Privacy Policy
This privacy policy explains which personal data we process when you visit www.xingu-ad.com, for which purposes and on which legal basis.
1. Controller
Xingu Advertising GmbH
Dachauer Straße 15c
80335 München, Germany
E-mail: hello@xingu-ad.com
Phone: +49 15678 500301
Managing Directors: Dr. Robert Mayer-Uellner, Manuel Siedler, Alexander Nelkenstock
District Court München, HRB 238630
2. Hosting and server log data
The website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner is our processor. When you open the website we process technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. This serves to deliver and secure the website. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest being secure operation. We delete the logs after 30 days at the latest. We keep individual entries longer only if a security incident requires it, and only until it is resolved.
Fonts and videos are served from our own servers. Links to Google Maps only open Google Maps after you click them.
3. Contact form and Service Finder
If you write to us through the contact form or request a first call through the Service Finder, we process what you enter (name, company, e-mail address, optionally phone number, your message or the Service Finder answers and the resulting recommendation) together with the page you sent it from. The data goes to an application server operated by us and by e-mail to our inbox. We use your IP address briefly to protect the form against misuse.
To manage enquiries, we transmit name, e-mail address and message to our CRM provider HubSpot (section 6). If you have accepted analytics cookies, HubSpot additionally links the enquiry to your visitor ID (cookie hubspotutk).
The legal basis is handling your enquiry and, where applicable, preparing a contract (Art. 6 (1) (b) GDPR). The transfer to HubSpot is based on our legitimate interest in handling enquiries in an orderly way (Art. 6 (1) (f) GDPR). We keep the data as long as needed to handle it, and beyond that only under statutory retention duties.
4. XQI check
If you use the XQI check, the ASIN you enter is processed on our own servers to calculate the result. No personal data is required for this.
5. Applications
If you apply to us, we process your details and documents to decide on the employment (Art. 6 (1) (b) GDPR). If we do not hire you, we delete your data within four weeks unless agreed otherwise in writing.
6. Cookies, consent and services used
We use services that are not strictly necessary only with your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You make your choice in the cookie banner. You can change or withdraw it at any time through “Cookie settings” in the footer of every page; withdrawal applies to the future. Details are in the Cookie Policy.
- HubSpot (HubSpot Ireland Ltd., 1 Sir John Rogerson’s Quay, Dublin 2, Ireland): CRM, cookie banner and visitor analytics. Data is processed in the EU, HubSpot is our processor. We load the script for the cookie banner on every page view so that we can ask for your consent; HubSpot receives your IP address in doing so (Art. 6 (1) (f) GDPR). HubSpot sets the visitor analytics cookies only after your consent. Without consent, HubSpot still counts the page view, but without cookies and without storing anything on your device: it receives the page you open and its title, the page you came from, screen size, colour depth, browser language and a random identifier that is not stored in your browser. We use this to see how often which pages are viewed. The legal basis is our legitimate interest in this audience measurement (Art. 6 (1) (f) GDPR); you can object to it (section 9).
- Google Tag Manager (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland): Embeds Google Analytics and Google Ads conversion tracking. We load the Tag Manager only after you have accepted analytics or marketing cookies; from then on Google receives your IP address. The website passes the categories you accepted on to the services through Google Consent Mode.
- Google Analytics 4 (Google Ireland Ltd.): Audience measurement, meaning which pages are opened and how the website is used.
- Google Ads (Google Ireland Ltd.): Conversion tracking, meaning whether a visit through one of our ads led to an enquiry. We do not use remarketing.
7. Recipients and transfers to third countries
Recipients of your data are the providers named above, which we have contractually bound as processors where they act in that role. Within our group of companies we share data where needed to handle your enquiry or application. We transmit data to authorities and courts only where we are obliged to.
With Google and HubSpot, a transfer to parent companies in the USA cannot be ruled out. Google LLC and HubSpot, Inc. are certified under the EU-U.S. Data Privacy Framework. The transfer relies on the European Commission’s adequacy decision for it and, where needed, on standard contractual clauses.
8. Retention
We delete personal data once the purpose ends or you withdraw your consent, unless statutory retention duties apply. Commercial and tax records are kept for six to ten years (§ 257 HGB, § 147 AO).
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3)).
Right to object: You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (Art. 21). You can object to processing for direct marketing at any time without giving reasons.
For all requests, an e-mail to hello@xingu-ad.com is sufficient.
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
10. Obligation to provide data, automated decisions
You are not obliged to provide data. Without your details we cannot handle an enquiry or application, though. Automated decision-making under Art. 22 GDPR does not take place.
11. Changes
We update this policy when the website or the law changes. The version published here applies.