article 9(1) GDPR) in connection with use of the website.
Disclosure to Third Parties
Data is disclosed only where there is a legal obligation, on the basis of data processing agreements or appropriate safeguards, or with your consent. Typical recipients in the context of the website include, for example, IT/hosting service providers, providers of embedded content, support/ticketing services, and marketing/analytics providers (on an opt in basis).
Recipients of the Data
Internally, access is granted only to departments that need it to perform their duties. External, independent third parties are engaged under data processing agreements where required.
Possible recipients (website):
• Hosting & infrastructure: ALL-INKL
• Web development/design: Friendventure
• Help Center/support: Hubspot
• Email delivery/marketing (opt-in content only): IONOS / Brevo
• CRM/communication (contact enquiries): Hubspot
• Webinars/training (opt-in): Livestorm
• Captcha service (contact form protection): Trust Captcha
• (Bookings/payments, if via the website): Adyen (PSP), billwerk (Subscription)
Transfers to Third Countries / Intention to Transfer to Third Countries
A transfer to third countries (outside the EU/EEA) takes place only if legally permissible (e.g. EU Standard Contractual Clauses, an adequacy decision recognised by law, Articles 44–49 GDPR) or if you have consented. Some service providers (e.g. Vimeo, Meta, Google, Twitter/X, YouTube) are based in or have a connection to third countries. Details can be found below under the corresponding data processing activities.
Retention Period
We delete personal data as soon as the purpose no longer applies and no retention obligations prevent deletion. Examples:
• Server log files: generally 28 days (audit logs up to 180 days).
• Contact enquiries: for processing and thereafter in accordance with statutory limitation/retention periods (regularly up to 3 years to defend against claims).
• Marketing/tracking data: in accordance with the settings/consent selected and internal deletion policies.
• Statistics (anonymised): aggregated, without personal reference; raw data deleted after 25 months.
• Contract/payment data (if via the website): up to 10 years under commercial/tax law.
Secure Transmission of Your Data
Data exchange with our website is encrypted via HTTPS using current transport encryption (TLS). We regularly review and update technical and organisational measures. For further security information, please see our Statement of Security page.
https://conceptboard.com/de/sicherheitsmassnahmen/
Automated Individual Decision-Making
We do not make decisions with legal effect concerning website visitors that are based solely on automated processing.
Obligation to Provide Data
There is no obligation to provide personal data for purely informational use of the website; certain data (e.g. the IP address in log files) is technically required. Mandatory fields are marked on contact forms; without them, we may not be able to process your request.
Provision of the Website – Browsing Our Website
Categories, sources and origin of the data
When you visit purely for information, we process:
• Name of your internet service provider,
• the website from which you visit us (referrer),
• browser/operating system information of the device used,
• IP address,
• files/pages accessed, data volumes transferred, date/time.
Purposes: IT security, stability, load distribution, error-free operation (Article 6(1)(f) GDPR). Log data is generally truncated/deleted after 7–28 days (see above).
Contact Form / Email Contact
When you use our contact form or contact us by email, we process the information you provide (name, contact details, your message; IP address where technically required/to prevent misuse).
Legal bases: Article 6(1)(b) GDPR (pre-contractual communication) or point (f) (general enquiries).
Services: Hubspot, Trustcaptcha
Processing of Customer Data / Supplier Data / Data of Other Contractual Partners (Web Context)
Where you submit enquiries or initiate contracts via the website, we process contact details, work-related information and—if applicable—payment/contract data for this purpose.
Legal bases: Article 6(1)(b)/(c)/(f) GDPR.
Deletion: after completion and expiry of statutory periods (generally 3 years; 10 years for tax purposes).
Note: App-specific collaboration data is not covered by this website notice.
Processing of Applicant Data
If you apply for jobs via our website or contact our recruiting team, we process the data you submit (master data, contact details, qualification data, etc.).
Purpose: conducting the application procedure.
Legal basis: Section 26 BDSG, Article 6(1)(b) GDPR; consent (e.g. talent pool), Article 6(1)(a) GDPR.
Retention: generally up to 6 months after completion; with consent, for a maximum of 12 months.
Service: Personio (applicant management).
Cookies
Cookies are text files that contain data from websites or domains visited and are stored by the browser on users’ computers. They primarily serve to store information about a user during or after their visit to our website. The information stored may include, for example, login status, session ID or preferences from previous visits.
In operating our website, we distinguish between first-party cookies, which we set ourselves (e.g. to ensure technical functions of the site), and third-party cookies, which are integrated by third-party providers and are required to enable certain functions on our website, such as playing help videos, using the Help Center or other embedded content.
“Marketing cookies”: A subset of third-party cookies are so-called “marketing cookies” (also “marketing pixels” or “tracking tools”; see the Online Marketing section). These are used exclusively on our website and only with your express consent (opt-in). Marketing cookies enable us to serve targeted digital advertising to user groups that are likely to have an increased interest in our topics and offers.
Legal basis: The legal basis for the use of cookies depends on whether we ask you for your consent.
• If you have consented to the use of cookies, processing is based on your consent (Article 6(1)(a) GDPR).
• Without consent, processing takes place only insofar as it is necessary to ensure the technical operation of our website or is based on our legitimate interest in a secure, functional and user-friendly website (Article 6(1)(f) GDPR).
Withdrawal of consent and objection (opt-out): You may withdraw consent you have given at any time with effect for the future or object to the processing of your data through cookies.
You can do this in the following ways:
• Through your browser settings: You can disable or restrict the storage of cookies. Please note that
this may restrict the functionality of our website.
• Through our cookie settings: You can object at any time to the use of cookies for marketing or
analytics purposes via our cookie settings:
User Profiles / Web Tracking
We use Matomo in a self-hosted version on our website to analyse use of our website and improve its stability, functionality and user-friendliness. Matomo is operated on our own infrastructure; the data collected is not transferred to third parties.
Matomo currently uses cookies. In particular, the first-party cookies _pk_id and _pk_ses are used.
Matomo tracking is technically blocked until you give your consent. It is activated only if you have consented via our consent management system.
As part of the analysis, we process, among other things, URLs visited, including URL parameters that have not been excluded, referrer and campaign information, internal search terms, and various interaction and event data. In addition to a Visitor ID, Matomo also uses a User ID. The custom dimensions “User ID (CCB)”, “Company ID” and “Instance” are also enabled. The data processed in this way must therefore not be treated as anonymous, but at least as pseudonymised or personal data.
The IP address is truncated by two octets before it is used further. Geolocation is carried out exclusively on the basis of the IP address that has already been truncated.
FormAnalytics, heatmaps and session recordings are not enabled. According to the configuration reviewed, form contents are not captured via Matomo.
Detailed Matomo raw data is deleted after 186 days. Deletion is carried out weekly. Aggregated reports are not currently deleted automatically and are therefore stored without a defined deletion period.
The legal basis for setting Matomo tracking cookies and the associated processing of personal or pseudonymised data is your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the settings of our consent management system.
Social Network Plugins
No social plugins are active on our website that transfer data without your interaction.
Information on Data Protection on Social Media
We maintain presences on: Facebook, LinkedIn, Twitter/X, YouTube, Instagram, Xing. Use is subject to
the terms of the respective providers; data may be processed outside the EU; the networks may create
profiles for advertising purposes.
Your options: log out before visiting, delete cookies, use the providers’ objection/opt-out settings.
Legal basis for our presences: Article 6(1)(f) GDPR; where consent is given: Article 6(1)(a) GDPR.
Privacy notices/opt-out (selection):
• Facebook: https://www.facebook.com/about/privacy | Ads settings: https://www.facebook.com/settings?tab=ads
• LinkedIn: https://www.linkedin.com/legal/privacy-policy | Retargeting opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
• Twitter/X: https://twitter.com/en/privacy | https://twitter.com/personalization
• YouTube/Google: https://policies.google.com/privacy | https://adssettings.google.com/authenticated
• Instagram: https://www.instagram.com/legal/privacy/
• Xing: https://privacy.xing.com/en
Online Marketing (After Opt-In)
With your consent, we use marketing pixels/tags on the website to enable reach measurement, audience creation (remarketing/lookalikes) and conversion tracking.
Services (where applicable):
• Meta Platforms Ireland Limited, Dublin, Ireland (Facebook Pixel / Meta Pixel)
• LinkedIn Ireland Unlimited Company, Dublin, Ireland (LinkedIn Insight Tag)
• OpenAI OpCo, LLC, San Francisco, USA (or OpenAI Ireland Limited for users in the EEA) (ChatGPT Ads – ad placement and conversion measurement)
• X Corp., San Francisco, USA (Twitter Website Tag / X Ads Tag)
• Google Ireland Limited, Dublin, Ireland (Google Tag Manager / Google Ads Conversion Tracking)
• Microsoft Ireland Operations Limited, Dublin, Ireland (Microsoft Advertising)
• Dealfront Group GmbH, Mannheim, Germany (Leadfeeder / Dealfront)
• G2.com, Inc., Chicago, USA (G2 Reviews / “Track Your Prospects”)
• HubSpot Germany GmbH, Am Studio 20, 12489 Berlin, Germany (contracting party according to the order form/invoice); HubSpot, Inc., Two Canal Park, Cambridge, Massachusetts 02141, USA, other HubSpot group companies and their sub-processors may also be involved in the technical processing (HubSpot Tracking Code, CRM, forms, campaigns)
HubSpot Tracking Code: The HubSpot Tracking Code is integrated on all pages of our website and is loaded after you have given your consent. It enables website visits to be assigned to contacts in our CRM, form capture, campaign and audience creation (e.g. retargeting/contact-match audiences for Google Ads, LinkedIn Ads or Meta Ads), lead scoring and—if enabled—the synchronisation of conversions with advertising networks and the sending and/or analysis of marketing emails.
Google Tag Manager: Google Tag Manager is used as a technical control centre through which marketing and statistics tags are triggered after consent. Google Tag Manager itself does not collect any usage data of its own; it merely controls the loading of the relevant services (including Google Ads, LinkedIn Insight Tag, Microsoft Advertising/UET, HubSpot Tracking Code).
Google Ads: Conversion tracking for ads placed is carried out via Google Ireland Limited. If enabled, remarketing/retargeting, Enhanced Conversions (matching hashed contact data for more precise conversion attribution), Customer Match (matching contact lists, e.g. from HubSpot) and offline conversion imports may also be used.
Microsoft Advertising (Bing Ads): Ads are placed via Microsoft Ireland Operations Limited (or Microsoft Corporation, USA). If the UET tag (Universal Event Tracking) is active and you have consented to marketing cookies, conversion tracking, remarketing/retargeting, Enhanced Conversions and—if enabled—Customer Match or offline conversion imports may be used.
LinkedIn Insight Tag: In addition to reach measurement and conversion tracking, remarketing (creation of website audiences), Enhanced Matching (matching an email address entered in a form and hashed before transmission) and Enhanced Conversion Tracking (attribution of ad clicks using a Click ID) may also be used, if enabled.
ChatGPT Ads: We place ads within ChatGPT via OpenAI’s advertising platform. To measure performance, we use the OpenAI Measurement Pixel on our website, which, after consent (opt-in), transmits conversion events (e.g. completed registrations or enquiries) to OpenAI and stores a click reference value (“oppref”) in a first-party cookie in order to link ad clicks to subsequent conversions. If enabled, automatic advanced matching (“Automatic Advanced Matching”) may also be used, whereby contact details entered on our website (e.g. an email address) are hashed in the browser using SHA-256 and transmitted to OpenAI in a non-reversible form; unencrypted contact details do not leave our website.
OpenAI does not gain access to individual chat histories or user identities in ChatGPT, but only to aggregated performance and conversion data. The pixel becomes active only after you have given your consent (technical integration with our consent management tool).
Legal basis: Article 6(1)(a) GDPR (opt-in). Withdrawal via cookie settings.
Embedded Help Videos
We embed help videos via Vimeo to explain functions. Processing of your IP address by the provider is technically necessary.
Legal basis: Article 6(1)(a) GDPR.
Service: Vimeo, Inc., USA.
Surveys and Questionnaires
Voluntary surveys (e.g. feedback forms) may be conducted via Survio. The content you enter and technical metadata (e.g. IP address for delivery) are processed.
Survio uses technically necessary cookies to operate the survey function (Article 6(1)(f) GDPR); additional cookies for advertising/reach measurement purposes are set only with your consent (Article 6(1)(a) GDPR). According to its own statements, Survio is certified as GDPR-compliant (ISO 27001) and stores data on servers within the EU. A transfer of data to third countries (e.g. as part of integrated Google or Microsoft services on the Survio platform) cannot be ruled out; Survio refers in this regard to appropriate safeguards pursuant to Articles 44 et seq. GDPR.
Legal basis: Article 6(1)(a) GDPR (participation/consent).
Service: Survio s.r.o. (Czech Republic).
Payment Services
For online payments, we use payment service providers that process card/account data in accordance with PCI-DSS. We receive only transaction-related metadata (e.g. transaction number, card type, last 4 digits).
Legal basis: Article 6(1)(b) GDPR.
Services: Adyen (PSP), billwerk (Subscription).
Email Delivery / Hosting
For sending, receiving and storing emails, we use the services of external providers. They provide the technical infrastructure for secure email traffic and support us in managing email communications.
In this process, personal data are processed, in particular:
• sender and recipient addresses,
• time of sending and receiving messages,
• technical metadata (e.g. servers involved, IP addresses),
• and the content of the respective message, including any attachments transmitted.
Processing this data is necessary to ensure electronic communication with you, respond to enquiries, ensure technical operations and prevent misuse of our systems (e.g. through spam or malware).
We store emails sent to us in connection with business negotiations, contractual relationships or general enquiries only for as long as necessary for the relevant communication or contract processing. Longer retention occurs only where statutory retention periods or legitimate interests (e.g. documenting the communication) apply.
Service providers:
• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (email hosting)
• Brevo (Sendinblue), 106 Boulevard Haussmann, 75008 Paris, France (email communication and optional newsletter delivery—only with prior consent, double opt-in for newsletter registration; hosting within the EU at OVH (France/Germany) and Google Cloud (Belgium); no use of tracking pixels or email tracking)
Legal bases:
• Article 6(1)(b) GDPR (processing to perform or initiate a contract, e.g. for quotation requests or customer communication),
• Article 6(1)(f) GDPR (legitimate interest in secure and efficient email operations and maintaining the ability to communicate),
• Article 6(1)(a) GDPR (sending informational or marketing emails with prior consent).
Provision of Online Services / Web Hosting
To provide conceptboard.com and publicly accessible subdomains securely, we use, among others:
Friendventure (web development/design), ALL-INKL, Zendesk (Help Center hosting).
Server log files (see above) serve security/load distribution.
Legal bases: Article 6(1)(f) GDPR (operation/security) and point (b) (for pre-contractual communication).