Ignite Group Privacy Policy

In this privacy policy we explain which personal data we collect via our website www.ignite-group.com, for what purposes, and on what legal basis. We take the protection of your data seriously and process it only in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

1. Data Controller

Ignite GmbH
Ernst-Heckel-Straße 6A
66386 St. Ingbert, Germany

Phone: +49 6894 999 56-0
Email: info@ignite-group.de
Website: www.ignite-group.com

Netherlands office:
Strawinskylaan 4117
1077 ZX Amsterdam

Phone: +31 (0)88 2020 400
Email: info@ignite-group.nl

Managing Directors: Dr. Benjamin Hötzer, Dr. Marc Schaber, Henk Heerink, Maarten Jacobs
Commercial Register: HRB 103148, Amtsgericht Saarbrücken, Germany
VAT ID: DE 305863860

2. Data Protection Officer

Dr. Sebastian Kraska
IITR Datenschutz GmbH
Marienplatz 2
80331 Munich, Germany

Email: email@iitr.de
Website: www.iitr.de

3. Website Hosting and Server Log Files

Our website is hosted by RAIDBOXES GmbH, Hafenweg 16, 48155 Münster, Germany, on servers in Germany. We have concluded a data processing agreement with RAIDBOXES (Art. 28 GDPR).

When you visit our website, our hosting provider automatically collects the following data in server log files:

• IP address of the accessing device
• Date and time of access
• Page visited and volume of data transferred
• Browser type and operating system
• Referrer URL (the page you came from)
• Status code of the request (e.g. 200, 404)

This data is technically required for operating the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing and securing the website).
Retention period: Log files are deleted after 90 days at the latest.

Content Management System: WordPress

Our website runs on the open-source software WordPress, which is installed on our own hosting. No data is transferred to the developers of WordPress.

Content delivery and security: Cloudflare

Our website is delivered via the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects the website against attacks and speeds up delivery. All requests to our website pass through Cloudflare servers; in the process, your IP address and the technical data listed above are processed.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and fast delivery of the website).
Third-country transfer: USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework.
Privacy policy: https://www.cloudflare.com/privacypolicy/

Fonts

All fonts are delivered from our own server. No connection to Google Fonts or other font providers is established.

4. SSL/TLS Encryption

Our website uses SSL/TLS encryption for security purposes. Data you send to us (e.g. via contact forms) is transmitted in encrypted form. You can recognise an encrypted connection by “https://” in your browser’s address bar.

5. Contact

Contact form

When you use our contact form, we process the data you enter (typically name, email address, message) to handle your enquiry. The form is provided by HubSpot (see section 10); your details are transmitted directly to our HubSpot account. To protect against automated submissions, HubSpot uses the security cookie __cf_bm (Cloudflare, duration 30 minutes).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Retention period: We delete your data once your enquiry has been fully handled and no statutory retention obligations apply.

Email and phone

If you contact us by email or phone, we process your contact details and the content of your enquiry. The legal basis and retention period are the same as for the contact form.

6. Appointment Booking

You can book consultation appointments via our website. We process the data you enter (name, email address, preferred date, and any additional information) to handle your appointment request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
Retention period: 12 months after the appointment, unless statutory retention obligations apply.
Provider: Appointment booking is handled via HubSpot (see section 10).

7. Newsletter

When you subscribe to our newsletter, we process your email address and any additional data you voluntarily provide for sending the newsletter.

Sign-up process: We use a double opt-in procedure. After signing up you receive a confirmation email with a link. Your subscription only becomes active after you click that link.
Legal basis: Art. 6(1)(a) GDPR (consent).
Withdrawal: You can withdraw your consent at any time. Every newsletter contains an unsubscribe link.
Sending tool: The newsletter is sent via HubSpot (see section 10).
Tracking: We measure open and click rates to improve the newsletter. Your consent is also the legal basis for this.

8. Job Applications

If you apply via our website or by email, we process your application documents (cover letter, CV, certificates, contact details) for the application procedure.

Legal basis: Art. 6(1)(b) GDPR (initiating an employment relationship).
Retention period: If you are not hired, your data will be deleted no later than 6 months after the end of the procedure, unless you have consented to being included in our talent pool.
Recipients: Within the group of companies, your application may be forwarded to the parent or sister company with your consent or where there is a legitimate interest.

9. Cookies and Consent Management

Our website uses cookies. Cookies are small text files that your browser stores on your device.

Technically necessary cookies are set without consent because they are required for the website to function (e.g. language selection, session management).
Legal basis: Art. 6(1)(f) GDPR.

Analytics and marketing cookies are only set after you give consent. You can withdraw your consent at any time via our cookie banner.
Legal basis: Art. 6(1)(a) GDPR.

Cookie Consent with Cookiebot

Our website uses the cookie consent tool “Cookiebot” to obtain your consent for storing certain cookies on your device or for using specific technologies, and to document this in a privacy-compliant manner. This service is provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter “Cookiebot”).

When you enter our website, a connection is established with Cookiebot’s servers to obtain your consent and other declarations regarding cookie usage. Cookiebot then stores a cookie in your browser to match and remember the consent you have granted or withdrawn. The data collected in this process is stored until you request us to delete it, you delete the Cookiebot cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected.

Legal Basis: Cookiebot is used to obtain the legally required consent for the deployment of non-essential cookies. The legal basis for this processing is Art. 6 (1) (c) GDPR (Compliance with a legal obligation).

Data Processing Agreement: We have concluded a Data Processing Agreement (DPA) with the provider Usercentrics A/S (Cookiebot). This guarantees that data is processed strictly for its intended purpose and in compliance with European data protection standards.

Cookie overview:

Which cookies are actually set depends on your consent decision. Without consent, only technically necessary cookies are set.

10. Web Analytics and Marketing

With your consent, we use various services to analyse website usage and optimise our advertising. These services are integrated via the Google Tag Manager, which does not itself collect personal data but technically triggers the following services.

Google Tag Manager

The Google Tag Manager is a technical management tool. It loads other services (Analytics, Ads, etc.) depending on your consent decision.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically managing tags).

Server-side tagging: Stape

The Google Tag Manager is loaded via our own subdomain (load.trk.ignite-group.com) and processed on a server container operated by Stape. Tracking data is first sent to this server container and only forwarded from there to the services described below, in accordance with your consent decision. This allows us to control which data reaches the individual providers.

Provider: Stape (stape.io)
Legal basis: Art. 6(1)(a) GDPR (consent) for the forwarded tracking data; Art. 6(1)(f) GDPR for the technical operation of the container.
Privacy policy: https://stape.io/privacy-policy

Google Analytics

Google Analytics creates pseudonymous usage profiles of our website. This allows us to analyse usage and improve the website. IP addresses are anonymised.

Provider: Google Ireland Limited
Data collected: Page views, time spent, origin, device information, pseudonymous user ID
Legal basis: Art. 6(1)(a) GDPR (consent).
Third-country transfer: USA. Google LLC is certified under the EU-US Data Privacy Framework.
Opt-out: https://tools.google.com/dlpage/gaoptout
Privacy policy: https://policies.google.com/privacy

Google Ads and Conversion Tracking

We use Google Ads to promote our services. When you reach our website via a Google advertisement, a conversion cookie is set. This allows us to measure whether an advertisement led to an action (e.g. a contact request). We do not receive any data that would allow us to personally identify you.

Provider: Google Ireland Limited
Legal basis: Art. 6(1)(a) GDPR (consent).
Third-country transfer: USA (EU-US Data Privacy Framework).
Opt-out: https://support.google.com/My-Ad-Center-Help/answer/12155451

Microsoft Advertising (Bing UET Tag)

With the Microsoft UET tag we measure whether clicks on our Bing advertisements lead to actions on our website. We can also segment website visitors into audiences for advertisements on the Microsoft advertising network.

Provider: Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18, Ireland
Cookie duration: 390 days
Legal basis: Art. 6(1)(a) GDPR (consent).
Third-country transfer: USA (EU-US Data Privacy Framework).
Opt-out: https://optout.networkadvertising.org/
Privacy policy: https://privacy.microsoft.com/privacystatement

LinkedIn Insight Tag

We use the LinkedIn Insight Tag to measure the effectiveness of our LinkedIn advertisements and to show relevant advertising to website visitors on LinkedIn. LinkedIn receives information such as the URL, referrer, IP address, device and browser characteristics and timestamp, and can associate the visit with your LinkedIn profile if you are logged in.

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Legal basis: Art. 6(1)(a) GDPR (consent).
Third-country transfer: USA (EU-US Data Privacy Framework).
Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
Privacy policy: https://www.linkedin.com/legal/privacy-policy

Microsoft Clarity

Microsoft Clarity analyses how visitors use our website. It records mouse movements, clicks and scrolling behaviour, can record sessions and creates heatmaps from them. Input in form fields is masked and not recorded.

Provider: Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18, Ireland
Legal basis: Art. 6(1)(a) GDPR (consent).
Third-country transfer: USA (EU-US Data Privacy Framework).
Privacy policy: https://privacy.microsoft.com/privacystatement

Leadinfo

We use Leadinfo to recognise visits to our website by companies. Leadinfo uses the IP address to determine whether the visitor belongs to a company and shows us publicly available company information (e.g. company name, address). Leadinfo does not identify individual persons.

Provider: Leadinfo B.V., Rotterdam, Netherlands
Server location: EU
Legal basis: Art. 6(1)(a) GDPR (consent).
Privacy policy: https://www.leadinfo.com/en/privacy/

Ahrefs Web Analytics

We use Ahrefs Web Analytics to measure the reach of our website. The service does not use cookies and does not store IP addresses; page views are only evaluated in aggregated form.

Provider: Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581
Legal basis: Art. 6(1)(a) GDPR (consent).
Third-country transfer: Singapore. The transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Privacy policy: https://ahrefs.com/legal/privacy-policy

HubSpot

We use HubSpot as our CRM system (Customer Relationship Management) and for various marketing functions: contact forms, appointment booking, newsletter delivery, lead tracking and web analytics. HubSpot sets cookies for these purposes.

Provider: HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland (parent company: HubSpot Inc., USA)
Data collected: IP address (truncated), pages visited, time spent, origin, form entries, interaction with emails
Server location: EU (Ireland). In exceptional cases, transfer to the USA (IP truncation applied there).
Cookie duration: Up to 13 months
Legal basis: Art. 6(1)(a) GDPR (consent) for tracking; Art. 6(1)(b) GDPR (performance of a contract) for forms and appointment bookings.
Withdrawal: Via the cookie banner.
Privacy policy: https://legal.hubspot.com/privacy-policy

Interactive Forms and Funnels (Heyflow)

We use the service Heyflow to provide interactive forms, clickfunnels, and to generate user inquiries. The provider is Heyflow GmbH, Jungfernstieg 41-42, 20354 Hamburg, Germany (hereinafter “Heyflow”).

When you enter information into our interactive forms or submit an inquiry, this data is transmitted to and stored on Heyflow’s servers. Heyflow also collects technical log data (e.g., IP address, browser type, date and time of access) to ensure the functionality and security of the service. All data processing takes place exclusively on servers within the European Union.

Legal Basis: The processing of your data via Heyflow is carried out on the basis of Art. 6 (1) (b) GDPR, provided that your inquiry serves the fulfillment of a contract or is necessary for the execution of pre-contractual measures. If there is no contractual context, the usage is based on our legitimate interest (Art. 6 (1) (f) GDPR) in a user-friendly, modern, and efficient method of contact and lead generation.

Data Processing Agreement: We have concluded a Data Processing Agreement (DPA) with Heyflow GmbH in accordance with Art. 28 GDPR. This agreement is an automatic component of the terms of service and obligates Heyflow to process the data of our website visitors strictly for its intended purpose and in compliance with European data protection standards.

11. Embedded External Services

YouTube

On some pages we embed videos from YouTube. The videos do not load automatically: until you start a video, only a preview image from our own server is shown and no connection to YouTube is established. Only when you click play is a connection to YouTube servers established; YouTube then learns which page you visited. If you are logged into your YouTube/Google account, YouTube can associate the visit with your profile.

Provider: Google Ireland Limited
Legal basis: Art. 6(1)(a) GDPR (consent).
Third-country transfer: USA (EU-US Data Privacy Framework).
Privacy policy: https://policies.google.com/privacy

12. Links to Social Networks

Our website contains simple links to our profiles on social networks (e.g. LinkedIn). These are not plugins: no data is transferred to the respective network when you visit our website. Data is only processed by the network once you click a link and are taken to its website; the privacy policy of the respective provider then applies.

13. Transfers to Third Countries

Some of the services listed above transfer personal data to the USA. The transfer is based on the adequacy decision of the European Commission for the EU-US Data Privacy Framework (Art. 45 GDPR), where the respective provider is certified. Details on certification: https://www.dataprivacyframework.gov/

If a provider is not certified, we base the transfer on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

14. Your Rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR): You can request information on whether and which personal data we process about you.
• Rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): You can request the deletion of your data, provided the conditions are met.
• Restriction of processing (Art. 18 GDPR): You can request that we restrict the processing of your data.
• Data portability (Art. 20 GDPR): You can request that we provide your data in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR): You can object to the processing of your data based on Art. 6(1)(f) GDPR (legitimate interest) at any time. We will then no longer process your data unless we can demonstrate compelling legitimate grounds.
• Withdrawal of consent (Art. 7(3) GDPR): Where processing is based on your consent, you can withdraw it at any time. The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, contact us at: info@ignite-group.de

15. Right to Lodge a Complaint

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

The supervisory authority for Ignite GmbH:

Unabhängiges Datenschutzzentrum Saarland (UDZ)
Die Landesbeauftragte für Datenschutz und Informationsfreiheit
Fritz-Dobisch-Straße 12
66111 Saarbrücken, Germany
Website: https://datenschutz.saarland.de

16. Retention Periods

Unless a different retention period is stated in the individual sections, we store your personal data for as long as it is necessary for the respective processing purpose. We then delete the data unless statutory retention obligations apply (e.g. under German commercial and tax law: 6 or 10 years).

17. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in the law or changes in our data processing. The current version can always be found on this page.