Privacy policy

This English text is a convenience translation. In case of any discrepancy, the German version is legally authoritative.

Introduction and general information

Thank you for your interest in our website. Protecting your personal data is very important to us. Below you will find information on how we handle the data collected through your use of our website. Your data is processed in accordance with the statutory data protection provisions.

Controller within the meaning of the GDPR

Drozak GmbH
Managing Director Jacek Drozak
Lyckallee 32
14055 Berlin, Germany
+49 151 724 172 22
kontakt@drozak.com

Definitions

Our privacy policy is intended to be simple and understandable for everyone. It generally uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are set out in Art. 4 GDPR.

Access to and storage of information on your device

Using our website may involve accessing information (e.g. your IP address) or storing information (e.g. cookies) on your device. Such access or storage may be associated with further processing of personal data within the meaning of the GDPR.

Where such access to, or storage of, information is strictly necessary for the technically faultless provision of our services, this is done on the basis of the German Telecommunications Digital Services Data Protection Act (TDDDG). The further processing of your personal data is governed by the GDPR and the German Federal Data Protection Act (BDSG).

Further information on the processing of your personal data and the relevant legal bases can be found in the sections below on the specific processing activities on our website.

Web hosting

This website is hosted by an external service provider (host). Personal data collected on this website is stored on the host's servers. This may include, in particular, IP addresses, contact requests, meta and communication data, website access data and other data generated via a website. The servers used by our hosting provider (Vercel) are located in a data centre in Frankfurt am Main. Your data is therefore stored and processed within the European Union.

We collect the data listed in order to ensure a smooth connection to the website and the technically faultless provision of our services. Processing this data is strictly necessary in order to make the website available to you. The legal basis for the processing is our legitimate interest in the correct presentation and functionality of our website pursuant to Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR, obliging it to protect our customers' data and not to pass it on to third parties.

Server log files

When you access our website, it is technically necessary for data to be transmitted to our web server via your internet browser. The following data is recorded during an active connection for communication between your browser and our server:

• Date and time of the request
• Name of the requested file
• Page from which the file was requested
• Access status
• Web browser and operating system used
• (Full) IP address of the requesting computer
• Amount of data transferred

We collect this data to ensure a smooth connection to the website and the technically faultless provision of our services. Processing this data is strictly necessary in order to make the website available to you. The log files serve to evaluate system security and stability and for administrative purposes. The legal basis is our legitimate interest in the protection and functionality of our website pursuant to Art. 6(1)(f) GDPR.

For reasons of technical security, in particular to defend against attempts to attack our web server, we store this data for a short time. Where applicable, the data is also processed in anonymised form for statistical purposes. This data is never stored together with other personal data of the user, compared with other data sets, or passed on to third parties.

Cookies

Our website uses only technically necessary cookies. These are small text files required to operate the website, in particular to keep you logged into the member area (session). They are automatically deleted at the end of your session or after a short time.

The legal basis is our legitimate interest in the technically faultless provision of our services pursuant to Art. 6(1)(f) GDPR in conjunction with Section 25(2) TDDDG. We do not use cookies for analytics or advertising, which is why no cookie consent banner is required. You can reject or delete cookies in your browser, either generally or in individual cases; however, logging into the member area will then not work.

Embedded videos (Vimeo)

Our website embeds videos from the Vimeo service (Vimeo Inc., USA). When you open a page containing an embedded video, a connection to Vimeo's servers is established, which may transmit your IP address to Vimeo. We load the videos in “Do Not Track” mode (dnt=1) in order to reduce, as far as possible, the setting of cookies and the analysis of your usage behaviour by Vimeo. For more information, please see Vimeo's privacy policy at vimeo.com/privacy.

Services, forms

This website uses a contact and membership form. The data you enter is stored and processed for the purpose of handling your enquiry or your membership request.

Member area and user account

We provide a protected member area for members of the CPO Network. To set up and operate your user account, we process the profile data stored about you, in particular your name, position, company, country, industry and email address, as well as your login credentials (email address and a password you set). You may optionally add further details, such as a link to your LinkedIn profile.

The purpose of the processing is to provide the member area, to authenticate you, to display your profile to other members within the closed circle, and to organise the Round Tables. The legal basis is the performance of the membership relationship or the carrying out of pre-contractual measures pursuant to Art. 6(1)(b) GDPR. Passwords are stored in encrypted form only.

Account and profile data is stored in our database (Supabase); the servers are located in a data centre in Frankfurt am Main within the European Union. We delete your account and the associated profile data when the membership ends, unless statutory retention obligations apply.

Newsletter

If you expressly consent as part of your request, we use your email address to send you a newsletter with information about the CPO Network. Providing this is voluntary and is not required for your membership request.

The legal basis for sending it is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future, for example via the unsubscribe link in every newsletter email or by message to kontakt@drozak.com. The withdrawal does not affect the lawfulness of processing carried out before it.

For dispatch we use a service provider (Brevo, Sendinblue SAS, France), which processes the data on our behalf and on the basis of a data processing agreement pursuant to Art. 28 GDPR within the European Union.

External links

Social networks (LinkedIn) are only integrated on our website as links to the respective services. After clicking the embedded text or image link, you are redirected to the provider's page. Only after this redirection is user information transmitted to the respective provider. For information on how your personal data is handled when using these websites, please refer to the respective privacy policies of the providers you use.

Data sharing and recipients

Your personal data is not transferred to third parties, except

• where we have explicitly stated so in the description of the respective data processing,
• where you have given your express consent pursuant to Art. 6(1)(1)(a) GDPR,
• where the transfer pursuant to Art. 6(1)(1)(f) GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not having your data transferred,
• where there is a legal obligation to transfer the data pursuant to Art. 6(1)(1)(c) GDPR, and
• where this is necessary pursuant to Art. 6(1)(1)(b) GDPR for the performance of contractual relationships with you.

In addition, to provide our services we use external service providers whom we have carefully selected, engaged in writing, and with whom we have concluded data processing agreements pursuant to Art. 28 GDPR where required. They are bound by our instructions and are regularly monitored by us. These include, among others, providers for hosting, the sending of emails, and the maintenance of our IT systems. These service providers will not pass on this data to third parties.

International data transfers

Your data is generally stored within the European Union (data centres in Frankfurt am Main). Some of the service providers we use are based in the USA, so that in exceptional cases, for example in the context of support or remote maintenance, access from a third country cannot be entirely ruled out. This concerns in particular our hosting provider (Vercel Inc.) and the provider of our database (Supabase Inc.).

When videos are embedded, a connection to Vimeo (Vimeo Inc., USA) is also established, and data may be transferred to the USA.

Where personal data is transferred to a third country, this is done on the basis of appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular the EU-US Data Privacy Framework where the respective provider is certified, or on the basis of the European Commission's Standard Contractual Clauses.

Data security

In accordance with Art. 32 GDPR, and taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. For security reasons and to protect the transmission of confidential content, this website uses SSL encryption.

Storage period of personal data

The storage period for personal data is determined by the applicable statutory retention periods. After the respective period expires, the corresponding data is routinely deleted. Where data is required for the performance or initiation of a contract, or where we have a legitimate interest in continued storage, the data is deleted once it is no longer required for these purposes or once you have exercised your right of withdrawal or objection.

Your rights

Below you will find information on the data subject rights that applicable data protection law grants you vis-à-vis the controller with regard to the processing of your personal data:

• the right to request information about your personal data processed by us pursuant to Art. 15 GDPR;
• the right to request the immediate correction of inaccurate data, or the completion of your personal data stored by us, pursuant to Art. 16 GDPR;
• the right to request the deletion of your personal data stored by us pursuant to Art. 17 GDPR, unless statutory exceptions apply;
• the right to request the restriction of the processing of your personal data pursuant to Art. 18 GDPR;
• the right to receive your personal data in a structured, commonly used and machine-readable format, or to request its transfer to another controller, pursuant to Art. 20 GDPR;
• the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR;
• the right to withdraw consent given, with effect for the future, pursuant to Art. 7(3) GDPR.

Right to object

Where your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6(1)(1)(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data on grounds relating to your particular situation. Where the objection is directed against the processing of personal data for direct marketing purposes, you have a general right to object without the need to state a particular situation.

To exercise your right of withdrawal or objection, an email to kontakt@drozak.com is sufficient.

Statutory obligations

The provision of personal data for the decision on entering into a contract, the performance of a contract, or the carrying out of pre-contractual measures is voluntary. However, we can only make a decision within the scope of contractual measures if you provide such personal data as is necessary for the conclusion or performance of the contract, or for pre-contractual measures.

Automated decision-making

Automated decision-making or profiling pursuant to Art. 22 GDPR does not take place.

Right to amend

We reserve the right to amend or update this privacy policy where necessary, in compliance with applicable data protection regulations. This allows us to adapt it to current legal requirements and to reflect changes to our services, e.g. when introducing new services. The version in force at the time of your visit applies.

Last updated: August 2026