Go Back

Privacy Policy

Last updated: [17.06.2026]

We take the protection of your personal data seriously. This Privacy Policy explains what personal data we process, why we process it, on what legal basis, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller responsible for the processing described in this policy is:

Users Digital GmbH

Rahel-Varnhagen-Weg 38

21035 Hamburg Germany

Managing Director: Alicja Borucinska

Commercial Register: Amtsgericht Hamburg, HRB 162356

VAT ID: DE329641692

Email: info@usersdigital.com

We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR and § 38 BDSG. For all data protection matters, please contact us at the address above.

2. Scope of this policy

This policy applies to:

visitors to our website usersdigital.com
our business contacts at client and supplier companies
applicants for positions with us
visitors to our company page on LinkedIn

It also explains, in Section 8, the separate role we play when we process data on behalf of our clients as part of our marketing services.

3. Our two roles: controller and processor

Users Digital operates a performance marketing business. This means we handle personal data in two distinct capacities, and your rights differ depending on which applies.

As a controller, we decide why and how personal data is processed. This covers everything described in Sections 4 to 7 of this policy: our website, our business relationships, recruitment, and our social media presence. If you are a client contact, a supplier contact, an applicant, or a website visitor, we are the controller and you can exercise your rights directly with us.

As a processor, we process personal data strictly on the documented instructions of our clients, who remain the controller for that data. This applies to campaign and attribution data handled in the course of delivering our services. We do not decide the purposes of that processing, and we do not use that data for our own purposes. See Section 8.

4. Our website

4.1 Hosting and server log files

Our website is hosted by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel.

When you visit our website, our hosting provider automatically collects and stores technical information transmitted by your browser in server log files. This may include:

the IP address of the requesting device
date and time of the request
the page or file requested
referrer URL
browser type and version
operating system

This data is necessary to deliver the website, ensure its stability and security, and defend against attacks. It is not merged with other data sources and is not used to identify you personally.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and technically correct operation of our website.

International transfer: Israel is recognised by the European Commission as providing an adequate level of data protection, so no additional safeguards are required for this transfer.

4.2 Cookies and consent

Our website uses cookies and comparable technologies. Cookies are small text files stored on your device.

Strictly necessary cookies are required for the website to function (for example, to remember your cookie preferences or maintain security). These are set on the basis of § 25(2) no. 2 TDDDG and do not require your consent.

All other cookies, including those used for analytics, are only set after you have given your consent via our cookie banner.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG for cookies requiring consent; Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG for strictly necessary cookies.

You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website, or by deleting cookies in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4.3 Wix Analytics

We use Wix Analytics, the built-in analytics function of our website platform provided by Wix.com Ltd., to understand how our website is used and to improve it.

Wix Analytics collects information such as pages visited, time spent on pages, referral source, approximate location, and device and browser type. IP addresses are shortened before evaluation, so that direct identification of individual visitors is not possible.

Analytics is only activated if you have given your consent via our cookie banner.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent).

Retention: Analytics data is retained in aggregated form for the period set by the platform. You can withdraw consent at any time as described in Section 4.2.

4.4 Contact form and email

You can contact us using the contact form on our website or by email.

If you use the contact form, the information you enter (such as your name, email address, company and message) is transmitted to us, stored in the content management system of our website platform, and forwarded to our email inbox. If you contact us by email, we process the content of your message and your contact details.

We use this data solely to process your enquiry and any follow-up questions arising from it.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries addressed to us.

Retention: We delete enquiries once they have been fully dealt with and no retention obligations apply. Where an enquiry leads to a business relationship, the data is transferred to our CRM system and handled as described in Section 5. Correspondence that qualifies as a commercial or business letter is subject to the statutory retention periods described in Section 9.

Providing this data is voluntary. However, without at least a means of contacting you, we cannot respond to your enquiry.

5. Business contacts: clients and suppliers

To establish, manage and maintain our business relationships, we process personal data relating to contact persons at our client and supplier companies.

Categories of data:

name, job title and function
business email address and telephone number
company name and business address
correspondence and records of communication with us
contract, order and billing data
payment and bank account details, where relevant to the business relationship

This data is stored in our CRM and invoicing system (see Section 7).

Purposes: initiating, negotiating, performing and administering contracts; communication with our business partners; invoicing and payment processing; account management; and compliance with our legal obligations.

Legal basis:

Art. 6(1)(b) GDPR for the performance of a contract, or steps taken at your request prior to entering into a contract
Art. 6(1)(f) GDPR where the contact person is not the contracting party themselves. Our legitimate interest is the efficient management of business relationships with our corporate partners
Art. 6(1)(c) GDPR for compliance with legal obligations, in particular under commercial and tax law

We do not sell, rent, or otherwise make your contact details available to third parties for their own marketing purposes. Your data is used exclusively for the business purposes described above.

Retention: See Section 9.

6. Applicants

If you apply for a position with us, we process the data you provide as part of your application, including your name, contact details, CV, references, qualifications and any other information you choose to send us.

Purposes: assessing your suitability for the position and carrying out the recruitment process.

Legal basis: § 26(1) sentence 1 BDSG and Art. 6(1)(b) GDPR, for the purposes of deciding on the establishment of an employment relationship. Where you voluntarily provide information beyond what is required, the legal basis is your consent under Art. 6(1)(a) GDPR and § 26(2) BDSG, which you may withdraw at any time.

Retention: If your application is unsuccessful, we delete your application data three months after the recruitment process for the relevant position has been closed. If we agree with you to keep your application on file for future opportunities, we will do so only with your explicit consent and will delete the data once that consent is withdrawn or the agreed period ends.

7. Service providers and international transfers

We use carefully selected service providers who process personal data on our behalf. Each of these providers is bound by a data processing agreement under Art. 28 GDPR, which obliges them to process data only on our instructions and to maintain appropriate technical and organisational security measures.

Wix.com Ltd. Website hosting, contact form, website analytics

Google Ireland Ltd. (Google Workspace)Business email, calendar, file storageIreland / EU, with possible access from the USA

Zoho Corporation B.V.CRM and invoicingNetherlands / EU, with possible access from outside the EU

Where personal data is transferred to a country outside the European Economic Area, we ensure an appropriate level of protection through one of the following:

an adequacy decision of the European Commission, which exists for Israel
the EU-US Data Privacy Framework, where the provider is certified under it
Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, supplemented where necessary by additional safeguards

You may request a copy of the relevant safeguards by contacting us at the address in Section 1.

Beyond these providers, we disclose personal data only where we are legally obliged to do so, for example to tax authorities, or to our tax advisors and auditors, who are themselves bound by professional confidentiality.

8. Data processed on behalf of our clients

As part of our performance marketing services, we process campaign, tracking and attribution data on behalf of our clients. In relation to this data we act as a processor within the meaning of Art. 28 GDPR. Our clients are the controllers and determine the purposes and means of that processing.

We process this data only on the documented instructions of the respective client, under a data processing agreement, and we do not use it for our own purposes. IP addresses processed in this context are truncated before storage so that they cannot be attributed to an identifiable individual.

If you are an end user and wish to exercise your data protection rights in relation to a specific app, campaign or advertiser, please contact that company directly, as they are the controller for that data. If you contact us, we will forward your request to the relevant client without undue delay, insofar as we are able to identify them.

9. Retention periods

We keep personal data only for as long as it is required for the purposes for which it was collected, or for as long as statutory retention obligations apply.

Business contact data in our CRM: deleted two years after the last contact, where the contact is inactive and no contractual or statutory obligation requires further retention.

Invoices, accounting records and business correspondence: retained for the statutory periods under German commercial and tax law, in particular § 147 AO and § 257 HGB. These periods are six or ten years depending on the type of document, calculated from the end of the calendar year in which the document was created.

Where data must be retained solely to comply with these statutory obligations, we restrict its processing under Art. 18 GDPR: it is no longer used for active business purposes and is deleted once the retention period expires.

Applicant data: three months after the close of the relevant recruitment process, unless you have consented to longer retention.

Website enquiries: deleted once the enquiry has been fully dealt with, subject to the retention obligations above.

10. Our LinkedIn company page

We maintain a company page on LinkedIn at linkedin.com/company/usersdigitalgmbh, operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

When you visit or interact with our page, LinkedIn processes your personal data as a controller in accordance with its own privacy policy, over which we have no influence. LinkedIn provides us with anonymised statistics about page visitors ("Page Insights"). In relation to the processing underlying these statistics, we and LinkedIn are joint controllers under Art. 26 GDPR. LinkedIn has assumed primary responsibility for this processing and for handling data subject rights.

If you contact us via LinkedIn, we process the content of your message and your profile name in order to respond.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is presenting our company and communicating with clients, partners and potential applicants.

LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

11. Data security

We use appropriate technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction, and unauthorised access. Our website uses TLS/SSL encryption, which you can recognise by the padlock symbol and the "https://" prefix in your browser's address bar. Our measures are reviewed and improved in line with technological developments.

12. Your rights

Under the GDPR you have the following rights in relation to your personal data:

Right of access (Art. 15 GDPR): to obtain confirmation of whether we process your data and, if so, to receive a copy of it together with information about the processing.
Right to rectification (Art. 16 GDPR): to have inaccurate data corrected and incomplete data completed.
Right to erasure (Art. 17 GDPR): to have your data deleted where one of the grounds set out in the GDPR applies and no retention obligation prevents it.
Right to restriction of processing (Art. 18 GDPR): to require that we limit the processing of your data in certain circumstances.
Right to data portability (Art. 20 GDPR): to receive data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller.
Right to object (Art. 21 GDPR): to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. Where we process your data for direct marketing purposes, you may object at any time without giving reasons.
Right to withdraw consent (Art. 7(3) GDPR): to withdraw any consent you have given at any time with effect for the future.

To exercise any of these rights, contact us at info@usersdigital.com. We will respond without undue delay and in any event within one month of receiving your request.

13. Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

The supervisory authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit Ludwig-Erhard-Straße 22, 7th floor 20459 Hamburg Germany https://datenschutz-hamburg.de

14. Changes to this policy

We review this Privacy Policy regularly and update it where our processing activities or the legal requirements change. The version published on this page is always the current one. The date of the most recent update is shown at the top.