Privacy Policy

The controller responsible for data processing within the meaning of the GDPR is:

UnitedAds GmbH, Fürstenrieder Str. 279a, 81377 München, Germany

Email: hello@csspartner.io

Personal data is any information relating to an identified or identifiable natural person (e.g. name, address, email address, IP address, user behavior).

We generally only process personal data of our users to the extent necessary to provide a functional website and our content and services, or if you have consented to the processing.

Our website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in Germany. On every request, the server processes the data technically required to deliver the page, in particular your IP address, the page requested, the time and browser and device information.

We do not store access logs. The web server and the application only log technical error messages. In individual cases these may contain an IP address, for example for failed connections, but no form contents or email addresses. The logs are limited in size; older entries are continuously overwritten.

The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the error-free delivery and security of the website.

Our website uses technically necessary cookies to ensure functionality. This includes the cookie "csp_consent", in which we store your choice in the cookie notice for 6 months. This processing is based on Art. 6 (1) lit. f GDPR or Section 25 (2) TDDDG.

Insofar as we use cookies, analytics or marketing tools that are not strictly necessary, this is done exclusively on the basis of your consent (Art. 6 (1) lit. a GDPR, Section 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer.

Google Ads conversion tracking and remarketing: with your consent, we use Google Ads by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This lets us measure which of our ads lead to enquiries or bookings and show relevant ads to visitors of our website.

For this, your browser loads the Google tag (gtag.js). Google sets cookies on our domain (e.g. "_gcl_au", retention up to 90 days) and on Google domains and processes in particular online identifiers, IP address, pages visited, time of visit and device and browser information. Without consent, the Google tag is not loaded. After a withdrawal, we remove the Google Ads cookies on our domain.

Google may also transfer data to Google LLC in the USA (see section 8). You can find further information in Google's privacy policy: https://policies.google.com/privacy

Google Tag Manager: With your consent we also use Google Tag Manager provided by Google. It is a tool we use to manage measurement and marketing tags on our website. Tag Manager itself sets no cookies; it loads the tags configured in it, here Google Analytics 4 and the Google Ads conversion linker. In doing so, Google processes in particular your IP address as well as browser and device information. Without consent, Tag Manager is not loaded.

Google Analytics 4: Through Tag Manager and with your consent we use Google Analytics 4 provided by Google. It lets us analyse how our website is used, for example which pages are viewed, through which sources visitors arrive and which actions they take. For this, Google sets the cookies "_ga" and "_ga_<ID>" on our domain (stored for up to 2 years) and processes in particular online identifiers, pages viewed, time of visit, the source of the visit as well as device and browser information. The IP address is used to determine an approximate location and is not stored by Google Analytics 4. Without consent, Google Analytics is not loaded. If you withdraw your consent, we remove the Analytics cookies on our domain.

The legal basis for Google Tag Manager and Google Analytics is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google may also transfer data to Google LLC in the USA (see section 8).

OpenAI Ads Measurement Pixel: with your consent, we also use the OpenAI Ads Measurement Pixel by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI"). This lets us measure which of our ads in ChatGPT lead to page views and booked subscriptions.

For this, your browser loads a script from OpenAI (oaiq.min.js). OpenAI sets the cookie "__oppref" on our domain and processes in particular pages visited, time of visit, IP address, device and browser information and, when you book, an identifier of the subscription and the booked plan. Without consent, the script is not loaded. After a withdrawal, we no longer send measurement data to OpenAI and remove the cookie on our domain.

The legal basis is your consent (Art. 6 (1) lit. a GDPR, Section 25 (1) TDDDG). OpenAI may also transfer data to the USA (see section 8). You can find further information in OpenAI's privacy policy: https://openai.com/policies/eu-privacy-policy/

Meta Pixel: with your consent, we also use the Meta Pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). This lets us measure which of our ads on Facebook and Instagram lead to page views, enquiries and booked subscriptions, and show visitors to our website relevant ads on Facebook and Instagram.

For this, your browser loads a script from Meta (connect.facebook.net). Meta sets the cookie "_fbp" on our domain and, if you arrive via one of our ads, the cookie "_fbc" (each stored for 90 days), and for users logged in to Facebook or Instagram also cookies on Meta domains. In particular, pages visited, time of visit, IP address, device and browser information are processed, for an enquiry the type of form, and for a booking an identifier of the subscription, the booked plan and the price. We do not send names, email addresses or form entries to Meta. Without consent, the script is not loaded. After a withdrawal, we no longer send data to Meta and remove the cookies on our domain.

We are jointly responsible with Meta for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR); the agreement for this is Meta's Controller Addendum (https://www.facebook.com/legal/controller_addendum). Meta alone is responsible for any further processing. The legal basis is your consent (Art. 6 (1) lit. a GDPR, Section 25 (1) TDDDG). Meta may also transfer data to the USA (see section 8). You can find further information in Meta's privacy policy: https://www.facebook.com/privacy/policy/

Customer reviews via Trustindex: with your consent, we embed review widgets by Trustindex Kft., Nyári Pál utca 15, 2724 Újlengyel, Hungary ("Trustindex") and load a Trustindex script that provides the review data to search engines. Trustindex processes in particular your IP address and browser and device information and may use cookies or similar technologies. Without consent, no content from Trustindex is loaded.

The legal basis is your consent (Art. 6 (1) lit. a GDPR, Section 25 (1) TDDDG). You can find further information in Trustindex's privacy policy: https://www.trustindex.io/privacy-policy/

Microsoft Clarity: With your consent we use Microsoft Clarity provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). It lets us analyse how our pages are used – which sections are read and which buttons are clicked, for example – in order to improve the website.

To do so, your browser loads a script from Microsoft (clarity.ms). Microsoft sets the cookies "_clck" (stored for up to 1 year) and "_clsk" (1 day) on our domain as well as cookies on Microsoft domains, and processes in particular the pages you visit, clicks, mouse and scroll movements, time on page, a truncated IP address, and device and browser information. This produces session recordings and heatmaps. Entries in form fields are masked by Clarity. Without consent the script is not loaded. After a withdrawal we no longer send data to Microsoft and remove the Clarity cookies on our domain.

The legal basis is your consent (Art. 6 (1) lit. a GDPR, Section 25 (1) TDDDG). Microsoft may also transfer data to the USA (see section 8). You can find further information in Microsoft's privacy statement: https://privacy.microsoft.com/privacystatement

YouTube videos: in some blog posts we embed videos from YouTube by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in privacy-enhanced mode (youtube-nocookie.com). A video is only loaded when you click "Play video". Only then is data such as your IP address transmitted to Google, including to the USA (see section 8). The legal basis is the consent you give with that click (Art. 6 (1) lit. a GDPR, Section 25 (1) TDDDG).

Videos via Bunny CDN: we deliver some videos on our website via the content delivery network of BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia ("Bunny"). At first we only show a preview image from our own server; only when you click "Play" does your browser load the video file from Bunny. In doing so, Bunny processes technically necessary data such as your IP address, the date and time of the request and device and browser information in order to deliver the video. Bunny does not set any cookies in the process.

Bunny processes this data on our behalf on the basis of a data processing agreement (Art. 28 GDPR). The legal basis is our legitimate interest in fast and reliable delivery of the videos you request (Art. 6 (1) lit. f GDPR). You can find further information in Bunny's privacy policy: https://bunny.net/privacy/

Appointment booking via Google Calendar: on our "Book a call" page we embed the appointment booking of Google Calendar by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The calendar is loaded as soon as you open this page. This transmits data such as your IP address and browser and device information to Google, including to the USA (see section 8). The calendar is not loaded on any other page of our website. If you book an appointment, Google processes the details you enter, in particular your name and email address, and adds the appointment with these details to our calendar. The legal basis for loading the calendar is our legitimate interest in providing the appointment booking you request by opening this page (Art. 6 (1) lit. f GDPR, Section 25 (2) no. 2 TDDDG); for the booking and holding the appointment it is Art. 6 (1) lit. b GDPR. Further information can be found in Google's privacy policy: https://policies.google.com/privacy

Live chat: while one of us is reachable, we offer a chat on our pages. If you send a message in it, we store the text of your messages, the language of the page and the path of the page you opened the chat from, in order to answer your enquiry. We do not ask for your name or email address and store no IP address.

So that your messages are matched to the right conversation, we set the cookie "csp_chat" with a random identifier (stored for 30 days). It contains no information about you personally and is only set once you send a message.

Translation: so that we can answer messages in every language we offer, we transmit the text of your message to Anthropic PBC, San Francisco, California, USA ("Anthropic"), which translates it on our behalf as a processor. Anthropic processes the content for that purpose only and does not use it to train models. This involves a transfer of data to the USA (see section 8).

The legal basis for the chat is our legitimate interest in answering your enquiry quickly and intelligibly (Art. 6 (1) lit. f GDPR); where your enquiry concerns an existing or prospective contract, it is Art. 6 (1) lit. b GDPR. We delete chat transcripts 48 hours after the last message.

If you contact us by email or via our forms, the data you provide (email address, name, company, message) will be stored in our database for the purpose of processing your request.

To send emails, for example confirmations of enquiries and bookings, we use the Resend service by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA ("Resend"). Your email address and the content of the message are transmitted to Resend (see section 8).

The legal basis is Art. 6 (1) lit. b or lit. f GDPR. The data will be deleted as soon as they are no longer required for processing and no statutory retention periods apply.

If you enter into a contract with us, we process the data required for contract execution (name, company, address, email, VAT ID, payment data) in accordance with Art. 6 (1) lit. b GDPR.

Payment processing is handled by the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The data required for payment is transmitted directly to Stripe. For this, your browser loads Stripe's payment form (Stripe.js) on our order page; Stripe also processes device and browser information to prevent fraud. The privacy policy of Stripe applies: https://stripe.com/privacy

We only pass on personal data to third parties if this is necessary for the performance of the contract, if there is a legal obligation, or if you have consented.

This includes in particular our hosting provider Hetzner (section 3), our email service provider Resend (section 5), the payment service provider Stripe (section 6), Google as part of the CSS program (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), Anthropic for translating chat messages (section 4), Google for appointment booking via Google Calendar (section 4), Bunny for delivering videos (section 4) and, only with your consent, Google Ads, Google Tag Manager, Google Analytics, OpenAI Ads, Meta, Trustindex, Microsoft Clarity and YouTube (section 4).

A transfer of personal data to third countries only takes place if this is necessary for the performance of the contract, required by law, or if you have consented. We base such transfers on standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR.

With Google Ads, Google Tag Manager, Google Analytics, YouTube and appointment booking via Google Calendar (section 4), data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

When emails are sent via Resend (section 5), data is transferred to Plus Five Five, Inc. in the USA. The company is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

With the OpenAI Ads Measurement Pixel (section 4), data may be transferred to OpenAI companies in the USA. Such transfers are based on the European Commission's standard contractual clauses (Art. 46 (2) lit. c GDPR).

With the Meta Pixel (section 4), data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

With Microsoft Clarity (section 4), data may be transferred to Microsoft Corporation in the USA. Microsoft Corporation is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

When chat messages are translated (section 4), their content is transferred to Anthropic PBC in the USA. The transfer is based on the European Commission's standard contractual clauses (Art. 46 (2) lit. c GDPR).

We only store personal data for as long as is necessary to achieve the respective processing purpose or as long as statutory retention periods apply (e.g. commercial and tax law obligations of up to 10 years).

Under the GDPR you have, in particular, the following rights: information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time (Art. 7 (3) GDPR).

You also have the right to object to the processing of your personal data (Art. 21 GDPR), in particular in the case of processing based on legitimate interests or for direct marketing.

To exercise your rights an informal notice to hello@csspartner.io is sufficient.

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). Competent authority is, among others, the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

We use the widespread TLS/SSL procedure during the website visit in conjunction with the highest level of encryption supported by your browser.

This privacy policy is currently valid and has the status: 2026-10-25. As a result of the further development of our website and offers or due to changed legal or regulatory requirements, it may become necessary to change this privacy policy.