Privacy Policy of Dealcode GmbH

for the marketing website dealcode.ai, the CRM & sales platform app.dealcode.ai, the mobile event lead scanner scanner.dealcode.ai, and the booking platform meetings.dealcode.ai

As of: September 2026

1. Introduction, Scope & Contact Details

Below we inform you about the collection and processing of personal data when using our services.

1.1. Scope of this Policy

This Privacy Policy applies to: 1. our public marketing website at https://www.dealcode.ai/ (including all subpages and the Trust Center), 2. our cloud-based B2B CRM and sales platform at https://app.dealcode.ai/ (hereinafter "Platform"), 3. our mobile web application for trade fair and event lead capture at https://scanner.dealcode.ai/ (hereinafter "Lead Scanner App"), 4. our integrated calendar booking platform at https://meetings.dealcode.ai/ (hereinafter "Booking Subdomain"), and 5. our corporate social media presences (e.g. LinkedIn).

Personal data means any information relating to an identified or identifiable natural person (e.g. name, professional contact details, IP address, email content).

1.2. Data Controller

The Data Controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) for data processing in connection with the operation of the website dealcode.ai, customer account administration, and technical platform provisioning is:

Dealcode GmbH
c/o SPACE Hamburg
Am Sandtorkai 27
20457 Hamburg
Germany

Phone: +49 40 822 116 30
Email: contact@dealcode.ai / datenschutz@dealcode.ai
Commercial Register: HRB 168195 (Local Court of Hamburg)
Managing Directors: Alexander Weltzsch, Dennis Hilger
VAT ID: DE341860858

1.3. Data Protection Officer

We have appointed an external Data Protection Officer:

Martin Bastius
heyData GmbH
Kantstraße 99, 10627 Berlin
Germany
Email: datenschutz@heydata.eu
Website: www.heydata.eu

2. Differentiation of Roles under GDPR: Controller vs. Processor

To ensure complete legal transparency, we strictly distinguish between two data processing roles:

2.1. dealcode as Data Controller (Art. 4(7) GDPR)

dealcode acts as the Data Controller for processing activities that: relate to visits and interactions with our public marketing website dealcode.ai; govern the establishment, execution, and billing of subscription agreements with our corporate customers (e.g. administrator credentials, billing and payment details, role management, customer support communications); concern security-relevant system telemetry and audit trails (server logs, anti-fraud trails).

2.2. dealcode as Data Processor (Art. 28 GDPR)

Where the customer or its authorized users utilize the platform app.dealcode.ai or the Lead Scanner App scanner.dealcode.ai as a B2B CRM system to create, import, synchronize, manage, or enrich contact records of their business partners, prospects, leads, notes, emails, or calendar data ("CRM Customer Data"), dealcode acts exclusively as a technical Data Processor within the meaning of Art. 28 GDPR.

The customer is and remains the sole Data Controller pursuant to Art. 4(7) GDPR for such CRM Customer Data.
dealcode processes this data strictly upon documented instruction on the basis of a separate Data Processing Agreement (DPA).
The customer is responsible for ensuring that a lawful basis exists for the collection, storage, enrichment, and business communication with contacts stored in the CRM (e.g. Art. 6(1)(f) GDPR in conjunction with applicable unfair competition laws) and that statutory information duties under Art. 14 GDPR are fulfilled.

3. Technical Infrastructure, Domain Registration & 100% Google Cloud Hosting

3.1. Domain Registration via GoDaddy (Pure Domain Registrar)

The domain dealcode.ai and related subdomains were purchased and registered through GoDaddy.com LLC, 2155 E. GoDaddy Way, Tempe, AZ 85284, USA. GoDaddy acts strictly as a domain registrar for DNS (Domain Name System) routing. No hosting of website assets, application data, or databases takes place on GoDaddy infrastructure.

3.2. 100% Hosting on the Google Cloud Platform (Frankfurt am Main, Germany)

The public website dealcode.ai, the SaaS platform app.dealcode.ai, the mobile Lead Scanner App scanner.dealcode.ai, the booking subdomain meetings.dealcode.ai, and all associated databases are hosted 100% on the Google Cloud Platform in Germany.

Service Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Server Location / Data Residency: All production core systems, customer workspaces, and databases operate exclusively in the European Google Cloud region Frankfurt am Main, Germany (europe-west3). Internal development, staging, or test environments do not process live customer data.
Google Cloud Technologies Deployed:
Google Cloud Run: High-availability serverless container execution for our Next.js 16 backend and frontend services.
Google Cloud SQL (MySQL 8.0): Fully managed, encrypted relational database instances housing CRM, user, and workspace data. Access occurs exclusively via IAM-authenticated, encrypted Cloud SQL Auth Proxies (no public IP exposure).
Google Cloud KMS (Key Management Service): Hardware-backed envelope encryption of sensitive tokens (e.g. OAuth refresh tokens, external API keys) at rest.
Google Cloud Tasks: Asynchronous task queue architecture for decoupled, resilient background job processing.
Google Cloud Storage: Encrypted object storage for file attachments, documents, business card scans, and audio memos.
Google Cloud Pub/Sub & Redis: Scalable messaging and caching layers utilizing distributed locks to preserve transactional data integrity.
Legal Basis: Legitimate interest in providing secure, highly available, resilient, and performant cloud services (Art. 6(1)(f) GDPR). A Data Processing Addendum including EU Standard Contractual Clauses (SCCs) has been executed with Google Cloud.

4. Data Processing when Using the Platform app.dealcode.ai

4.1. Registration, Login & Workspace Administration

To access the platform, the customer establishes a workspace. In this context, we process: User full name, business email address, corporate telephone number (optional), company name, corporate domain; Authentication credentials: Cryptographically hashed passwords (bcrypt), two-factor authentication tokens (AuthToken via email); Role and permission assignments (Workspace Owner, Administrator, Manager, Campaign Manager, Viewer, Agency). Purpose & Legal Basis: Performance of a contract or steps prior to entering into a contract (Art. 6(1)(b) GDPR), and legitimate interest in access control and security (Art. 6(1)(f) GDPR).

4.2. Security Logging & Audit Trails

To safeguard IT security, detect cyberattacks, and prevent fraudulent abuse, we log: TenantLogin: Login timestamps, IP addresses, and user-agent strings; TenantActivity: Functional user interactions and view accesses; AdminAuditLog: Administrative interventions (e.g. role updates, subscription adjustments). Legal Basis: Legitimate interest in ensuring cybersecurity and preventing platform abuse (Art. 6(1)(f) GDPR).

4.3. Credit Ledger & Billing Records

The platform bills modular services (such as data enrichments, AI analyses, and campaign dispatches) based on exact consumption via an internal credit ledger. We log every transaction in the Credit Ledger (CreditLedgerTransaction) recording timestamp, user email, billed operation, credit amount, and resulting balance. Billing and transaction records are retained for ten (10) years in accordance with statutory tax and commercial retention laws (§ 147 AO, § 257 HGB). Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal retention obligations (Art. 6(1)(c) GDPR).

5. Active Data Enrichment & B2B Research Gateways

The platform provides API gateways allowing customers to actively enrich company and contact records. dealcode never initiates enrichments autonomously. All enrichments occur strictly upon active initiation by the customer.

5.1. FullEnrich (Email & Phone Waterfall)

Purpose: Locating and validating business email addresses and direct corporate telephone numbers of B2B professionals. Transmitted Parameters: Contact name, company domain, company name. Private personal email addresses (e.g. @gmail.com, @gmx.de) are filtered out and not queried. Provider: FullEnrich SAS, 10 Rue de Penthièvre, 75008 Paris, France (EU). Legal Basis: Data processing on behalf of the customer (Art. 28 GDPR).

5.2. Unipile (LinkedIn API Bridge via Hosted Session)

Purpose: Optional technical gateway linking the user's connected LinkedIn profile for role-based discovery of B2B decision-makers and executing customer-directed contact sequences (profile visits, connection requests, direct messages). Provider: Unipile SAS, 11 Rue Danielle Casanova, 75001 Paris, France (EU). Operation ("Auth on Behalf" & Hosted Session): The connection to the LinkedIn account is established via a secure authentication wizard (Hosted Auth Wizard). Unipile sets up an isolated hosted user session (Hosted Session). No unauthorized scraping of the platform takes place. All queries and interactions are executed strictly on customer instruction in the name and on behalf of the user through their own active session. Session tokens are encrypted and processed within the EU. The system supports automatic reconnects upon token expiration. Disconnection and full data erasure on Unipile servers can be triggered at any time via platform settings. Legal Basis: Data processing on behalf of the customer (Art. 28 GDPR).

5.3. Google Vertex AI Search Grounding & Gemini 3.8 Flash

Purpose: Structured B2B web searches to extract publicly available company metadata (imprint records, registry details, company headcount, industry, executive leadership) via AI grounding over Google Vertex AI. Provider: Google Cloud EMEA Limited, Dublin, Ireland. Legal Basis: Data processing on behalf of the customer (Art. 28 GDPR).

5.4. SalesViewer (Buyer Intent & LeadStream)

Purpose: Ingestion of corporate visitor webhooks and 72-hour buffer synchronization (salesviewerSync.ts) displayed in the customer's LeadStream. Provider: SalesViewer GmbH, Hiltroper Str. 88, 44789 Bochum, Germany (EU). Legal Basis: Data processing on behalf of the customer (Art. 28 GDPR).

6. Connecting External User Accounts (Google Workspace & Microsoft 365)

Customers may voluntarily connect external email and calendar accounts to the platform via secure OAuth 2.0 interfaces.

6.1. Google Workspace (Gmail, Google Calendar, Google Meet, Google Docs, Google Chat)

Customers may voluntarily connect their Google Workspace accounts to dealcode via the official OAuth 2.0 authorization framework.

6.1.1. Google User Data Accessed (Data Access Disclosure)

When connecting Google Workspace, dealcode accesses and processes strictly the following categories of data within the scopes explicitly authorised by the user (principle of least privilege): Email Address & User Identity: Accessing the user's business Google email address (https://www.googleapis.com/auth/userinfo.email) to authenticate and link the mailbox to their workspace account. Outbound Email Parameters (Gmail Send): Via the sensitive scope https://www.googleapis.com/auth/gmail.send, the platform processes user-authored outbound communication parameters (recipient email address, subject line, body text, and attachments) exclusively to execute outbound message dispatch via gmail.users.messages.send. Calendar & Event Data (Google Calendar & Google Meet): Via the sensitive scope https://www.googleapis.com/auth/calendar.events, the platform synchronises calendar event data (title, start/end time, attendees, automated Google Meet video conference links, and location details) from the user's primary calendar for bidirectional appointment coordination in the CRM and calculation of open availability slots on personal booking pages (/book/...). Document & Template Data (Google Drive Per-File Access): Via the non-sensitive scope https://www.googleapis.com/auth/drive.file, the platform enables optional creation and editing of sales proposals and contract templates. Access is strictly confined to individual documents and files created directly by dealcode or explicitly opened by the user (zero broad access to the user's Google Drive). OAuth Authentication Tokens: Storage of temporary access tokens and cryptographically protected refresh tokens to maintain API connectivity without requiring repeated password entry.

6.1.2. Google User Data Sharing and Disclosure (Data Sharing Disclosure)

Strict Prohibition on Sharing: Sensitive Google user data is under no circumstances sold, rented, shared, transferred, or disclosed to third parties, external platforms, advertising networks, data brokers, or third-party AI model providers. Direct Transmission Only: Data is transmitted strictly and directly between dealcode and Google's official API endpoints (gmail.googleapis.com, www.googleapis.com/calendar, www.googleapis.com/drive) to perform the actions actively requested by the user (message dispatch, calendar event synchronisation, document creation). No Advertising Use: Google user data is never utilised, processed, or evaluated for personalised advertising, retargeting, or consumer profiling.

6.1.3. Data Protection and Security Mechanisms for Sensitive Data (Data Protection Mechanisms)

To protect all sensitive user data received and processed through Google APIs (specifically calendar event records, attendee details, meeting metadata, outbound email payloads/metadata, and OAuth 2.0 authentication tokens), dealcode implements comprehensive technical and organisational security mechanisms pursuant to Art. 32 GDPR: Encryption in Transit: All data transmissions between the user's browser, dealcode application servers, and Google's official API endpoints are strictly encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS) with HTTP Strict Transport Security (HSTS). Encryption at Rest (All Sensitive User Data & OAuth Credentials): Database & Object Storage Encryption: All sensitive Google user data stored in our database (synchronised calendar events, attendee lists, meeting metadata, and email dispatch logs) as well as file attachments in Google Cloud Storage are encrypted at rest using AES-256 encryption. Hardware-Backed Token Envelope Encryption: All Google OAuth 2.0 access and refresh tokens are never stored in plaintext, but are additionally encrypted at the application layer at rest using Google Cloud Key Management Service (Cloud KMS) with hardware-backed AES-256-GCM encryption. Strict Access Controls, Multi-Tenant Isolation & Least Privilege: Logical Multi-Tenant Isolation: Every customer workspace is strictly segregated at the database query layer (tenantDomain / workspace scope), preventing any cross-tenant data access. Role-Based Access Control (RBAC) & 2FA: Platform access is protected by granular Role-Based Access Control (RBAC), cryptographic password hashing (bcrypt), and Two-Factor Authentication (2FA). Private Database Network Architecture: Production Cloud SQL databases have zero public IP exposure and are accessible exclusively via IAM-authenticated, encrypted Cloud SQL Auth Proxies under strict least-privilege IAM policies, accompanied by continuous security audit logging (TenantLogin, AdminAuditLog). Certified European Cloud Infrastructure & Vulnerability Management: All databases, backups, and processing pipelines are hosted 100% within ISO/IEC 27001, SOC 1/2/3, and BSI C5 certified data centres in the Google Cloud region Frankfurt am Main, Germany (europe-west3) with continuous security monitoring. Data Minimisation, Retention, Immediate Revocation & Deletion: Sensitive Google user data is retained strictly for the duration of the active integration to provide the user-requested CRM functionality. Users may revoke the Google Workspace connection at any time with a single click via Settings > Integrations* (or directly via their Google Account at myaccount.google.com/permissions). Upon disconnection, stored OAuth tokens and cached synchronisation state are immediately and irrevocably deleted from the active database and revoked at Google.

#### 6.1.4. Binding Google API Limited Use & AI Compliance Statement

dealcode's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy and Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

> Affirmative Compliance Statement on AI/ML Models:

The use of raw or derived user data received from Google Workspace APIs adheres strictly to the Google User Data Policy, including the Limited Use requirements.

dealcode does NOT use Google Workspace user data (including raw, derived, or aggregated email content or metadata) to develop, create, train, or improve any foundational, generalized, or third-party machine learning and artificial intelligence models.

6.2. Microsoft 365 (Outlook & Exchange Calendar)

Scope of Integration: Synchronization of emails and calendar appointments via the Microsoft Graph API (/v1.0/me). Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Data Protection Classification: Microsoft acts as the customer's processor under the customer's direct agreement with Microsoft. dealcode accesses Microsoft Graph API as an authorized technical client on customer instruction pursuant to Art. 28 GDPR.

7. Automated Data Analysis, AI Scanning & AI Message Generation

7.1. AI Inbox Analysis, Automated Tagging & Adaptive Learning

When a user connects an email account, the platform performs automated AI-assisted processing: Content Analysis: Parsing incoming email texts to detect intent, scheduling requests, follow-ups, or objections. Automated Tagging: Categorization of email threads into 11 closed system tags (All Done, Task (To-do), Chat/Comment, Reminder, Cold Pitch, Marketing Newsletter, Social Media, Spam, System Notification, Awaiting Reply, FYI*). User-Specific Adaptive Learning (UserTagFeedback): When a user manually corrects a category, the system stores this feedback and adapts workspace-specific classification rules for future communications from that sender or domain. Speech Synthesis (Daily Audio Briefing): Converting daily executive dashboard summaries into audio briefings via Google Cloud Text-to-Speech (high-definition model de-DE-Chirp3-HD-Charon).

7.2. AI-Based Message Generation (Campaigns & Sequences)

The platform equips customers with AI capabilities to draft, personalize, and orchestrate communication campaigns and contact sequences: AI Copy Generation & Prompting (generate-copy): Users can prompt enterprise AI models (Google Vertex AI / Gemini) to draft tailored subject lines, email copy, and LinkedIn messages for multi-step sequences. AI Preflight Validation (aiPreflight.ts / verifyAndPolishMessage): Before scheduling or dispatching, an automated validation routine inspects drafts for grammatical integrity, tone, and unresolved template variables. Streaming Preview & Personalization (preview-stream): Real-time preview of generated drafts populating CRM attributes (e.g. first name, last name, company, title). Campaign Email Telemetry (emailTracking.ts): Outgoing HTML messages may include a 1x1 tracking pixel (/track/open) and redirecting tracking links (/track/click) to measure open and click rates within campaign dashboards. Message opens and link clicks are recorded with timestamps, message IDs, and recipient IDs. Cryptographic Unsubscribe Management (buildUnsubscribeUrl / /unsubscribe): Campaign emails contain a unique, cryptographically secured unsubscribe link. Clicking this link immediately adds the recipient's address to the customer's tenant-wide exclusion list, permanently barring them from future campaigns and sequences. Dispatch Windows & Holiday Protection (mailboxLimiter.ts): To protect domain reputation and respect standard business hours, the system enforces daily volume limits (warmup throttling) and pauses automated dispatch on weekends and German nationwide public holidays.

7.3. AI Meeting Transcripts & Call Insights (meetingTranscriptAi.ts)

The platform can reconcile calendar appointments with associated meeting notes or transcripts (from Google Docs / Google Drive or Microsoft Graph). Generative AI models extract executive summaries, action items, attendee sentiment, and buyer intent into the customer CRM.

7.4. Confidentiality & Exclusion of Foundation Model Training

All AI processing utilizes enterprise APIs (specifically Google Vertex AI). We contractually guarantee that customer data, email contents, campaign copy, prompts, and notes never flow into public model training datasets of AI providers (Google, OpenAI, Anthropic). Legal Basis: Processing on behalf of the customer (Art. 28 GDPR) based on terms agreed in the T&Cs.

8. Mobile Lead Scanner App scanner.dealcode.ai (Trade Fair Lead Capture)

At https://scanner.dealcode.ai/, dealcode provides a dedicated mobile web application enabling on-site capture of business contacts during conferences, trade fairs, and industry events.

8.1. Business Card Scanning & Camera Processing

Functionality: Upon native OS camera permission or manual image upload, the user captures photographs of business cards or event badges. OCR and AI Extraction: Optical Character Recognition and multimodal vision models (Google Vertex AI Vision) extract contact data (name, title, job role, company, email, phone numbers, postal address, website, LinkedIn profile) into structured fields. Image Archival: Captured images are stored encrypted in Google Cloud Storage (uploadBufferToGcs) within the EU data center as verification records.

8.2. Automated QR Code Scanning & LinkedIn Resolution

The app features embedded QR code detection (jsQR) decoding badges in real time. If a badge encodes a LinkedIn profile, the interface (resolve-linkedin) queries the profile identifier to link the record directly to the contact's LinkedIn profile.

8.3. Voice Memos & Transcription

Microphone Access: Upon native browser permission, users can record spoken voice memos summarizing conversations. Processing & AI Summarization: Audio files are streamed encrypted to Google Cloud Storage and transcribed into text (processMeetingAudioAndNotes), extracting structured notes, follow-up commitments, and action items.

8.4. Consent Documentation (Marketing Opt-Ins)

The app includes dedicated check fields to record on-site marketing consent (opt-in / double opt-in checkboxes), priority levels, event tagging, and lead status. The customer remains solely responsible for informing data subjects on-site and obtaining valid consent where required.

8.5. CRM Synchronization & Timeline Audit (submit-lead)

Upon user confirmation, the contact record, event linkage, image attachments, voice notes, and opt-in status synchronize to the customer's workspace on app.dealcode.ai, logging a chronological timeline event. Role & Legal Basis: The customer acts as sole Controller (Art. 4(7) GDPR); dealcode acts as Processor pursuant to Art. 28 GDPR.

9. Appointment Booking Subdomain meetings.dealcode.ai

Via https://meetings.dealcode.ai/{tenant}/{slug}, dealcode hosts public scheduling pages for customer calendars.

9.1. Data Collected during Booking

When a guest books a meeting, we process: First name, last name, business email address, phone number, company name; Date, time, duration, and time zone of the booking; Notes, meeting objectives, and agenda items; Email addresses of additional invited attendees (additionalGuests).

9.2. Automated Meeting Invitation Dispatch (meetingMailer.ts)

The system automatically generates a formal confirmation and calendar invite. The invitation is dispatched directly via the host's authenticated mailbox (e.g. Gmail API or Microsoft Graph), ensuring invitations originate from the host's domain. Additional attendees receive personalized invites and are registered as CRM contacts with associated timeline events. Legal Basis: Steps prior to entering into a contract or fulfilling the booking party's request (Art. 6(1)(b) GDPR) within the scope of processing for the customer (Art. 28 GDPR).

10. Data Processing on Marketing Website dealcode.ai

10.1. Informational Use & Server Logfiles

When visiting our website for informational purposes, our web servers collect standard technical telemetry: IP address of the requesting computer Date and time of server access Requested URL / path Transferred data volume and HTTP response code Browser type, version, and operating system Referrer URL (previously visited website).

Logfiles are stored to safeguard IT infrastructure and diagnose technical faults, and are purged automatically after at most 14 days.
Legal Basis: Legitimate interest in cybersecurity and operational stability (Art. 6(1)(f) GDPR).

10.2. Essential Cookies

We use cookies strictly necessary for website operation (e.g. maintaining language preferences and cookie consent status). Legal Basis: § 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

10.3. Analytics & Consent-Based Tools

10.3.1. SalesViewer on Marketing Website

We utilize technology provided by SalesViewer GmbH, Hiltroper Str. 88, 44789 Bochum, Germany. SalesViewer identifies corporate visitors (company name, industry, geography) via statistical IP address matching. Residential private IP addresses are discarded immediately. Legal Basis: Explicit consent via our consent management tool (Art. 6(1)(a) GDPR, § 25(1) TDDDG), revocable at any time.

10.3.2. Google Analytics

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We utilize Google Analytics with IP anonymization enabled (anonymizeIP). Legal Basis: Explicit consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), revocable at any time via the consent tool.

10.4. Contact Forms & Demo Requests

When contacting us via website forms, we process your submitted information (name, corporate email, phone, message) to answer your inquiry. Legal Basis: Legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR) or pre-contractual measures (Art. 6(1)(b) GDPR).

10.5. Job Applications

Application materials submitted to us are processed for hiring purposes. Legal Basis: Art. 88(1) GDPR in conjunction with § 26(1) BDSG. If an application is rejected, materials are purged after at most six (6) months.

11. Your Rights as a Data Subject

Under the GDPR, you have the following statutory rights regarding your personal data:
1. Right of Access (Art. 15 GDPR): Request confirmation and details regarding your processed data.
2. Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete records.
3. Right to Erasure (Art. 17 GDPR): Request deletion of your data where statutory grounds exist.
4. Right to Restriction of Processing (Art. 18 GDPR): Request restriction of data processing.
5. Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, standard, machine-readable format.
6. Right to Object (Art. 21 GDPR): Object at any time to data processing based on legitimate interests (Art. 6(1)(f) GDPR).
7. Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw granted consents at any time with effect for the future.

To exercise your rights, contact us at datenschutz@dealcode.ai or reach our external Data Protection Officer at datenschutz@heydata.eu.

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a competent data protection supervisory authority. The authority responsible for our registered office is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)
Ludwig-Erhard-Straße 22, 7th Floor
20459 Hamburg
Germany
Phone: +49 40 428 54 4040
Email: mailbox@datenschutz.hamburg.de
Website: https://datenschutz-hamburg.de/

12. Updates and Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy to ensure continued compliance with statutory requirements or reflect modifications to our platform services. The current version is accessible at https://www.dealcode.ai/legal/privacy-policy.

Dealcode GmbH Legal Documentation Suite

This Privacy Policy forms an integral component of Dealcode's comprehensive legal and compliance framework:

General Terms and Conditions (T&Cs): https://www.dealcode.ai/legal/terms
Data Processing Agreement (DPA / Art. 28 GDPR): https://www.dealcode.ai/legal/data-processing-agreement
Technical and Organisational Measures (TOMs / Art. 32 GDPR): https://www.dealcode.ai/legal/technical-and-organisational-measurements
List of Sub-processors (Art. 28(2) GDPR): https://www.dealcode.ai/legal/list-of-sub-processors
Profile Visibility & Opt-Out (Art. 21 GDPR): https://www.dealcode.ai/opt-out

• Dealcode Trust Center: https://www.dealcode.ai/trust-center