Privacy Policy

This Privacy Statement is effective as of May 2018.

This Privacy Policy clarifies the nature, scope and purpose of the processing of personal data (hereinafter referred to as "data") within our online services and the related websites, features and content, as well as external online presences, e.g. our social media profiles (collectively referred to as "online offer"). With regard to the terminology used, e.g. "Processing" or "Responsible", we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

Contacting us

Hanseaticsoft GmbH
Frankenstraße 12
20097 Hamburg

Phone: +49 (0)40 180 377 47

CEO: Alexander Buchmann

Data Protection Official: Mr. Sven Herma

General categories of personal data that we may process:

  • Inventory data (e.g. name, address).
  • Contact details (e.g. telephone number, email address).
  • Content data (e.g. text input, photographs, videos).
  • Usage data (e.g. page views, website navigation paths, length of visit).
  • Meta/communication data (e.g. operating system, IP address).

The data may be processed for the purposes of

  • Operating our website and providing our services
  • Communicating with you
  • Ensuring the security of our website and services
  • Analyzing the use of the website and services/marketing


“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” is any operation or set of operations that is performed on personal data or on sets of personal data, whether or not by automated means. The term is extensive and contains any possible dealing with personal data.

“Controller” is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

Legal basis

In accordance with Art. 13 GDPR we inform you of the legal basis of our data processing. Unless the legal basis is stated in the privacy policy, the following applies: The legal basis for obtaining consent is Article 6 (1) lit. a and Art. 7 GDPR, the legal basis for the processing for the performance of our services and the execution of contractual measures as well as the response to inquiries is Art. 6 (1) lit. b GDPR, the legal basis for processing in order to fulfill our legal obligations is Art. 6 (1) lit. c GDPR, and the legal basis for processing in order to safeguard our legitimate interests is Article 6 (1) lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR as legal basis.

Safety measures

We ask you to inform yourself regularly about the content of our privacy policy. We will adjust the privacy policy as soon as the changes we make to the data processing require it. We will notify you as soon as the changes require your participation (eg. consent) or other individual notification.

Collaboration with processors and third parties

If, in the context of our processing, we disclose data to other persons and companies (contract processors or third parties), transmit them to them or otherwise grant access to the data, this will only be done on the basis of a legal permission (eg. if a transmission of the data to third parties like payment service providers is required, pursuant to Art. 6 (1) (b) GDPR to fulfill the contract), you have consented to a legal obligation or based on our legitimate interests (e.g. the use of agents, webhosters, etc.).

If we commission third parties to process data on the basis of a so-called "contract processing contract", this is done on the basis of Art. 28 GDPR.

International transfers of your personal data

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. GDPR. That is the processing is e.g. on the basis of specific guarantees, such as the officially recognized level of data protection (e.g. for the US through the Privacy Shield) or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").

Your rights

You have the right to ask for confirmation as to whether the data in question is being processed and for information about this data as well as for further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR you have the right to demand the completion of the data concerning you or the correction of the incorrect data concerning you.

In accordance with Art. 17 GDPR you have the right to demand the immediate deletion of the relevant data or, alternatively, to require a restriction of the processing of data in accordance with Art. 18 GDPR.

You have the right to demand that you receive the data concerning you, which you have provided to us, in accordance with Art. 20 GDPR and demand that it be transmitted to other persons responsible.

You have the right to demand the data relating to you, which you have provided to us, to be obtained in accordance with Art. 20 GDPR and request their transmission to other persons responsible.

In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to withdraw granted consent with effect for the future in accordance with Art. 7 (3) GDPR.

Right of objection

You can object to the future processing of your data in accordance with Art. 21 GDPR at any time. The objection may in particular be made against processing for direct marketing purposes.


"Cookies" are small files that are stored on users' computers. Different information can be stored within cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after his visit to an online service. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online service and closes his browser. In such a cookie, e.g. the contents of a shopping cart in an online shop or a login status can be stored.

The term "permanent" or "persistent" refers to cookies that remain stored even after the browser has been closed. Thus, e.g. the login status will be saved even if users visit after several days. Likewise, in such a cookie the interests of the users can be stored, which are used for range measurement or marketing purposes.

A "third-party cookie" refers to cookies that are offered by providers other than the controller of the online service (otherwise they’re called "first-party cookies").

We can use temporary and permanent cookies and clarify this in the context of our privacy policy.

If users do not want cookies stored on their computer, we ask them to disable the option in their browser's system settings. Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online service.

A general objection to the use of cookies used for online marketing purposes is explained in a large number of services. Especially in the case of tracking the american website or the european site can be visited. Furthermore, the storage of cookies can be achieved by switching them off in the browser’s settings. Please note that in this case it’s possible that not all features of this online service can be used.

Deleting Personal Data

The data processed by us are deleted or limited in their processing in accordance with Articles 17 and 18 GDPR. Unless explicitly stated in this privacy policy, the data stored by us is deleted as soon as it is no longer required for their purpose and the deletion does not conflict with any legal obligation to retain data. Unless the data is deleted because it is required for other and legitimate purposes, its processing will be restricted. This means the data will be blocked and will not be processed for other purposes. This applies, for example to data that must be kept for commercial or tax reasons.

In accordance with legal requirements in Germany, the data will be stored for 10 years pursuant to §§ 147 (1) AO, 257 (1) Nr 1 and 4 (4) HGB (books, records, management reports, accounting documents, trading books for taxation of relevant documents, etc.) and 6 years pursuant to § 257 (1) Nr. 2 and 3 (4) HGB (commercial letters).


The hosting services we use serve the providing of: infrastructure and platform services, computing capacity, maintaining back-ups of our databases, ensuring the security of our website and maintenance services for the purpose of operating our website and providing our services.

Here we or our hosting providers process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online service on the basis of our legitimate interests in an efficient and secure provision of this online service pursuant to Art. 6 (1) lit. f GDPR and Art. 28 GDPR (job processing contract closing).

Collection of access data and log files

Based on our legitimate interests within the meaning of Art. 6 (1) lit. f GDPR we or our hosting provider collect data on every access to the server on which this service is located (so-called server log files).

Access data includes:

  • Name of the visited website
  • File
  • Date and time of access
  • Transferred amount of data
  • Report of successful access
  • Browser type and version
  • Host name of the accessing computer
  • Operating system of the user
  • Referrer URL (the previously visited page)
  • IP address
  • requesting providers

Logfile information is stored for security purposes (for example, to investigate abusive or fraudulent activities) for a maximum of 7 days and then deleted. Data required for evidential purposes shall be exempted from the deletion until final clarification of the incident.

A merge of this data with other data sources will not be made.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and for the protection of the transmission of confidential content, such as the inquiries you send to us as the site operator. You can recognize an encrypted connection in your browser’s address line when it changes from “http://” to “https://” and the lock icon is displayed in your browser’s address bar.

If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties.

Contact Form

Should you send us questions via the contact form, email, telephone or social media, we will collect the data you provide, to answer your question and any follow-up questions as per Art. 6 (1) lit. a GDPR. The data may be stored in a Customer-Relation-Management System (“CRM System”) or similar systems.

We delete the requests, if they are no longer required. We check the necessity every two years. Furthermore, the legal archiving obligations apply.


We are providing you with the following information to explain the content of our newsletter as well as the registration, dispatch and statistical evaluation processes and your right of objection. By subscribing to our newsletter you agree with the described processes. Content of our newsletter: We send newsletter, emails and other electronic notifications with advertising material (referred to hereinafter as the “newsletter”) with the consent of the recipients or legal permission. If specific content of the newsletter is altered during the registration process, this content is essential for the consent of the users. Our newsletters contain information on our services and us.

Double-opt-in and recording process

Registration for our newsletter is completed as part of a so called double-opt-in process. This means you will receive an email after registration in which you will be asked to confirm your registration. This confirmation is required so that nobody can register with email addresses that do not belong to them. The newsletter registrations are recorded in order to be able to verify the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation and the IP address. The changes to your data that is held by your email service provider are also recorded.


You only need to provide your email address to register for the newsletter. If you also provide us with your and your company’s names this enables us to personalise our newsletter.

The dispatch of our newsletter and the related performance measurement is based on the consent of the recipient in accordance to Art. 6 (1) lit. f GDPR, § 7 (2) Nr. 3 UWG and on the basis of the legal permission according to § 7 (3) UWG.

The protocolling of the registration process is based on our legitimate interests in accordance with Art. 6 (1) lit. f GDPR. Our interest is a user-friendly and secure newsletter system, which serves both our business interests and the expectations of the users and also allows us to prove consent.


You may opt-out of receiving our newsletter at any time, i.e. withdraw your consent. You can find a link to unsubscribe to the newsletter at the end of each newsletter. We may store the withdrawn email addresses based on our legitimate interests for up to three years before we delete them to prove prior consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that at the same time the former existence of a consent is confirmed.

Email service provider

The newsletter is dispatched by “MailChimp”, a newsletter distribution platform of the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. You can view the MailChimp privacy policy here: The Rocket Science Group LLC d/b/a MailChimp is certified under the US-EU data privacy agreement Privacy-Shield and agrees to comply with the EU data privacy guidelines ( The use of Mailchimp constitutes a justified interest pursuant to Art. 6 (1) (f) GDPR and a job processing contract pursuant to Art. 28 (3) GDPR.

MailChimp can by its own admission also use this data in a pseudonymous form to enhance or improve its own services, e.g. to technically enhance the dispatch procedure and display of the newsletter or for commercial purposes to be able to determine which countries the recipients are from. However, MailChimp will not use the data of our newsletter recipients to contact them itself or forward it to third parties.

Performance measurement

Our emails contain a “web beacon”, i.e. a pixel-size file that is retrieved from our or the MailChimp server when opening emails. This initially involves technical information being retrieved such as information on the browser and your system as well as your IP address and the time of retrieval.

This information is used to make technical improvements to services based on technical data or the target groups and their reading behaviour based on their retrieval locations (that can be determined with the IP address) or access times. The statistical surveys also involve determining whether the newsletters are opened, when they are opened and which links are clicked on. This information may be assigned to individual newsletter recipients for technical reasons but it is neither our intention nor that of MailChimp to monitor individual users. The evaluations instead help us to recognise the reading habits of our users and to adapt our content to them or to send different content based on our users’ interests.

Google Analytics

This website uses Google Analytics, a web analytics service. It is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Google Analytics cookies are stored based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in analyzing user behavior to optimize both its website and its advertising.

Google is certified under the data privacy agreement Privacy-Shield and agrees to comply with the EU data privacy guidelines (

Google will use this information on our behalf to evaluate the use of our online service by users, to compile reports on the activities within this online offer and to provide us with further services related to the use of this online offer and the internet usage. Thereby pseudonymous usage profiles of the users may be created from the processed data.

IP anonymization

We have activated the IP anonymization feature on this website. Your IP address will be shortened by Google within the European Union or other parties to the Agreement on the European Economic Area prior to transmission to the United States. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there.

The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data held by Google.

Objecting to the collection of data

You can prevent the collection of your data by Google Analytics by clicking on the following link and downloading and installing the plugin:

Alternatively, when using a smartphone or tablet you can click on the following link. An opt-out cookie will be set to prevent your data from being collected on future visits to this site: Deactivate Google Analytics.

When deleting the cookies in this browser you need to click this link again.

For more information about how Google Analytics handles user data, see Google’s privacy policy:

Outsourced data processing

We have closed a contract with Google for the outsourcing of our data processing and have fully implemented the strict requirements of the German data protection authorities when using Google Analytics.

Demographic data collection by Google Analytics

This website uses Google Analytics’ demographic features. This allows reports to be generated containing statements about the age, gender, and interests of site visitors. This data comes from interest-based advertising from Google and third-party visitor data. This collected data cannot be attributed to any specific individual person. You can disable this feature at any time by adjusting the ads settings in your Google account or you can forbid the collection of your data by Google Analytics as described in the section “Objecting to the collection of data”.

The personal data of users will be deleted or anonymised after 14 months.

For more information about Google's data usage, settings and opt-out options, please refer to Google's privacy policy ( as well as to the settings for the display of advertising impressions by Google (

Google AdWords and Google Conversion-Tracking

Based on our legitimate interests (analysis, optimization and economical operation of our online services) in accordance to Art. 6 (1) lit. f GDPR we use Google-Marketing-Services operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, („Google“).

Google is certified under the data privacy agreement Privacy-Shield and agrees to comply with the EU data privacy guidelines (

Google Marketing Services allows us to better target advertisements for and on our website so that we only present ads to users that potentially match their interests. For example showing a user ads for products he's been interested in on other websites is called remarketing. Therefore, when our and other websites using Google Marketing Services are accessed, a code by Google will be executed and so called (re)marketing tags (invisible graphics or code, also called "Web Beacons") are incorporated into the website. This way an individual cookie (instead of cookies, comparable technologies may be used) is stored on the user’s device. These cookies can be set by different domains, including,,,, or In such a cookie details like websites the user visited, what content he is interested in and what offers he has clicked as well as technical information about the browser and operating system, referring web pages, visit time and other information about the use of the online offer can be stored. The user’s IP address will be stored as well. It will, however, be shortened by Google within the European Union or other parties to the Agreement on the European Economic Area prior to transmission to the United States. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data held by Google. The information mentioned above may be linked by Google with similar information from other sources. If the user then visits other websites, ads can be displayed matching his interests.

The user’s data is processed pseudonymously by the Google marketing services. That is Google stores and processes e.g. not the user’s name or e-mail address but the relevant cookie-related data from pseudonymous user profiles. From Google’s perspective ads are not managed for and displayed to an identifiable person, but the cookie owner, regardless of who that cookie owner is. This doesn’t apply if a user has explicitly allowed Google to process the data without its pseudonymization. The information about users collected by Google Marketing Services is transmitted to Google and stored on Google's servers in the United States.

As part of Google AdWords, we use so-called conversion tracking. Each Google AdWords advertiser has a different cookie. Thus, cookies cannot be tracked using the website of an AdWords advertiser. The information obtained using the conversion cookie is used to create conversion statistics for the AdWords advertisers who have opted for conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a conversion tracking tag page. However, advertisers do not obtain any information that can be used to personally identify users.

We can incorporate third-party ads based on the Google AdSense marketing service. AdSense uses cookies that enable Google and its affiliate sites to serve ads based on users' visits to this or other sites on the Internet.

In addition, we may use the "Google Tag Manager" to integrate and manage the Google Analytics and Marketing Services on our website.

For more information about Google's data usage for marketing, see the overview page:, Google's Privacy Policy is available at

If you wish to opt-out of interest-based advertising through Google Marketing Services, you can make use of Google's recruitment and opt-out options:

Plugins and Tool

Based on our legitimate interests (ie. interest in the analysis, optimization and economic operation of our online services in accordance to Art. 6 (1) lit. GDPR), we make use of contents and services offered by third-party providers in order to provide their content and services, such as including videos or fonts (collectively referred to as "content").

This always presupposes that the third-party providers of this content perceive the IP address of the users, since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as traffic of visitors on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include, but is not limited to, technical information about the browser and operating system, referring web pages, visit time, and other information regarding the use of our online offer.


We use Drift to provide a website chat bot and to allow you to schedule a meeting with a sales representative. As part of your conversation with the chat bot, you may enter personal information such as your name and email address. This information is stored by Drift, and automatically transferred to us to enable the booking of your meeting and to notify a sales representative.

To access the privacy policy of Drift, please visit:


Data that is provided by the user when making a contact request (via contact form or e-mail), is handled and processed in accordance with Art. 6 (1) lit. b) GDPR (Lawfulness of processing).

To process and answer your requests and messages as quickly as possible, we have linked our forms with our Customer Relationship Management tool ("CRM tool") Pipedrive. The data submitted when completing the form will be transmitted to Pipedrive and stored on Pipedrive servers.

We use the Pipedrive CRM system from service provider Pipedrive OÜ based on our legitimate interests (efficient and fast processing of user inquiries, management of existing customers, new customer business). Pipedrive OÜ is a private limited company established under the laws of the Republic of Estonia, with the address Paldiski mnt 80 , Tallinn, 10617, Estonia, registered in the Estonian Commercial Register under the code 11958539, and a subsidiary of Pipedrive US. For this purpose, we have entered into a contract with Pipedrive with so-called standard contractual clauses, in which Pipedrive commits itself to processing user data only in accordance with our instructions and in compliance with the EU data protection standard. Pipedrive US is also certified under the Privacy Shield agreement, providing an additional guarantee to comply with European privacy legislation. To access the privacy policy of Pipedrive, please visit:

After we have processed your request, the purpose of the storage is omitted and no other legal exceptions exist, your data will be deleted from our CRM tool Pipedrive. You can always inform yourself about the data stored about you.


Our website uses plugins from Hotjar. This is provided by Hotjar Ltd, Level 2, St Julians Business Center, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe. We use Hotjar in order to better understand our users' needs and to optimize our service and users' experience.

Hotjar is a technology service that helps us better understand our users' experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don't like, etc.) and this enables us to build and maintain our service by means of user feedback. Hotjar uses cookies and other technologies to collect data on our users' behavior and their devices (in particular the IP address of the device (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website). Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar's Privacy Policy at

If you do not want to be recorded by Hotjar, you can disable it by setting the DoNotTrack header in your browser. For more information and more about Hotjar's data processing, please visit:

LinkedIn Conversion Tracking and Insight Tag

The LinkedIn Insight Tag is a piece of lightweight JavaScript code that we have added to our websites to enable in-depth campaign reporting and to help us unlock valuable insights about our website visitors. We use the LinkedIn Insight Tag to track conversions, retarget website visitors, and unlock additional insights about members interacting with our LinkedIn adverts.

The LinkedIn Insight Tag enables the collection of metadata such as IP address information, timestamp, and events such as page views. All data is encrypted. The LinkedIn browser cookie is stored in a visitor's browser until they delete the cookie or the cookie expires (there’s a rolling six-month expiration from the last time the visitor’s browser loaded the Insight Tag).

You can opt out of cookies from LinkedIn on your LinkedIn settings page and recommend you read their Cookie Policy for more information.


Our website uses plugins from YouTube, which is operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

If you visit one of our pages featuring a YouTube plugin, a connection to the YouTube servers is established. Here the YouTube server is informed about which of our pages you have visited. If you’re logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

YouTube is used to help make our website appealing. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.

Privacy Policy:

Google Maps

This site uses the Google Maps map service via an API. It is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use Google Maps, it is necessary to save your IP address. This information is generally transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. The use of Google Maps is in the interest of making our website appealing and to facilitate the location of places specified by us on the website. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.

Privacy Policy:

Google Web Fonts

For uniform representation of fonts, this page uses web fonts provided by Google. When you open a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.

For this purpose, your browser has to establish a direct connection to Google servers. Google thus becomes aware that our web page was accessed via your IP address.

The use of Google Web fonts is based on our legitimate interest of a uniform and attractive presentation of our website. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.

If your browser does not support web fonts, a standard font is used by your computer.

Further information:
privacy policy:


This site, especially the blog, uses the external Avatar-Service Gravatar for the display of pictures and avatars of users posting on this website. Gravatar is operated by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.

Gravatar is used to save user’s email addresses together with their profile pictures. That way when writing or commenting on websites (mostly blogs) the user’s profile picture can be displayed beside the post. For this purpose, the user’s encoded email address is transferred to Gravatar for them to check if a profile exists. We transmit exclusively the e-mail addresses of the authors of posts on our blog, thus mostly our own employees’. By displaying these pictures Gravatar can store your IP-address.

The use of Gravatar is in the interest of making our website appealing and to provide the opportunity for users to personalize their posts. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.

Further information:


This site uses plugins from Wistia a service for hosting and playing videos. It is operated by Wistia Inc., 17 Tudor Street, Cambridge, Massachusetts, United States, USA.

The Wistia server is informed about which of our pages you have visited. If you’re logged in to your Wistia account, Wistia allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your Wistia account.

Further information:

Online presence in social media

We maintain online presences within social networks and platforms in order to communicate with customers, prospects and users to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing guidelines apply to their respective operators.

Unless otherwise stated in our Privacy Policy, we process users' data if they communicate with us within social networks and platforms, e.g. write posts on our online presence or send us messages.

Schedule a demo