Privacy Policy & Disclaimer

Data Protection at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website. Detailed information about the individual processing activities can be found in the following sections of this Privacy Policy.

Who is responsible?

The processing of personal data on this website is carried out by IdoubleS Cybersecurity GmbH. Contact details can be found in the section “Information on the Controller”.

What data do we process?

Your data is processed, firstly, when you provide it to us, particularly through our contact form, when you register for our events, when you request a download, by email, by telephone or by fax. In addition, technically necessary connection and log data is processed when you access our website. Further data is processed by analytics, media or third-party services only in accordance with the sections below and – where required – after your prior consent.

What do we use your data for?

We process data in particular to provide our website securely and reliably, to handle contact and business inquiries, to run our events, to provide downloads and – where you have given your consent – to analyze the use of our website or provide external content. Our website serves to provide information about our company and our products and services; products and services are not provided or ordered directly through this website. Contact or business inquiries may, however, serve to initiate a business relationship.

What rights do you have?

You have, in particular, rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent previously given with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. Details can be found later in this Privacy Policy.

Non-essential analytics and third-party services are used only in accordance with the information below and, where legally required, are activated only after you have given your consent.

Scope of this Privacy Policy

This Privacy Policy provides information about the processing of personal data when visiting and using the IdoubleS corporate website. It applies in particular to the technical provision of the website, contact and business inquiries, event registrations, downloads, web analytics and the integration of the external services and content described below.

The website provides information about IdoubleS and our products, services, research and other corporate activities. Where personal data is processed in connection with separately provided IdoubleS products or services, separate privacy information or contractual data-protection provisions may apply.

Information about the security measures we use and transport encryption can be found in the section “SSL or TLS Encryption”.

Information on the Controller

The controller responsible for data processing on this website is:

IdoubleS Cybersecurity GmbH
Mr. Romman Khan
Weimarer Str. 13
61130 Nidderau
Germany

Telephone: +49 (0) 6187 2004572
Email: dataprivacy@idoubles.net

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

General Information on the Legal Bases for Data Processing on this Website

The legal basis applicable to each processing activity is specified in the relevant section of this Privacy Policy.

Where we obtain your consent, processing is based on Article 6(1)(a) GDPR. Where processing is necessary to handle an inquiry aimed at entering into or performing a contract, Article 6(1)(b) GDPR may apply. Processing required to comply with legal obligations is based on Article 6(1)(c) GDPR. Where we rely on legitimate interests, processing is based on Article 6(1)(f) GDPR; the relevant legitimate interest is explained in connection with the respective processing activity.

The storage of information on your terminal device or access to information stored there is additionally subject to the requirements of Section 25 TDDDG. Access that is not strictly necessary generally takes place only after your consent pursuant to Section 25(1) TDDDG.

Information about transfers to third countries can be found in a separate section.

Recipients of Personal Data and Processors

As part of our business activities, we cooperate with various external parties.

Where necessary for the purposes described in this Privacy Policy and legally permitted, personal data may be disclosed in particular to hosting and IT service providers, providers of analytics, security, media or social-media services, professional advisers, authorities or other recipients legally entitled to receive the data. The specific providers used are identified in the respective sections of this Privacy Policy.

Service providers that process personal data solely on our behalf are engaged on the basis of a contract pursuant to Article 28 GDPR. Where a provider processes personal data as an independent controller or as a joint controller, the actual roles of the parties are taken into account accordingly.

International Data Transfers

Some of the providers referred to in this Privacy Policy may process personal data outside the European Economic Area (EEA), particularly in the United States, or transfer data there. Such transfers take place only in accordance with Articles 44 et seq. GDPR.

Where the relevant US recipient is certified under the EU-U.S. Data Privacy Framework, the transfer may be based on the adequacy decision of the European Commission pursuant to Article 45 GDPR. Where no applicable adequacy decision exists, the providers concerned use appropriate safeguards pursuant to Article 46 GDPR where applicable, in particular the European Commission’s Standard Contractual Clauses.

Further information about the applicable transfer mechanisms can be found in connection with the relevant services. You may also request information about appropriate safeguards by contacting dataprivacy@idoubles.net.

Storage Period

Where possible, we specify a concrete retention period or the criteria used to determine it in connection with each individual processing activity. Unless a more specific storage period has been stated within this Privacy Policy, your personal data will remain with us until the purpose for data processing no longer applies. If you request deletion of your data and the legal requirements for deletion are met, or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for continued storage. These may include statutory retention obligations or the establishment, exercise or defense of legal claims. The relevant data will be deleted once these grounds cease to apply.

Hosting and Server Log Files – STRATO

We host our website with STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (“STRATO”). When you access our website, STRATO processes technically necessary server and connection data. This may include, in particular, the IP address, date and time of access, the requested resource, referrer information and information about your browser and terminal device. The processing serves to deliver the website, ensure technical stability and detect and defend against attacks.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and reliable provision of our corporate website.

According to STRATO’s current information, non-anonymized IP addresses are retained for a maximum of seven days for the detection and defense against attacks. Webserver log files made available to the website operator contain anonymized IP addresses.

We have concluded a data processing agreement with STRATO pursuant to Article 28 GDPR.

Further information can be found in STRATO’s Privacy Policy.

Cookies and Consent Management

Our website uses cookies and comparable technologies where these are used to provide certain functions.

Where the statutory requirements are met, storage or access that is strictly necessary on your terminal device takes place on the basis of Section 25(2) TDDDG. Any subsequent processing of personal data is based on the legal basis specified for the relevant processing activity.

Non-essential cookies and comparable technologies, particularly for web analytics or the integration of certain external services, are used only after your prior consent pursuant to Section 25(1) TDDDG and – where personal data is processed – Article 6(1)(a) GDPR.

You may change or withdraw consent previously given at any time with effect for the future via the “Cookie Settings” link available on our website. There you will also find information about the specific cookies and technologies used, their providers, purposes and storage periods.

Browser settings may additionally be used but do not replace the consent-management functionality provided by us.

Google Analytics

Google Analytics 4 (Google Ireland Limited)

We use Google Analytics 4 (“Google Analytics”), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to statistically analyze the use of our website and improve our information offering.

Google Analytics may process, in particular, information about page views, interactions with the website, browser and device information, approximate location information and online identifiers. According to Google, IP addresses are not logged or stored in Google Analytics 4.

Advertising or personalization features are used only where they are actually configured, transparently disclosed in our consent-management tool and covered by your consent.

Google Analytics is activated on our website only after you have given your consent. The legal bases are Article 6(1)(a) GDPR and, where information is stored on or read from your terminal device, Section 25(1) TDDDG. You may withdraw your consent at any time via “Cookie Settings”.

The retention period for user- and event-related data in our Google Analytics configuration is up to 14 months.

Processing by Google LLC in the United States cannot be ruled out. Information about the applicable transfer mechanisms can be found in the section “International Data Transfers”.

Google reCAPTCHA v3 / Spam Protection

To protect our forms – the contact form, the download form and the event registration form – against automated access, spam and other abusive behavior, we use Google reCAPTCHA v3. Google processes customer data processed in connection with reCAPTCHA as a processor on behalf of IdoubleS in accordance with the applicable Google Cloud contractual terms and the Google Cloud Data Processing Addendum.

reCAPTCHA v3 operates in the background and uses a risk-based scoring system to assess whether an interaction with our forms is likely to originate from a human user or an automated system. For this purpose, in particular the IP address, browser and device information as well as technical interaction and usage data may be processed. reCAPTCHA v3 also uses the _GRECAPTCHA cookie for risk analysis.

We use reCAPTCHA v3 for security purposes and to detect and prevent spam and automated abuse of our forms. The processing of personal data is based on Article 6(1)(f) GDPR. Our legitimate interest consists in protecting our website, IT systems and forms against automated abuse and spam.

We have entered into the contractual arrangements required for processing pursuant to Article 28 GDPR with Google or use reCAPTCHA under the applicable Google Cloud data-processing terms.

Under Google’s current reCAPTCHA framework, Google’s general Privacy Policy and Terms of Service should no longer be presented as the contractual basis for processing reCAPTCHA customer data, because Google processes reCAPTCHA customer data as a processor. Information about any processing outside the EEA can be found in the section “International Data Transfers”.

LinkedIn and External Social Networks

Our website contains links to our presence on LinkedIn. Merely accessing our website through such a simple link does not establish a connection to LinkedIn. Only when you click the link do you leave our website, at which point LinkedIn may process personal data. For users in the European Economic Area, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, is responsible for the processing carried out there.

Information about LinkedIn’s processing of personal data can be found in LinkedIn’s Privacy Policy.

Contact Form

If you contact us using the contact form, we process the data you enter in the form, in particular your contact details and the content of your inquiry, in order to handle your request and, where necessary, respond to follow-up questions.

Where we use service providers to operate the contact form or handle your inquiry, or where disclosure is required for other legally permitted reasons, this takes place in accordance with the section “Recipients of Personal Data and Processors”.

If your inquiry is aimed at initiating or performing a contract, processing is based on Article 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest in the proper and efficient handling of inquiries pursuant to Article 6(1)(f) GDPR. Processing on the basis of Article 6(1)(a) GDPR takes place only where we expressly obtain consent for an additional processing purpose.

Information marked as mandatory is required in order for us to process and respond to your inquiry. Without this information, we may not be able to process your request.

The data will be deleted once your inquiry has been conclusively handled and no statutory retention obligations, legitimate documentation interests or other legal grounds prevent deletion.

Registration for Webinars and Workshops

If you register for a webinar or workshop using our registration form, we process your first and last name, your email address, your position, your company, the sessions you select and your answer to how you heard about the event. You may optionally provide your telephone number. We process your postal address only if you reserve a printed copy of the accompanying book.

We process this data in order to handle your registration, to organize and run the event and to send you a registration confirmation with a calendar invitation as well as organizational information about the event. The processing is based on Article 6(1)(b) GDPR. We process your answer to how you heard about the event on the basis of our legitimate interest in assessing the effectiveness of our communication channels (Article 6(1)(f) GDPR).

If you reserve a printed copy of the book, we use your name and postal address to send you the book. For this purpose, these details may be passed on to the postal or shipping service provider we engage. The processing is based on Article 6(1)(b) GDPR.

If you consent to receiving future information about webinars, workshops and product releases, we use your email address for this purpose on the basis of Article 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future, in particular by email to dataprivacy@idoubles.net.

The data will be deleted once it is no longer required for running and following up on the event and no statutory retention obligations, legitimate documentation interests or other legal grounds prevent deletion. Data that we process on the basis of your consent is stored until you withdraw your consent.

Downloading Resources

To download certain resources, such as research papers, we ask for your name, your email address and your company; you may optionally provide your telephone number. We process this information together with the name of the requested resource in order to provide the download and to understand which content is of interest to which organizations.

The processing is based on Article 6(1)(b) GDPR for providing the requested resource and on our legitimate interest in assessing the interest in our content and initiating business relationships (Article 6(1)(f) GDPR).

The data will be deleted once it is no longer required for these purposes and no statutory retention obligations, legitimate documentation interests or other legal grounds prevent deletion.

Origin of Inquiries (Campaign and Referrer Information)

When you submit one of our forms, we transmit together with your details the page through which you entered our website, the domain of a referring website and, where applicable, campaign parameters contained in the link you followed (e.g. utm_source, utm_medium, utm_campaign). This information is kept only in your browser’s memory during your visit; no information is stored on your terminal device for this purpose.

We use this information to evaluate through which channels and campaigns inquiries and registrations reach us. The processing is based on our legitimate interest in evaluating our communication and marketing activities (Article 6(1)(f) GDPR).

Google Ads click identifiers (gclid, gbraid, wbraid) are transmitted only if you have consented to the “Marketing” category in the “Cookie Settings” (Article 6(1)(a) GDPR).

This information is stored together with the respective inquiry or registration and deleted along with it.

Inquiries by Email, Telephone or Fax

If you contact us by email, telephone or fax, we process the contact details you provide and the content of your inquiry in order to handle your request and, where necessary, respond to follow-up questions.

Information about possible recipients can be found in the section “Recipients of Personal Data and Processors”.

If your inquiry is aimed at initiating or performing a contract, processing is based on Article 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest in the proper handling of communications addressed to us pursuant to Article 6(1)(f) GDPR.

The data will be deleted once the matter has been concluded and no statutory retention obligations, legitimate documentation interests or other legal grounds justify further storage.

Email Delivery and Mailboxes – Microsoft 365

The information submitted through our forms is forwarded by our server by email to our mailboxes; we also send registration confirmations by email. For this purpose, and for our email communication in general, we use Microsoft 365 (Exchange Online) provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Microsoft processes the data as a processor on the basis of the Microsoft Products and Services Data Protection Addendum pursuant to Article 28 GDPR. The processing is based on the legal basis stated for the respective inquiry or registration and on our legitimate interest in secure and efficient email communication (Article 6(1)(f) GDPR).

Processing by Microsoft Corporation in the United States cannot be ruled out. Information about the applicable transfer mechanisms can be found in the section “International Data Transfers”.

YouTube Videos

We embed videos from the YouTube platform on our website in privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

A video is loaded only after you enable it using the “Load video” button or have consented to the “External media” category in the “Cookie Settings”. Until then, no connection to YouTube is established.

If you enable the video, a connection to Google/YouTube is established. In particular, your IP address, browser and device information and information about the page accessed may be transmitted to Google. If you are simultaneously logged into a Google or YouTube account, Google may be able to associate this information with your account.

The legal bases for activation are your consent pursuant to Article 6(1)(a) GDPR and, where information is stored on or read from your terminal device, Section 25(1) TDDDG. You may withdraw consent at any time via our Cookie Settings.

Processing in the United States may take place. Information about the applicable transfer mechanisms can be found in the section “International Data Transfers”.

SSL or TLS Encryption

This website uses SSL or TLS encryption to secure data transmission and protect confidential content, particularly contact inquiries.

You can generally recognize an encrypted connection by the use of “https://” in your browser’s address bar.

Transport encryption is intended to protect data against unauthorized access and manipulation while it is being transmitted. It cannot, however, guarantee the absolute security of the terminal devices or systems involved.

Withdrawal of Consent

Many data processing operations are only possible with your express consent. You may withdraw consent already granted at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

You may change or withdraw consent relating to cookies, web analytics and consent-dependent third-party services at any time via the “Cookie Settings” link on our website. Other consent may in particular be withdrawn by contacting dataprivacy@idoubles.net.

Right to Object, Including Direct Marketing

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL THEREAFTER NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ARTICLE 21(2) GDPR).

You may submit an objection in particular by contacting dataprivacy@idoubles.net.

Access, Rectification and Erasure

You have, subject to the applicable statutory requirements, the right to access the personal data concerning you (Article 15 GDPR), as well as the right to rectification of inaccurate data (Article 16 GDPR) and erasure of your personal data (Article 17 GDPR). To exercise these rights, you may in particular contact dataprivacy@idoubles.net.

Right to Restriction of Processing

You have the right to request the restriction of processing of your personal data. You may contact us at any time regarding this. The right to restriction of processing exists in the following cases:

• If you contest the accuracy of your personal data stored by us, we generally require time to verify this. For the duration of the verification, you have the right to request restriction of the processing of your personal data.
• If the processing of your personal data is unlawful and you request restriction of its use instead of erasure.
• If we no longer need your personal data, but you require it for the exercise, defense, or assertion of legal claims, you have the right to request restriction of processing instead of deletion.
• If you have lodged an objection pursuant to Article 21(1) GDPR, a balancing of interests between your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may – apart from storage – only be processed with your consent or for the assertion, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

The right to restriction of processing is governed by Article 18 GDPR. To exercise this right, you may in particular contact dataprivacy@idoubles.net.

Right to Data Portability

You have, subject to the requirements of Article 20 GDPR, the right to receive personal data that you have provided to us and that we process on the basis of your consent or a contract by automated means in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that the data be transmitted directly to another controller.