Privacy Policy

This Privacy Policy applies to visits to our website curly.de as well as to booking appointments and contacting us via this website.

Note on scope: This Policy does not apply to participation in an AI-supported interview via our platform (e.g. at demo.curly.de or via an interview link you have received from a company). In those cases, the commissioning company is generally the controller, and curly Intelligence GmbH processes the data as a processor pursuant to Art. 28 GDPR. You will be shown a separate, study-specific privacy notice before an interview begins. See Section 11.

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:

curly Intelligence GmbH Sapporobogen 6–8, c/o hph 80637 Munich Germany

Represented by the managing directors Philipp Nastaly and Paul Büchter Commercial register: Munich Local Court (Amtsgericht München), HRB 307469 VAT ID: DE458907252

General contact: hey@curly.de

1a. Data Protection Officer

We have appointed an external Data Protection Officer. You may contact him directly at any time with any questions regarding data protection and the exercise of your rights:

Kilian Schmidt Kertos GmbH Brienner Straße 41 80333 Munich Germany

Email: dataprivacy@kertos.io

The Data Protection Officer is also the point of contact for data subjects and for data protection supervisory authorities. Alternatively, you can reach us with data protection questions at hey@curly.de.

2. Principles

We process personal data only to the extent necessary to provide a functional website and our content, or where you have given us your consent. We do not pass your data on to third parties for advertising purposes and we do not sell it.

Personal data is any information relating to an identified or identifiable natural person – e.g. name, email address or IP address.

3. Hosting and Provision of the Website

Our website is hosted on the Framer platform. The provider is Framer B.V., Amsterdam, Netherlands.

When you access our website, technically necessary data is transmitted to our host's servers and processed in server log files (see Section 4). Content is delivered via a Content Delivery Network (CDN), which serves content from servers distributed worldwide so that the site loads quickly and reliably. Static content (images, fonts, scripts) is loaded from the domain framerusercontent.com; your IP address is transmitted in this process as technically necessary.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and high-performance provision of our website.

We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR.

4. Server Log Files

Each time our website is accessed, information transmitted by your browser is automatically collected:

• truncated or full IP address of the requesting device

• date and time of access

• page accessed / file requested and amount of data transferred

• HTTP status code

• referrer URL (the previously visited page)

• browser type, browser version and operating system

We cannot attribute this data to a specific person without additional information. We do not merge this data with other data sources.

Purpose: delivery of the website, ensuring system security and stability, detecting and defending against attacks and misuse, technical error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Retention period: Log files are deleted or anonymised after no more than 30 days, unless longer retention is required in individual cases to investigate a security incident.

5. Cookies and Similar Technologies

Our website uses cookies – small text files that are stored on your device.

Technically necessary cookies are required for the website to function and for your settings (e.g. language selection, your cookie decision) to be saved. We use these without your consent on the basis of Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR.

Analytics cookies (see Section 6) are used only with your prior consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We request your consent via our cookie banner before use.

You may withdraw your consent at any time with effect for the future – via the cookie settings on our website or by contacting us at datenschutz@curly.de or our Data Protection Officer at dataprivacy@kertos.io. In addition, you can delete cookies at any time via your browser settings or generally refuse their storage; the functionality of our website may be limited as a result.

A detailed overview of the cookies used, their providers and lifetimes can be found in our Cookie Policy at curly.de/cookies.

6. Web Analytics with Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to statistically evaluate the use of our website and to improve our offering.

Data processed: IP address (used by Google to determine coarse location and not permanently logged), pseudonymous user and session identifiers, pages visited and time spent, click and scroll events, referrer source, device type, browser/operating system, language and approximate location (country/region).

Cookies: _ga, _gid, _gat (details and lifetimes in our Cookie Policy).

Purpose: reach measurement, analysis of usage behaviour in aggregated form, optimisation of content and website performance. We do not use Google Analytics for advertising purposes, for personalised advertising or for building audiences for third parties.

Legal basis: your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. No analysis takes place without your consent. You may withdraw your consent at any time via the cookie settings.

Data processing: We have concluded Google's data processing terms (Google Ads Data Processing Terms / Google Measurement Controller-Controller Data Protection Terms) with Google.

Third-country transfer: Data is collected via Google Ireland Limited (EU). A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework, so that an adequacy decision of the European Commission pursuant to Art. 45 GDPR provides the basis for the transfer; in addition, the EU Standard Contractual Clauses pursuant to Art. 46 GDPR apply.

Retention period: User- and event-level data collected by Google Analytics is automatically deleted after the retention period set in our property, which is a maximum of 14 months. Aggregated reporting data without personal reference may be retained beyond this.

Objection: You can additionally prevent collection by Google Analytics by installing Google's browser add-on: tools.google.com/dlpage/gaoptout.

Further information on how Google handles user data can be found in Google's privacy policy: policies.google.com/privacy.

7. Contact by Email

If you contact us by email (e.g. via the addresses provided on the website, hey@curly.de), we process your email address, your name and the contents of your message in order to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR, insofar as your enquiry serves the initiation or performance of a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Retention period: We delete your enquiry once it has been fully processed and no statutory retention obligations (in particular commercial and tax law periods of up to 10 years) prevent deletion.

8. Appointment Booking for Demo Calls (Google Calendar Appointment Scheduling)

On our website, we offer you the option of booking an appointment for a demo or consultation call directly via a link. For scheduling, we use the appointment booking function of Google Calendar as part of Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you click on the booking link, you are redirected to a booking page provided by Google (calendar.app.google). In doing so, you leave our website; Google initially processes your data there under its own responsibility in accordance with its own privacy terms, in particular your IP address and device information. If you are logged in to your Google account, Google may associate the page visit with your account.

Data you enter: name, email address, selected appointment and optional details (e.g. company, subject, telephone number). This data is stored in our Google Workspace calendar and is used exclusively to prepare for and conduct the call. You will receive an appointment confirmation from Google by email. For this processing, Google acts as our processor on the basis of the Google Workspace Data Processing Amendment.

Purpose: arranging, confirming and conducting the call you requested. Legal basis: Art. 6(1)(b) GDPR (contract initiation at your request); insofar as you provide voluntary additional information, Art. 6(1)(a) GDPR. Third-country transfer: see Section 6 (DPF certification of Google LLC, EU Standard Contractual Clauses). Retention period: We delete calendar entries and associated details as soon as they are no longer required for the follow-up of the call, and no later than after 24 months, provided that no contractual relationship arises and no statutory retention periods apply.

Booking is voluntary. Alternatively, you can arrange an appointment at any time by emailing hey@curly.de.

9. Embedded Content (Google Slides)

In certain places on our website, we embed or link to a publicly shared presentation via the Google Slides / Google Docs service (Google Ireland Limited). When the embedded content is retrieved, a connection to Google's servers is established; in this process, your IP address and device information are transmitted to Google.

Purpose: presentation of product and introductory content. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation of our offering) or your consent pursuant to Art. 6(1)(a) GDPR, insofar as the content is only embedded after you have given your consent. Third-country transfer: see Section 6.

We have no influence over any further processing of this data by Google. Further details can be found at policies.google.com/privacy.

10. Link to LinkedIn

On our website, we link to our company profile on the LinkedIn network. This is a simple link, not a social media plugin: a connection to LinkedIn is only established when you actively click on the link. Only then is data transmitted to LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn is responsible for the processing of your data on the LinkedIn platform; LinkedIn's privacy policy applies (linkedin.com/legal/privacy-policy).

11. Use of Our Platform and Interview Participation

Links on our website (e.g. "Try curly" / demo.curly.de) take you to our product. A separate privacy notice applies to processing there, which is displayed to you before an interview begins and to which you must expressly consent.

When conducting interviews for our customers, the commissioning company is generally the controller within the meaning of the GDPR; we process the data on its behalf as a processor on the basis of a contract pursuant to Art. 28 GDPR. All interview data is stored in data centres within the European Union. Your data is not used to train AI models; this is contractually excluded with all providers we use.

Upon request, we are happy to provide prospective customers and customers with our data processing agreement, including the technical and organisational measures and the complete list of sub-processors: datenschutz@curly.de.

12. Recipients of Your Data

Your data is only transmitted to third parties insofar as this is necessary to fulfil the purposes stated above. Categories of recipients are:

• hosting and CDN service providers (Framer B.V., Netherlands)

• providers of analytics, collaboration and scheduling services (Google Ireland Limited, Ireland)

• email and IT service providers that support us in operating our systems

• tax advisors, lawyers, authorities, insofar as this is required by law or necessary to safeguard legitimate interests

We have concluded contracts pursuant to Art. 28 GDPR with all processors. Transfers to third countries take place only under the conditions described in Section 6 (adequacy decision or EU Standard Contractual Clauses pursuant to Art. 46 GDPR).

13. Retention Period

We process and store your personal data only for as long as is necessary to achieve the respective processing purpose. The specific periods are stated in the respective sections. Beyond this, we store data insofar as statutory retention obligations exist (in particular Sections 257 HGB, 147 AO: 6 or 10 years); in this case, we restrict processing to the fulfilment of these obligations.

14. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• access to the personal data we process about you (Art. 15 GDPR)

• rectification of inaccurate or incomplete data (Art. 16 GDPR)

• erasure of your data (Art. 17 GDPR)

• restriction of processing (Art. 18 GDPR)

• data portability in a structured, commonly used format (Art. 20 GDPR)

• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, a message to datenschutz@curly.de or directly to our Data Protection Officer at dataprivacy@kertos.io (contact details see Section 1a) is sufficient. Exercising these rights is free of charge for you.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA) Promenade 27, 91522 Ansbach, Germany www.lda.bayern.de

You may also contact the supervisory authority of your habitual residence or place of work.

15. No Obligation to Provide Data, No Automated Decision-Making

The provision of your personal data is neither required by law nor by contract. For the mere use of our website, you do not need to provide any data other than the technically necessary access data. If you wish to book an appointment or contact us, we require the information marked as mandatory in order to process your request.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website.

16. Data Security

We take appropriate technical and organisational measures to protect your data against manipulation, loss, destruction and unauthorised access. Data transmission between your browser and our website is encrypted via TLS (HTTPS). Our security measures are continuously reviewed and improved in line with technological developments.

17. Changes to This Privacy Policy

We will amend this Privacy Policy if the legal situation, our services or the data processing on our website changes. The version published on this page applies in each case. The current version date is stated above.