Privacy Policy

1. Controller Responsible for Data Processing

The data controller in the sense of the GDPR is:

2. Scope of This Privacy Policy

This Privacy Policy applies to BetStup's corporate and agency website and to the personal data we process via this website and in connection with general inquiries, sales inquiries, quotation processes, and agency-related contractual relationships.

Separate privacy policies and contractual terms generally apply to BetStup's standalone software products, SaaS applications, customer portals, or other digital services. Where applicable, those product-specific policies take precedence over the general information on this page.

To the extent that we process personal data exclusively on behalf of our agency clients, for example in connection with development, hosting, support, or operational services for client projects, such processing is generally carried out as processing on behalf under Art. 28 GDPR on the basis of the agreements concluded with the respective client.

Typical Categories of Data

• Access and log data when visiting the website
• Master data and contact data in connection with inquiries and business relationships
• Communication content
• Contract, billing, and payment data
• Usage and account data to the extent you use our own digital offerings

3. Visiting Our Website

When you access our website, technically necessary information is automatically transmitted by your browser to the web server. This includes in particular:

• IP address
• date and time of access
• the page called up or file requested
• referrer URL
• browser type, browser version, and operating system

Processing is carried out to provide the website, ensure stability and security, and prevent misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online offering.

Server log data is stored only as long as necessary for secure operation and error analysis. As a rule, deletion takes place after a few days and no later than within 30 days, unless longer storage is exceptionally required for evidentiary or security purposes.

4. Contact and Communication

If you contact us by email or by other means, we process your information for the purpose of handling the inquiry and related communication. This generally includes your name, contact details, company affiliation, and the content of your message.

The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry is aimed at the conclusion or performance of a contract or concerns pre-contractual measures. In all other cases, we process your data on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of business inquiries.

Where we provide a contact, initial consultation, or inquiry form on this website and you use it, we process the data entered there for the purpose of handling your inquiry. This may include company name, name, email address, telephone number, and message content. If an external provider is used for the technical operation of the form, this is done on the basis of a data processing agreement under Art. 28 GDPR.

Unless statutory retention obligations prevent this, we delete communication data as soon as the inquiry has been fully processed and no further business relationship exists.

5. Contractual Relationships, Services, and Billing

In the context of agency-related contractual relationships, we process the data required for quotations, contract conclusion, service delivery, project communication, support, billing, and the enforcement of claims. This includes in particular contact persons, contact details, contractual content, project information, and invoicing and payment data.

The legal bases are Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for commercial and tax retention obligations, and Art. 6(1)(f) GDPR for the establishment, exercise, or defense of legal claims.

This Privacy Policy does not describe the full scope of data processing within BetStup's standalone software products. Users of those products are informed separately in the respective product-specific privacy policies.

Commercially and tax-relevant documents are generally stored for six or ten years in accordance with statutory requirements.

6. Recipients and Data Processors

Personal data is disclosed only to those recipients who require it to fulfill the respective purposes. These may include in particular:

• hosting and infrastructure providers
• email, form, and communication service providers
• analytics and consent management providers, where used
• marketing and advertising platforms, in particular in connection with Facebook and Instagram advertising as well as Meta Pixel, where used
• payment service providers and banks where required in the context of agency contracts or offered payment methods
• tax advisors, legal advisors, and other professional confidentiality-bound service providers where required
• authorities and public bodies where there is a legal obligation

Where external service providers act as processors on our behalf, we conclude agreements pursuant to Art. 28 GDPR.

7. Data Transfers to Third Countries

In individual cases, processing may also be carried out by service providers in countries outside the European Union or the European Economic Area. In such cases, we ensure an adequate level of data protection.

Where a transfer to a third country takes place, this occurs only on the basis of an adequacy decision under Art. 45 GDPR, appropriate safeguards under Art. 46 GDPR, or another statutory permission. Appropriate safeguards may include, in particular, the European Commission's Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework, where the respective provider falls under it.

Further information about service providers used and the relevant transfer mechanisms is available upon request at datenschutz@betstup.com.

8. Storage Period

We store personal data only for as long as this is necessary for the respective purpose or as long as statutory retention obligations exist.

9. Cookies and Similar Technologies

We use technically necessary cookies or comparable storage technologies where this is required for the secure and functional operation of the website.

In addition, after launch we may use consent-based services such as consent management tools, web analytics, reach measurement, or tag management, for example Google Analytics, Google Tag Manager, Umami, or comparable technologies. Such services are activated only on the basis of your prior consent where consent is legally required. The legal basis is then Art. 6(1)(a) GDPR in conjunction with the applicable rules governing access to terminal equipment information.

Further information on providers, functionality, storage periods, possible third-country transfers, and withdrawal options for consent-based services can be found in our Cookie Policy. The consent modal is used primarily to select and later withdraw your preferences.

Where we use Google Tag Manager, it serves exclusively for the technical integration and control of additional tags and scripts. According to our intended setup, Google Tag Manager itself is not intended to create independent user profiles, but it may technically transmit data such as the IP address or device-related information to Google where this is required for service delivery. Any consent-based services delivered through the tag manager are loaded only after your consent.

Where we use Google Analytics, this takes place only with active consent, IP anonymization, a defined storage period, and privacy-friendly settings chosen by us. If we instead use Umami or comparable analytics tools, this likewise takes place only within the legally permissible scope and, where required, only after your consent.

Where we use Meta Pixel or comparable Meta business tools for advertising measures on Facebook or Instagram, this likewise takes place only on the basis of your prior consent where legally required. This may in particular serve conversion measurement, remarketing, audience building, and the evaluation and optimization of our advertising campaigns.

Details about the cookies, services, providers, durations, and withdrawal options currently in use can be found additionally in our Cookie Policy.

Technically necessary cookies or storage technologies serve the secure provision of the website and are based on Art. 6(1)(f) GDPR; insofar as access to terminal equipment information is concerned, this takes place only within the legally permissible scope.

10. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

To exercise these rights, please contact us at: datenschutz@betstup.com

You also have the right to lodge a complaint with a supervisory authority. For our company in North Rhine-Westphalia, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia is of particular relevance.

11. Security of Personal Data

We implement appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, and other unauthorized processing.

• TLS encryption for data transmissions
• access and authorization concepts
• regular updates of systems in use
• backup and recovery measures
• organizational processes to ensure confidentiality and integrity

Despite all due care, complete security of data transmission on the internet cannot be guaranteed.

12. No Automated Decision-Making

We do not currently carry out automated decision-making, including profiling within the meaning of Art. 22 GDPR, in connection with this website.

13. Data Protection Contact

For questions about data protection or to exercise your rights, please contact us:

14. Changes to This Privacy Policy

We update this Privacy Policy whenever our website, our processes, or the legal requirements change. The version published on this page is the authoritative version.