Privacy Policy

This English version is a translation of the German original and is provided for your convenience. Only the German text is legally binding.

With this privacy notice, we inform you about how we process personal data on our websites. As a matter of principle, we only process personal data of our users to the extent necessary to provide a functional website as well as our content and services.

I. Responsibilities and Contact Details

PAD Communications GmbH, Holstenstraße 1, 22767 Hamburg, Germany, email: info@pommesaldente.com (hereinafter: “we”, “our”, “us”, “Controller”, “PAD”) acts as the controller for your personal data.

II. General Information on Data Processing

1.  Legal Basis for the Processing of Personal Data

We process your personal data in accordance with the applicable data protection laws, including the General Data Protection Regulation (“GDPR”), if:

  • you have given your consent (Art. 6 (1) (a) GDPR),
  • the processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures at your request (Art. 6 (1) (b) GDPR),
  • the processing is necessary for compliance with a legal obligation to which we are subject (Art. 6 (1) (c) GDPR), or
  • the processing is necessary for the purposes of our legitimate interests or the legitimate interests of third parties (Art. 6 (1) (f) GDPR), in particular our legitimate interests in pursuing the purposes described in this privacy notice.

2.  Categories of Recipients

Where necessary for the purposes described above, we share your personal data with:

  • third-party service providers and business partners who require your personal data in order to provide their services to us, in particular:
    • administrative services (e.g., document service providers, facility management, or security companies),
    • customer care and support services (e.g., call centers, helpdesks, or providers of customer relationship management),
    • financial and accounting services (e.g., auditors, banks, credit agencies, insurance companies, payment processors, or tax advisors),
    • IT services (e.g., IT service and telecommunications providers),
    • legal and compliance services (e.g., auditors, lawyers, or other experts),
    • marketing and sales services (e.g., marketing and advertising, social media platforms, or other media companies),
    • strategy and business development services (e.g., management consultants, business intelligence providers, or other advisors),
  • government authorities that require your personal data to fulfill their public duties (e.g., courts for legal disputes, tax authorities for tax administration, or law enforcement authorities for investigations), or
  • other third parties, such as potential buyers of our company (e.g., in the event of a sale, merger, or acquisition), counterparties including their service providers (e.g., in legal disputes), or other recipients at your instruction.

  • 3.  Third-Country Transfers

    We generally process your personal data within the EU/EEA. If we transfer your personal data to recipients in countries outside the EU/EEA (“third countries”), we apply the following safeguards to ensure that the protection of your personal data is not undermined:

    For further details on our third-country transfers or copies of these safeguards, please contact us using the contact details provided in the section “Data Subject Rights and Questions”.

    4.  Storage Period

    We do not store your personal data longer than necessary for the purposes described above. 

    To determine our storage period, we use in particular the following criteria: 

    • If you withdraw your consent or effectively object to the processing of your personal data and we cannot rely on another legal basis, we generally do not store your personal data any longer.
    • If we have an existing relationship with you, we generally store your personal data for the duration of our relationship.
    • If we expect to need your personal data in the future, we generally store your personal data for this expected period in the future.

    Otherwise, we only store your personal data to the extent necessary to fulfill our contractual and legal obligations or to preserve evidence.

    The most important statutory retention periods are six or ten years.

    The statutory limitation periods can be up to thirty years, with the regular limitation period being three years.

    Evidence of proper data processing can generally be stored for five years.

    As soon as our applicable retention periods expire, we will delete or anonymize your personal data.

    For further details on our storage practices, please contact us using the contact details provided in the section “Data Subject Rights and Questions”.

    5.  Sources of Personal Data

    We generally collect personal data directly from you, in particular:

    • when you communicate with us,
    • when you use our services, offers, or technologies,
    • when you otherwise interact with us directly.

    You may provide us with your personal data voluntarily, unless you are legally or contractually obliged to do so or it is necessary for the conclusion of a contract.

    If you do not provide us with your personal data, you will likely not be able to enter into or maintain a contractual relationship with us, or you will likely not be able to interact with us as described above.

    For further details on your obligations and possible consequences, please contact us using the contact details provided in the section “Data Subject Rights and Questions”.

    Sometimes we also collect personal data from sources other than you, in particular from:

    • third-party service providers and business partners,
    • government authorities (e.g., law enforcement authorities for investigations), or
    • other third parties, such as providers of publicly accessible sources (e.g., public websites, media, social media profiles, registers, records, or databases), counterparties including their service providers (e.g., in legal disputes), or other companies or individuals at your instruction.

    6.  Data Subject Rights and Questions

    You have the following rights under the GDPR:

  • Right to withdraw consent: You may withdraw your consent at any time (Art. 7 (3) GDPR),
  • Right of access: You may ask us to grant you access to your personal data (Art. 15 GDPR),
  • Right to rectification: You may ask us to rectify inaccurate personal data or complete incomplete personal data (Art. 16 GDPR),
  • Right to erasure: You may ask us to delete your personal data (Art. 17 GDPR),
  • Right to restriction of processing: You may ask us to restrict the processing of your personal data (Art. 18 GDPR),
  • Right to data portability: You may ask us to transfer your personal data to you or to another recipient of your choice (Art. 20 GDPR),
  • Right to object: You may object to the processing of your personal data (Art. 21 GDPR).

If you wish to exercise these rights or have questions about this privacy notice, please contact us using the contact details listed above. Please note that your rights may be restricted in certain situations.

In such a case, we will inform you of the reason for the restriction. If you have concerns about our processing of your personal data, we ask that you let us know so that we can try to address your concerns.

Irrespective of this, you have the right to lodge a complaint with the competent supervisory authority if you believe that we have not complied with data protection laws (Art. 77 GDPR).

7.  Existence of Automated Decision-Making

As a matter of principle, we do not use automated decision-making and, in this context, no profiling within the meaning of Art. 22 GDPR.

III. Use of Cookies and Similar Technologies

We and third parties use cookies and similar technologies (e.g., pixels, local storage, or session storage objects) on our website, which allow information to be stored on your end device (e.g., computer, notebook, mobile phone) or information already stored on your end device to be accessed. 

Cookies and similar technologies are used (1) to provide this website and the functions fundamentally necessary for it (e.g., certain user inputs, authentication, security, multimedia players, load balancing, UI customization cookies), (2) to analyze the use of our website (e.g., which pages were visited most frequently) so that this website can be improved in a user-oriented manner, (3) to display personalized advertising and content, and (4) to measure the success of our activities in connection with the use of our website. 

The details in the privacy settings, which you can access via the pink circle in the bottom left corner of the website, are decisive. 

The storage of information on your end device or access to information already stored on your end device only takes place on the basis of your consent. 

Without your consent, the storage of information on your end device or access to information already stored on your end device only takes place if 

  • (1) the sole purpose of the storage or access is to carry out the transmission of a communication over a public telecommunications network, or
  • (2) it is strictly necessary in order to provide a telemedia service expressly requested by you.

The functional duration of cookies and similar technologies generally depends on your visit to our website, i.e., cookies are deleted when you leave our website (so-called “session cookies”). 

The functional duration of cookies and similar technologies may also depend on a set expiration date, whereby the functional duration currently does not exceed two years in any case (exception: external media: LinkedIn, max. 10 years). 

The functional duration of cookies and similar technologies that require consent ends in any case upon withdrawal of your consent. 

Further details on the cookies and similar technologies we use can be found in our privacy settings, which you can access via the pink circle in the bottom left corner of the website. 

Via the privacy settings, you can make your desired settings, such as granting or withdrawing consent. 

If you withdraw your consent, the lawfulness of the storage of information on your device or the access to information already stored on your device up to the withdrawal of your consent is not affected. 

If you do not accept cookies and similar technologies that require consent, you will not suffer any disadvantages as a result. 

There is no obligation to give consent to cookies and similar technologies that require consent. 

Further details on the processing of personal data in connection with the cookies and similar technologies used can be found in this privacy policy.

IV. Data Processing in Detail

1.  Provision of the Website and Creation of Log Files

1.1   Provision of the Website and Creation of Log Files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. 

The following data is collected: 

  • IP address
  • Information about the browser type and browser version used
  • The user’s operating system
  • The user’s internet service provider
  • Date and time of access
  • Websites accessed by the user’s system via our website
  • Referrer URL
  • HTTP status code
  • HTTP method

The data is also stored in the log files of our system.

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s device.

Storage in log files takes place to ensure the functionality of the website.

We also use the data to optimize the website and to ensure the security of our information technology systems.

1.2   Legal Basis for the Processing of Personal Data

The legal basis is Art. 6 (1) (f) GDPR.

1.3   Storage Period

If data is collected for the provision of the website, your data is deleted when the respective session has ended.

If the data is stored in log files, this occurs after seven days at the latest.

1.4   Recipients

The following recipients receive personal data in connection with this data processing:

2.  Newsletter and Email Advertising

2.1   Description, Purposes, and Scope of Data Processing

On our website, you have the opportunity to learn about our products and services and to subscribe to a free newsletter (hereinafter “Newsletter”).

Only your email address is strictly required for sending the Newsletter.

The provision of further, separately marked data is voluntary and serves to enable us to address you personally.

We use the so-called double opt-in procedure for subscribing to our Newsletter.

This means that after you sign up, we will send you an email to the email address provided, asking you to confirm that you wish to receive the Newsletter.

You must confirm your registration within 24 hours to activate your subscription.

In addition, we store the IP addresses used as well as the times of registration and confirmation.

The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

After your confirmation, we process your email address for the purpose of sending you the Newsletter.

If you have given your consent, our Newsletters also contain personalized advertising or personalized content.

In addition, on the basis of your consent, we also measure the success of our Newsletter, for example whether our Newsletter has been read.

The processing includes the following types of personal data:

  • Email address
  • First name and last name
  • IP address
  • Information about the end device and operating system (e.g., device type, browser identifier)
  • Information on user behavior (e.g., access to content and advertising, time of access)
  • Geographic information

2.2   Legal Basis for the Processing of Personal Data

The legal basis for the data processing is your consent, Art. 6 (1) (a) GDPR.

The legal basis for the data processing in the context of the double opt-in procedure and in connection with the proof of your consent is Art. 6 (1) (c) in conjunction with Art. 5 (1) (a), (2), Art. 7 (1) GDPR and Art. 6 (1) (f) GDPR.

2.3   Storage Period

Personal data is stored for as long as the Newsletter subscription is active or the email advertising is requested.

The subscription can be canceled by the user concerned at any time by withdrawing the consent given (e.g., via the “Unsubscribe from newsletter” link in the Newsletter).

However, we may store your email address and the proof of your consent in the interest of and for the purpose of proving your consent and defending against possible claims for the duration of the statutory limitation period, i.e., three years.

If you do not confirm your registration for our Newsletter within 24 hours as part of the double opt-in procedure, your data will be deleted automatically.

2.4   Recipients

The processed personal data generally remains with the Controller. It is technically possible that the following recipients receive personal data in connection with this data processing:

3.  Advertising for Similar Goods and Services

3.1   Description, Purposes, and Scope of Data Processing

If you have provided us with your email address in connection with the purchase of goods or services from us, we also use your email address to regularly inform you by means of direct marketing about our own similar goods or services.

3.2   Legal Basis for the Processing of Personal Data

The legal basis is Art. 6 (1) (f) GDPR in conjunction with Section 7 (3) of the German Act Against Unfair Competition (UWG).

3.3   Storage Period

The data will be deleted as soon as you object to the use of your email address for sending advertising for similar goods and services.

You will not incur any costs for the objection other than the transmission costs according to the basic rates.

3. 4   Recipients

The processed personal data generally remains with the Controller. It is technically possible that the following recipients receive personal data in connection with this data processing:

4.  Direct Marketing by Post

4.1   Description, Purposes, and Scope of Data Processing

We use the postal contact details you provided in connection with the purchase of goods or services to regularly inform you by letter by means of direct marketing about our products and services.

4.2   Legal Basis for the Processing of Personal Data

The legal basis for the data processing is Art. 6 (1) (f) GDPR.

4.3   Storage Period

The data will be deleted as soon as you object to the use of your data for direct marketing by post.

5.  Contacting Us

5.1   Description, Purposes, and Scope of Data Processing

If you contact us via a form on our website, by email, or via the appointment booking function, the data you provide (your email address and any other data you provide) will be transmitted to us and processed by us to handle your inquiry.

5.2   Legal Basis for the Processing of Personal Data

If the contact is aimed at the conclusion of a contract, the legal basis for the processing is Art. 6 (1) (b) GDPR.

In all other cases, the legal basis for the processing of the data transmitted in the course of contacting us is Art. 6 (1) (f) GDPR.

5.3   Storage Period

We delete the data arising in this context as soon as your inquiry has been answered and no statutory retention obligations exist.

The statutory retention periods are generally ten years.

5.4   Recipients

The processed personal data generally remains with the Controller. It is technically possible that the following recipients receive personal data in connection with this data processing:

6.  Website Analysis to Optimize User-Friendliness

6.1   Description, Purposes, and Scope of Data Processing

We process personal data in order to continuously improve the user-friendliness of our website for you.

To this end, we analyze our website and measure how you have interacted with our website.

Your user behavior may also be recorded in order to collect information about your activities, interests, and visits to our website.

The results of our website analyses may be recorded in (aggregated) reports.

Based on the insights gained, we adapt our website to make it even more user-friendly for you.

The processing includes the following types of personal data:

  • IP address
  • Internet service provider (ISP)
  • Information about the end device (e.g., device type, browser ID, URL)
  • Information on user behavior (e.g., access to content, use of the website, previous usage activities)
  • Demographic and geographic information

6.2   Legal Basis for the Processing of Personal Data

The legal basis for the processing of personal data is your consent (Art. 6 (1) (a) GDPR) or our legitimate interest (Art. 6 (1) (f) GDPR).

6.3   Storage Period

Personal data processed by us in connection with website analysis to optimize user-friendliness will be deleted by us no later than 14 months after its collection.

6.4   Recipients

The following recipients receive personal data in connection with this data processing: 

7.  Website Analysis for Performance Measurement

7.1   Description, Purposes, and Scope of Data Processing

In order to measure the success of activities in connection with the use of our website, we and the third parties listed as recipients, who are controllers within the meaning of Art. 4 No. 7 GDPR for the data processing taking place via their respective service, process personal data. 

The website analysis includes 

  • measuring the performance of our content and advertising, such as the correct display of content and advertising
  • whether our content and advertising could be perceived, or
  • whether people interact with our content and advertising on our website.

We also count how often our website, our content, and our ads are viewed. 

The results of our performance measurement may be recorded in (aggregated) reports. 

The content and advertising on our website are adapted on the basis of the insights gained. 

The processing includes the following types of personal data: 

  • IP address
  • Information about the end device (e.g., device type, browser ID, URL)
  • Information on user behavior (e.g., access to content, use of the website, previous usage activities)
  • Demographic and geographic information

7.2   Legal Basis for the Processing of Personal Data

The legal basis for the processing of personal data is your consent (Art. 6 (1) (a) GDPR) or our legitimate interest (Art. 6 (1) (f) GDPR).

7.3   Storage Period

Personal data processed by us in connection with website analysis for performance measurement will be deleted by us no later than 14 months after its collection.

7.4   Recipients

The following recipients receive personal data in connection with this data processing:

8.  Social Plugins and Embedded Functions and Content

8.1   Description, Purposes, and Scope of Data Processing

In order to offer you social plugins as well as functions and content from third-party providers (hereinafter “Social Plugins”) on our website, we and the third parties listed as recipients, who are controllers within the meaning of Art. 4 No. 7 GDPR for the data processing taking place via their respective service, process personal data.

With the Social Plugins we use, you can reach our linked social media profile by clicking on it. We use these links to gain followers.

The processing includes the following types of personal data:

  • IP address
  • Information about the end device (e.g., device type, browser ID, URL)

Information on data processing by the respective provider of the Social Plugin can be found in its privacy policy.

Details can be found under 8.4.

8.2   Legal Basis for the Processing of Personal Data

The legal basis for the processing of personal data is your consent (Art. 6 (1) (a) GDPR) or our legitimate interest (Art. 6 (1) (f) GDPR).

8.3   Storage Period

Personal data processed by us in connection with Social Plugins will be deleted by us no later than 3 months after its collection.

8.4   Recipients or Joint Controllers

The following recipients receive personal data in connection with this data processing:

9.  Data Processing in the Application Process

9.1   Description, Purposes, and Scope of Data Processing

If you apply to us (e.g., by email or post), we collect and process the personal data you provide (e.g., first name, last name, contact information, CV, references, cover letter) in order to assess your suitability for the position and to carry out the application process.

9.2   Legal Basis for the Processing of Personal Data

The legal basis for the processing is Art. 6 (1) (b) GDPR (initiation of a contractual relationship) and, in Germany, additionally Section 26 of the German Federal Data Protection Act (BDSG) (data processing for purposes of the employment relationship). If you have given us your consent to store your data for a longer period for future job openings (“talent pool”), the legal basis is Art. 6 (1) (a) GDPR.

9.3   Storage Period

In the event of a rejection, your data will be deleted no later than six months after completion of the application process, unless statutory retention obligations prevent this or we have a legitimate interest in further storage for the preservation of evidence (e.g., under the German General Equal Treatment Act (AGG)). In the event of a successful application, the data will be transferred to your personnel file.

9.4   Recipients

Within PAD Communications GmbH, only those persons involved in the application process have access to your data. Technically, access may be possible by our IT service providers:

10.  Data Processing of Customers and Prospective Customers

10.1   Description, Purposes, and Scope of Data Processing

In the course of initiating and carrying out our business relationship, we process personal data of you or your contact persons (e.g., name, business contact details, position, communication content). This serves the purposes of preparing offers, project planning, providing our agency services, as well as invoicing and customer support.

10.2   Legal Basis for the Processing of Personal Data

The processing is carried out for the performance of a contract or for the implementation of pre-contractual measures pursuant to Art. 6 (1) (b) GDPR. In addition, we process data to safeguard our legitimate interests in efficient customer management and communication pursuant to Art. 6 (1) (f) GDPR.

10.3   Storage Period

We store this data for the duration of the business relationship. After the end of the cooperation, the data is generally stored for ten years in compliance with the statutory retention periods (in particular under commercial and tax law) and then deleted.

If no cooperation is established, we generally delete your data no later than two years after the last contact, unless you have consented to a longer storage period or legitimate interests on our part (e.g., for the documentation of consulting services or the defense against claims) prevent deletion.

10.4   Recipients

Within PAD Communications GmbH, only the persons responsible for the process have access to your data. Technically, the data is processed via our IT infrastructure:

11.  Company Presence on Social Media

11.1   Description, Purposes, and Scope of Data Processing

We also use social media to present ourselves, to stay in touch with you, and to interact with you.

In addition, we analyze how our company page on social media is used so that we can design and optimize it in line with demand based on the insights gained.

11.2   Legal Basis for the Processing of Personal Data

The legal basis for the processing of personal data is our legitimate interest pursuant to Art. 6 (1) (f) GDPR or the consent you have given pursuant to Art. 6 (1) (a) GDPR.

11.3   Storage Period

Personal data processed by us in connection with social media will be deleted by us no later than 3 months after its collection.

11.4   Recipients or Joint Controllers

The social media providers themselves are generally responsible for compliance with data protection regulations on their platform.

Beyond these providers, we are only responsible under data protection law to a very limited extent.

Security and Protection of Rights
  • to protect the services and our business operations, as well as to protect our rights or the rights of our stakeholders;
  • to prevent and detect fraud, unauthorized activities and access, and other misuse;
  • where we deem it necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our terms of use.

Compliance with Legal Requirements and Court Proceedings
  • to comply with applicable legal or regulatory obligations, including as part of a judicial proceeding;
  • to respond to a subpoena, warrant, court order, or other legal process;
  • or as part of an investigation or request (whether formal or informal) from law enforcement or a government authority.

Auditing, Reporting, and Other Internal Operations
  • to conduct financial, tax, and accounting audits; audits and assessments of our business operations, data protection, security and financial controls, risk, and compliance with legal obligations;
  • our general business, accounting, record-keeping, and legal functions, as well as to maintain appropriate business records and to enforce company policies and procedures.

General Business and Operational Processes
  • to evaluate and carry out mergers, acquisitions, reorganizations, insolvencies, and other business transactions such as financing, as well as to manage our business, accounting, auditing, compliance, record-keeping, and legal functions.

Last updated: May 18, 2026