PRIVACY

Privacy Notice

English translation for website publication

Status: September 2026

Note: This translation is provided as a faithful English-language version of the German source text. In the event of discrepancies, the German version should be reviewed by legal counsel as the authoritative source.

This Privacy Notice fulfills the information obligations pursuant to Articles 12 et seq. of the EU General Data Protection Regulation (hereinafter "GDPR") and provides you with an overview of the processing of your personal data (hereinafter "Data") on this website.

I. Privacy Notice for the Use of Our Website and Platform

1. Who is responsible for processing my Data?

direct services Gütersloh GmbH
Business Unit Campaign
Reinhard-Mohn-Str. 300
Telephone: +49 5241 80-40865

is responsible for processing your Data on this website (hereinafter the "Company"). The Company processes personal data in accordance with the GDPR and the German Federal Data Protection Act (Bundesdatenschutzgesetz, hereinafter "BDSG").

You may contact the Company’s Data Protection Officer at the postal address stated above, adding "For the attention of the Data Protection Officer", or by email at datenschutz@bertelsmann.de.

2. What Data is collected?

When you visit the website, information is automatically collected from the device accessing it (hereinafter "Access Data"). This Access Data includes server log files, which generally contain information about the browser type and browser version, operating system, internet service provider, date and time of use of the website, websites previously visited, pages newly accessed via the website, and the IP address of the accessing device. With the exception of the IP address, server log files cannot normally be related to an individual. An IP address may constitute personal data if it is permanently assigned when an internet connection is used and the internet service provider can associate it with an individual.

If you continue to use the website’s services, pseudonymous usage profiles and/or the Data entered by you on the website, such as search terms, login Data, ratings, form or contractual entries and click Data, are processed.

Some website services require you to provide personal data to the Company. In these cases, the Data you provide is used to deliver the requested service or process the relevant request. The following personal data is processed on the website: address Data and contact Data.

3. What cookies are used?

Cookies are used on the website. Cookies are small text files stored on your device when you visit a website. The stored cookies are assigned to the browser you use. If the relevant website is accessed again, the web browser sends the cookie content back, enabling the user to be recognized. Certain cookies are deleted when you log out or end the browser session ("transient cookies"). Other cookies are stored for a specified period or permanently ("temporary cookies" or "persistent cookies"). These cookies are deleted automatically once the defined period has expired. You can delete cookies at any time in your browser’s security settings and configure their use according to your preferences. However, the Company points out that you may then be unable to use all website functions.

As a rule, cookies are only online identifiers without a direct personal reference. Cookies become personal data if the information generated by them is combined with other Data. A distinction is made between cookies required to provide the website and cookies required for other purposes, such as analyzing user behavior or advertising.

Cookies required to provide the website include in particular:

• Cookies used to identify or authenticate users.
• Cookies that temporarily store certain user inputs, such as the contents of a shopping cart or an online form.
• Cookies that store certain user preferences, such as search or language settings.
• Cookies that store Data to ensure uninterrupted playback of video or audio content.

Cookies required for other purposes include in particular:

• Analytics cookies used to record user behavior, such as buttons clicked, subpages visited and search queries submitted, and evaluate it statistically.

3.1 Functional Cookies

3.1.1 Cookiebot

Our website loads a web service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter "cookiebot.com"). We use this service to respect your cookie preferences in compliance with the law. In this context, your browser may transmit personal data to cookiebot.com. The legal basis is Article 6(1)(f) GDPR. The legitimate interest consists in the legally compliant placement of cookies according to the website visitor’s cookie selection. The Data is deleted as soon as the purpose of its collection has been fulfilled.

Further information on the handling of transferred Data is available in the privacy policy at www.cookiebot.com. You can prevent the collection and processing of your Data by cookiebot.com by disabling script code in your browser or installing a script blocker, such as those available at www.noscript.net or www.ghostery.com.

3.1.2 Google reCAPTCHA

To ensure adequate Data security when forms are submitted, we use reCAPTCHA from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland in certain cases. The legal basis is Article 6(1)(f) GDPR and Section 25(2) No. 2 TDDDG. Our legitimate interest is to ensure that entries are made by natural persons and are not misused through machine-based or automated processing. reCAPTCHA analyzes visitor behavior using various characteristics, such as IP address, mouse movements and time spent on the page. The Data collected is transferred to Google and evaluated there. It cannot be ruled out that Data may also be transferred to servers of Google LLC in the United States.

3.1.3 Purposes and legal basis of processing

We integrate Cookiebot on the basis of our legitimate interests and Section 25(2) No. 2 TDDDG in order to respect your cookie preferences in compliance with the law. We use reCAPTCHA on the basis of our legitimate interest in preventing fraudulent activities pursuant to Article 6(1)(f) GDPR and Section 25(2) No. 2 TDDDG.

3.1.4 Retention period or criteria used to determine it

The CookieConsent cookie set by Cookiebot is stored for one year. The _GRECAPTCHA cookie set in connection with Google reCAPTCHA is stored for up to 180 days. Session-based storage is deleted when the relevant session ends; persistent entries in Local Storage generally remain until deleted by the user or browser.

3.1.5 Right to object and options for removal

You have the right to object to processing where grounds arise from your particular situation. To exercise this right, please contact the address specified in Section 1.

3.2 Consent-based cookies

Information about cookies that collect and process your Data on the basis of consent is available in Section 4 and in the Privacy Settings.

In the Privacy Settings or Privacy Center, you can decide whether you consent to information being stored on your device and to the collection and processing of such information and other Data by the operator of this website and its partners for the personalization, delivery and measurement of advertising and content within and outside this offering and for analyses of the use of this offering.

4. What Data is collected for which purposes?

The purposes of Data processing may arise from technical, contractual or legal requirements and, where applicable, from consent. We use the Data referred to in Section 2 for the following purposes:

• Providing the website and ensuring technical security, particularly correcting technical errors and ensuring that unauthorized persons cannot access the website’s systems.
• Audience measurement and web analytics to make the website more efficient and interesting for you and to conduct market research.
• Communication, initiation of contracts, customer relationship management, sending newsletters and booking our tours.
• Connecting and networking with us.
• Providing content free of charge.
• Payment processing and credit checks.
• Use of the services on the website in accordance with the Terms and Conditions.

Further information on these processing purposes is provided in the following sections.

4.1 Technical provision of the website

4.1.1 Description and scope of processing

To ensure the website’s functionality, conduct security analyses and defend against attacks, server log files forming part of the Access Data under Section 2 are automatically collected by the accessing computer system when the website is entered and used and are stored for a short period. Server log files are not stored together with other Data. The Company uses them for statistical evaluations, to analyze and remedy technical incidents, prevent attempted attacks and fraud, and optimize the website’s functionality.

4.1.2 Purposes and legal basis

The legal basis for collecting server log files is Article 6(1)(f) GDPR. The Company’s legitimate interests lie in website functionality, security analyses and the prevention of risks.

4.1.3 Retention period

After the website has been accessed, server log files are stored on the web server and the IP address contained in them is deleted after no more than seven days. Evaluation during this period takes place exclusively in the event of an attack.

4.1.4 Right to object and removal

You have the right to object to the processing of your Data in server log files where grounds arise from your particular situation. Please contact the address specified in Section 1.

4.2 Contact form, email and telephone contact

4.2.1 Description and scope of processing

You can contact the Company through a contact form, email address or telephone number. If you use this option, the Data entered in the form, your first name, surname, email address and/or telephone number and your request are transmitted to the Company. Depending on the request, such as questions about Company services, exercising Data subject rights or booking a tour, your contact Data is processed further, with the assistance of service providers where appropriate. If necessary to process your request, your contact Data may be forwarded to third parties, such as partner companies.

4.2.2 Purposes and legal basis

Contact Data is processed on the basis of Article 6(1)(f) GDPR. The legitimate interests lie in handling your request and further communication. If your contact is intended to conclude a contract with the Company, the legal basis is Article 6(1)(b) GDPR.

4.2.3 Retention period

After your request has been processed and further communication has ended, the contact Data is deleted. This does not apply if your contact is aimed at concluding a contract or if you exercise Data subject rights. In such cases, the Data is stored until contractual and/or legal obligations have been fulfilled and statutory retention periods no longer prevent deletion.

4.2.4 Right to object and removal

You have the right to object to processing where grounds arise from your particular situation. Please contact the address in Section 1. If you object, communication cannot be continued. This does not apply where storage is required to initiate or perform a contract or to exercise Data subject rights.

4.3 Newsletter

4.3.1 Description and scope of processing

You may subscribe to our free newsletter on our website to receive current Company news, press information and other relevant content. When you register, we collect your email address. To carry out the legally required double opt-in procedure, we also process your IP address and the date and time of registration and confirmation ("Verification Data"). We use a specialized service provider to send the newsletter and handle its technical delivery.

Tracking, audience measurement and access to terminal devices: We analyze use of the newsletter in order to continuously optimize its content and make it more relevant to readers. When the newsletter is opened, a tracking pixel is loaded so that we can record whether and when it was opened. Links included in the newsletter also contain individual pseudonymous parameters that allow us to determine which links were clicked and when. The evaluation is pseudonymous and based on a technical recipient ID. No combination with other Data sources takes place. Where technically necessary, information is stored on or read from your terminal device, for example by means of cookies or comparable technologies.

Bundled consent: During newsletter registration, we obtain your consent in a clearly identified step: (a) to receive the newsletter; (b) to store and read information on your terminal device pursuant to Section 25(1) TDDDG where required for audience measurement; and (c) to process the tracking Data collected, including opening and click behavior, pursuant to Article 6(1)(a) GDPR. The newsletter cannot be provided without these consents because audience measurement forms part of our newsletter offering.

4.3.2 Legal basis

The newsletter is sent on the basis of your consent pursuant to Article 6(1)(a) GDPR. In the same registration process, because of the close factual connection, we also obtain your consent under Section 25(1) TDDDG for storing and reading information on your terminal device and your consent under Article 6(1)(a) GDPR to evaluate opening and click events.

To document the double opt-in procedure and comply with our accountability obligations, we process your IP address and the registration and confirmation times on the basis of our legitimate interest under Article 6(1)(f) GDPR. This processing serves solely to prove that consent was properly given.

4.3.3 Categories of personal data

• Email address.
• Verification Data: IP address and date and time of registration and confirmation.
• Tracking Data: opening time (pixel retrieval), click events including times, newsletter ID or version, pseudonymous recipient ID and, where applicable, cookie or storage identifiers and technical parameters such as information about the email client used, insofar as required for audience measurement.

4.3.4 Retention period

Your personal data is stored for the duration of your newsletter subscription. After unsubscribing, your Data is initially blocked and stored for up to three years so that proper consent can be demonstrated. It is then deleted by the system. Aggregated or anonymized statistical evaluations without personal reference remain unaffected. If you do not confirm your registration during the double opt-in procedure, your Data is automatically deleted no later than 30 days after registration.

4.3.5 Withdrawal and removal

You may withdraw your consent to receive the newsletter and to the processing described at any time with effect for the future. Use the unsubscribe link at the end of each newsletter or contact us using the details in Section 1. Once your withdrawal is received, we stop sending the newsletter and delete your personal data, taking into account the retention periods above and statutory retention obligations.

4.4 Web tracking

The website incorporates services that optimize user-friendliness and measure the website’s reach. Your Access Data (see Section 2) is collected and user behavior is evaluated using analytics cookies (see Section 3). Personal identification is generally not required for web tracking; when Access Data is collected, the stored IP address is either not used or is used only in shortened form, and pseudonymous usage profiles are created. You may withdraw your consent at any time. Personal usage profiles are created only in exceptional cases and where you have given consent.

Some web-tracking services are provided by service providers that process Data only on the controller’s instructions and not for their own purposes as processors. This is ensured through data processing agreements. If service providers process your Data outside the European Union or European Economic Area ("EU/EEA"), this constitutes a third-country transfer. Such a transfer is permitted if you have consented, the Company has provided safeguards ensuring an adequate level of Data protection comparable to European standards, or the European Commission has recognized the relevant third country as adequate. Third-country transfers for individual services are identified below.

4.4.1 Google Tag Manager

The website uses Google Tag Manager, provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Tag Manager enables web-tracking services and other services integrated into the website to be managed through tags, which are placeholders for website code. Google Tag Manager merely implements these tags. It does not specifically collect personal data. It only triggers other tags that may collect Data and does not itself access that Data. Further information is available at http://www.google.de/tagmanager/use-policy.html.

Information is stored on or accessed from your terminal device on the basis of your consent pursuant to Section 25(1) TDDDG. The associated processing of personal data is based on your consent pursuant to Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future through the Cookie Settings pursuant to Article 7(3) GDPR. This does not affect the lawfulness of processing carried out before withdrawal.

4.4.2 Google Analytics

The website uses Google Analytics, provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics creates a pseudonymous usage profile to optimize the website’s user-friendliness. Pseudonymity is ensured by shortening your IP address before Data is transmitted to Google so that it is not possible to identify you. Google shortens the IP address within EU Member States or other states party to the EEA Agreement. Only in exceptional cases is the full IP address transferred to a Google server in the United States and shortened there. Google uses the information to evaluate use of the website, compile reports on website activities and provide other services relating to website and internet use. The Data is not combined with other Google Data. A data processing agreement ensures that Google processes Data only on the Company’s instructions.

Storage of or access to information on your terminal device is based on consent under Section 25(1) TDDDG; associated personal-data processing is based on Article 6(1)(a) GDPR. The _ga and ga# cookies are stored for a maximum of two years. Consent may be withdrawn at any time through the Cookie Settings with effect for the future.

4.4.3 HubSpot

We use services from HubSpot, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland for marketing, sales and service management on our website. The software enables us to manage customer and user Data and implement and evaluate aspects of online marketing, including analysis of our website and newsletters. Cookies are integrated for analysis and tracking. We use HubSpot to continuously optimize our website and make it more user-friendly, identify which Company services are of interest to customers, users and newsletter subscribers, and contact them for advertising purposes.

HubSpot may collect the following personal data: IP address, geographical location, browser type, duration of visit, pages accessed, user behavior and preferences. The information collected and our website content are stored on servers of HubSpot Ireland. Your IP address is collected only in shortened form, creating a pseudonymous usage profile. Only in exceptional cases is the full IP address transferred to a HubSpot server in the United States and shortened there. It cannot be ruled out that information generated by cookies about your use of our online offering is transferred to and stored on a HubSpot server in the United States. A third-country transfer therefore cannot be excluded and is permitted where you have consented. In addition to your consent, we have entered into EU standard contractual clauses as an appropriate safeguard, under which HubSpot undertakes to maintain an adequate European level of Data protection.

Storage of or access to information on your terminal device for analytics and marketing purposes is based on Section 25(1) TDDDG; associated processing is based on Article 6(1)(a) GDPR. Retention depends on the cookie function. Session cookies are deleted when the session ends. __hssc is stored for up to one day; __hstc and hubspotutk for up to 180 days. Persistent entries, particularly those recording interactions with website content, generally remain until deleted by the user or browser. Consent may be withdrawn at any time through the Cookie Settings. Further information is available in HubSpot Inc.’s privacy policy at http://legal.hubspot.com/de/privacy-policy.

4.4.5 Microsoft Clarity

We use Microsoft Clarity, a web analytics service of Microsoft Corporation, Redmond, WA 98052-6399, USA. Microsoft Clarity allows us to analyze how visitors use our website and interact with its content. In particular, usage and interaction Data such as page views, clicks, scrolling behavior and time spent are collected and evaluated as behavioral metrics, heatmaps and session recordings. We use this information to analyze and optimize our website and improve our products and services.

Microsoft uses cookies and comparable tracking technologies. Based on the current status, these include the _clck and _clsk cookies, _cltk in Local Storage and the c.gif pixel tracker. Depending on the technology, retention ranges from the duration of the session to a maximum of one year. Storage of or access to information on your terminal device is based on consent under Section 25(1) TDDDG; associated processing is based on Article 6(1)(a) GDPR. You may withdraw consent at any time through the Cookie Settings. Further information is available in Microsoft’s Privacy Statement at https://www.microsoft.com/de-de/privacy/privacystatement.

4.4.6 Microsoft Advertising (formerly Bing Ads)

We use Microsoft Advertising, formerly Bing Ads, an online marketing service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. It enables us to measure the effectiveness of advertising and determine whether users perform certain actions on our website after clicking an advertisement delivered by Microsoft (conversion tracking). Cookies and comparable technologies may process information about the device and browser used, IP address, page views, interactions with advertisements, and unique user or device identifiers. Microsoft may use this information to measure advertising reach and effectiveness and provide personalized advertising. If you are logged into a Microsoft service, Microsoft may associate the information collected with your user account.

Based on the current status, the MR, MUID, SRM_B, ANONCHK and SM cookies are used. Depending on the cookie, retention ranges from the session duration to a maximum of one year. Storage of or access to information on your terminal device takes place exclusively on the basis of consent under Section 25(1) TDDDG; associated processing is based on Article 6(1)(a) GDPR. Consent may be withdrawn at any time through the Cookie Settings. Further information is available in Microsoft’s Privacy Statement at https://www.microsoft.com/de-de/privacy/privacystatement.

4.4.7 Embedding YouTube videos

We embed videos from YouTube, provided by Google Ireland Limited. Embedded YouTube videos can be played directly on our website. When a video is activated, a connection is established to Google or YouTube servers. Your IP address, information about the device and browser used, the page visited and information about your interaction with the embedded video may be transferred to Google. If you are logged into your Google or YouTube account, Google may associate the information with your account.

YouTube uses cookies and comparable storage technologies to provide the video function and record interactions. Based on the current status, these include LAST_RESULT_ENTRY_KEY, TESTCOOKIESENABLED, yt-icons-last-purged, ytidb::LAST_RESULT_ENTRY_KEY and YtIdbMeta#databases. Retention ranges from the session duration to permanent storage in Local Storage or IndexedDB until deletion by the user or browser. Storage or access is based exclusively on Section 25(1) TDDDG; associated processing is based on Article 6(1)(a) GDPR. Consent may be withdrawn through the Cookie Settings. Further information is available at https://policies.google.com/privacy?hl=de.

4.4.8 LinkedIn

Our website includes services of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Information about your visit and use of our website may be transferred to LinkedIn. This may include your IP address, information about the device and browser used, and information about access to and use of the website. LinkedIn uses cookies and comparable technologies. If you are logged into LinkedIn while visiting, LinkedIn may associate the information with your LinkedIn account.

Based on the current status, the bcookie, li_gc and lidc cookies are used. bcookie is stored for up to one year, li_gc for up to 180 days and lidc for up to one day. Storage of or access to information on your terminal device is based on Section 25(1) TDDDG; associated processing is based on Article 6(1)(a) GDPR. Consent may be withdrawn through the Cookie Settings. Further information is available at https://at.linkedin.com/legal/privacy-policy.

4.5 Contract and payment processing

4.5.1 Description and scope

In connection with initiating, concluding and performing contracts for the Company’s products and services, the personal data required for these purposes is processed. This may include name, company, contact details, information about ordered or booked services, and invoice and payment Data. Before certain payment methods are granted, particularly payment on account, a credit check may be conducted. Required identification, address and company Data may be transferred to credit agencies, and information for assessing creditworthiness and default risk may be obtained from them. The result may be considered when deciding whether to grant the relevant payment method.

4.5.2 Purposes and legal basis

Processing for contract initiation and performance, provision of agreed services, and invoicing and payment is based on Article 6(1)(b) GDPR. Credit checks are based on Article 6(1)(f) GDPR. Our legitimate interest is to assess the creditworthiness of contractual partners and avoid or minimize payment defaults and other economic risks. Processing required to comply with legal obligations, particularly commercial or tax obligations, is based on Article 6(1)(c) GDPR in conjunction with Sections 257 HGB and 147 AO.

4.5.3 Retention period

Personal data is generally stored for the duration of the contractual relationship. After it ends, Data is deleted unless statutory retention obligations require continued storage. Credit-check Data and results are stored only as long as required for the decision on the relevant payment method and mitigation of the associated risk. Contractual, invoice and accounting records are subject in particular to statutory retention periods of six to ten years under Section 257 HGB and Section 147 AO. Data is deleted after the applicable period unless another legal basis permits continued storage.

4.5.4 Right to object and removal

Where processing is required under Article 6(1)(b) GDPR to initiate or perform a contract or under Article 6(1)(c) GDPR to comply with legal obligations, there is no right to object under Article 21(1) GDPR. You may object to a credit check based on Article 6(1)(f) GDPR for reasons arising from your particular situation. Processing generally cannot be ended early where the Data remains required for the stated purposes.

4.6 Downloading free content, such as studies and white papers

4.6.1 Description and scope

You can download content provided by us, such as studies or white papers on current topics in our business areas. Your contact details are transmitted to and stored by us through the registration form. We also record the date and time of the download. The download is voluntary, free of charge and generally independent of other website offerings. Further details are set out in the contractual terms and Terms and Conditions.

4.6.2 Purposes and legal basis

The download of free content is an online offering from us to you. The legal basis for processing the Data collected in this connection is a contract under Article 6(1)(b) GDPR.

4.6.3 Retention period

Your Data is stored for as long as required to perform the contract concerning the download. The contract ends automatically upon successful download. After termination, Data is stored until contractual and/or statutory retention periods have been fulfilled.

4.6.4 Right to object

Processing is required to perform the contract concerning the download of free content. You therefore have no right to object in this respect.

4.7 External services and content on our website

We integrate external services or content into our website. When you use such a service or third-party content is displayed, communication Data is exchanged between you and the relevant provider for technical reasons.

The provider may also process your Data for its own additional purposes. To the best of our knowledge and belief, we have configured services or content from providers known to process Data for their own purposes so that communication for purposes other than displaying the content or service does not take place, or only takes place once you actively choose to use the service. However, as we have no influence over the Data collected by third parties or their processing, we cannot provide binding information on its purpose and scope.

Please consult the privacy notices of the providers responsible for the integrated services or content: YouTube: https://policies.google.com/privacy?hl=en; LinkedIn: https://at.linkedin.com/legal/privacy-policy.

5. Who receives my Data?

Within the Company, access is granted to the departments that require your Data for the purposes described in Section 4. Service providers used by the Company may also receive access as processors, such as data centers, newsletter delivery providers or customer service providers. Data processing agreements ensure that these providers are bound by instructions, maintain Data security and treat your Data confidentially.

Data is disclosed to other recipients, such as advertising partners, social media providers or banks ("third parties"), where required by law or where you have consented. These third parties include in particular:

• Measurement and web analytics providers that measure website reach and create usage profiles for their own purposes.
• Social media service providers.

Further information on disclosure to individual third parties is provided under the relevant purposes in Section 4.

6. Is my Data processed outside the EU or EEA (third-country transfer)?

If service providers and/or third parties referred to in Sections 4 and 5 process your Data outside the EU/EEA for the purposes in Section 4, your Data may be transferred to a country that does not guarantee a level of Data protection adequate to EU/EEA standards. An adequate level may nevertheless be ensured by appropriate safeguards, such as standard contractual clauses issued by the European Commission. You may request a copy of these safeguards using the contact details in Section 1. Exceptionally, safeguards may not be required where you consent or the transfer is necessary to perform your contract with the Company. The European Commission has also recognized certain countries as providing an adequate level of protection.

Some or most of the social media providers named in Section 4 are located outside the EU. Data is therefore transferred to third countries, particularly the United States. This transfer is permitted on the basis of your prior consent. Please note that a transfer outside the European Union may result in your Data being sent to a country that does not provide the same Data protection standard as the European Union. We have no influence over the Data collected or processing carried out by social media providers and do not know the full scope of collection, purposes or retention periods. We also have no information about deletion by Instagram.

7. What Data protection rights do I have?

You have the right at any time to obtain information about personal data stored concerning you. If Data is incorrect or no longer current, you have the right to request rectification. You also have the right to request erasure or restriction of processing in accordance with Articles 17 and 18 GDPR. You may also have a right to receive Data you have provided in a commonly used, machine-readable format (Data portability).

If you have consented to processing for specific purposes, you may withdraw consent at any time with effect for the future. Withdrawal should be addressed to the Company using the contact details in Section 1. Consent given on the website may also be withdrawn at info@campaign-services.de.

Under Article 21 GDPR, you have the right, on grounds relating to your particular situation, to object at any time to processing based on Article 6(1)(f) GDPR. You also have the right at any time to object to processing for direct marketing purposes. The same applies to automated procedures involving individual cookies unless they are strictly necessary to provide the website.

You may also lodge a complaint with a Data protection supervisory authority. The authority responsible for the Company is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestrasse 2-4
40102 Düsseldorf

You may also contact the supervisory authority responsible for your place of residence.

8. To what extent is automated decision-making used?

We do not use fully automated decision-making for the purposes described in Section 4.

9. Does profiling take place?

No automated decision-making, including profiling, within the meaning of Article 22(1) and (4) GDPR takes place.

10. Final information and version

As the website is developed and new technologies are implemented to improve our service, changes to this Privacy Notice may become necessary. We therefore recommend that you review it from time to time.

Status: September 2026

II. Privacy Notice on the Processing of (End) Customer Data by Our/Your Contractual Partners

The following Privacy Notice provides an overview of the processing of your personal data ("Data") in connection with the use of our platform by one of our and your contractual partners, clients or employers. The controller responsible for this processing is the respective contractual partner, client or employer that processes your Data on the platform. The Company processes this Data exclusively on that party’s behalf and in accordance with its instructions.

1. Who is responsible for processing my Data?

The controller within the meaning of Article 4 No. 7 GDPR for the processing described below is the contractual partner with whom you have concluded a contract. The contact details of the contractual partner on whose behalf we carry out the processing described below can be found in that partner’s privacy notice or, alternatively, in the legal notice of the partner’s website through which you concluded the contract, or in subsequent correspondence such as email, invoices or contractual documents.

This website is operated by:
direct services Gütersloh GmbH
Reinhard-Mohn-Str. 300
33333 Gütersloh
info@campaign-services.de

References below to "we", "us" or the "Company" mean direct services Gütersloh GmbH. We process your personal data solely on behalf of your contractual partner, employer and/or client as a sub-processor, in accordance with the GDPR and BDSG.

direct services Gütersloh GmbH accepts no liability for the currentness, accuracy, completeness or quality of the following Privacy Notice or for its compliance with the GDPR and BDSG. This responsibility rests exclusively with the competent controller under Article 4 No. 7 GDPR.

You can contact the Data Protection Officer of your contractual partner, employer or client using the information on its website or in correspondence or contracts. You can contact our Data Protection Officer at the postal address above, adding "For the attention of the Data Protection Officer", or at datenschutz@bertelsmann.de.

2. Which categories of personal data are processed?

The following personal data is regularly entered into and processed on the platform by your contractual partner where you are an (end) customer of that partner: first and last name, email address, telephone number, postal address, age or age group, gender, customer status and segment, contractual and order Data, purchase and transaction history, product interests and preferences, usage and interaction Data, and other characteristics, categories or assignments created by the contractual partner. These may be used in particular for customer communications, segmentation and campaign personalization.

The nature and scope of Data processed depend on the relevant contractual partner and specific use case. In individual cases, additional personal data may therefore be processed and, where required for the purpose and permitted by Data protection law, special categories of personal data under Article 9(1) GDPR may also be processed.

The relevant contractual partner, as controller, determines which Data is entered into and processed on the platform. Further information about processing and Data categories is available from your contractual partner.

3. What Data is processed for which purposes?

Personal data under Section 2 is entered into the platform by your contractual partner. Further information on the processing and purposes for which your Data is used within the platform is available from your contractual partner.

4. What legal basis applies to processing?

The legal basis under Article 6 GDPR for processing your Data under Section 2 is closely linked to the specific purposes determined by the controller. Please contact the relevant controller in accordance with Section 1 for information about the purposes and legal bases of processing.

5. What retention period or criteria for determining it apply?

Under the GDPR, Data may be stored only for as long as required for the purposes pursued. Please contact the relevant controller in accordance with Section 1 for information on the retention period or the criteria used to determine it.

6. Who receives my Data?

Service providers used as processors may receive access to your Data. The Data required in each case is transferred to such processors to carry out and ensure the processing requested by the controller. Processors are also used for the technical provision of this website. Other commissioned service providers receive your Data where necessary to implement the processing requested by the controller, for example postal service providers. For information about transfers by the controller responsible for you to processors, other service providers and third parties, please contact that controller in accordance with Section 1.

7. Is my Data processed outside the EU or EEA (third-country transfer)?

Service providers may be located outside the EU/EEA. For information about transfers of your Data by the controller responsible for you outside the EU/EEA and the lawfulness of such transfers, please contact that controller in accordance with Section 1.

8. What rights do I have in relation to my Data?

You have the right at any time to obtain information about personal data stored concerning you. If Data is incorrect or no longer current, you have the right to request rectification. You also have the right to request erasure or restriction of processing in accordance with Articles 17 and 18 GDPR. Where you have provided Data to the controller and processing is automated and based on your consent or a contract with you, you have the right to receive the Data you provided in a structured, commonly used and machine-readable format (Data portability).

You may object to processing in accordance with Article 21 GDPR.

If you wish to exercise your rights or have general questions about Data protection, you may contact your contractual partner, employer or client. Alternatively, you can use our contact details in Section 1; we will forward your request to the relevant contractual partner, employer or client.

You may also lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2-4, 40213 Düsseldorf; telephone +49 211 38424-0; fax +49 211 38424-10; email poststelle@ldi.nrw.de.

You must ask your contractual partner, employer or client which authority is responsible for it. You may also contact the authority responsible for your place of residence, which will forward your request to the competent authority.

9. From which source does my Data originate?

We receive your Data under Section 2 from your contractual partner, employer or client in order to carry out the agreed processing as a sub-processor.

Status: September 2026