Privacy Policy

1. Controller

TurnFriendly Software GmbH, Schillstraße 4, 90491 Nuremberg, as operator of this website (www.turnfriendly.com), is the controller under the GDPR, determining alone or jointly with others the purposes and means of processing personal data, referred to below as “data”.

2. Definitions

Below, we explain how your personal data is processed when you visit our website and use our content and services.

Under the GDPR, “personal data” means any information relating to an identified or identifiable natural person (data subject). A natural person is identifiable if they can be identified directly or indirectly, particularly by reference to an identifier such as a name, address, telephone number, email address, IP address, location data or specific characteristics, such as genetic, economic or social identity.

“Processing” means any operation or set of operations performed on data, with or without automated means. This includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or making available, alignment, combination, restriction, erasure or destruction.

For other data protection terms used here, please refer to the definitions in Article 4 GDPR.

3. Scope of personal data processing

You generally do not need to provide data to use our website. In some cases, however, we need your name, address and other details to provide the requested services.

This applies, for example, to sending information material or ordered goods, or answering individual questions. We will let you know where this is necessary. Otherwise, we process only data you provide voluntarily and, where applicable, data automatically collected when you visit our website, such as your IP address, pages visited, browser and operating system, access date and time, search engines used and names of downloaded files.

When you use services, we generally collect only the data needed to provide them. Any additional data we request is voluntary.

4. Purposes of personal data processing

We process the data you provide according to the principles of data minimisation and purpose limitation. Purpose limitation means that data is collected for specified, explicit and legitimate purposes and must not be further processed in a way incompatible with those purposes. Further processing for archiving in the public interest, scientific or historical research, or statistical purposes is not considered incompatible with the original purposes.

We generally process your data to answer enquiries, handle orders or give you access to specific information or offers. To maintain customer relationships, we or a service provider acting on our behalf may also use the data to inform you about product offers or conduct online surveys to better meet our customers’ needs.

We will process data you provide online only for the purposes communicated to you.

5. Disclosure to external parties

Your data is disclosed to external parties only in exceptional cases:

• To external service providers acting on our behalf (processors), where necessary to perform the contractual relationship, particularly software vendors, maintenance companies, software support providers and platform operators.
• To government institutions and authorities where legally required.
• Where you consent.

We enter into appropriate data processing agreements with processors under Article 28 GDPR. Service providers engaged by us are bound to confidentiality and compliance with the GDPR and BDSG. They may use the disclosed data only to fulfil their tasks. Other use is not permitted and is not undertaken by the service providers we engage.

Data is transferred to and further processed by government institutions and authorities entitled to receive it only under applicable laws or where required by a court decision.

Otherwise, we do not disclose data to third parties unless you have expressly consented.

We respect your decision not to provide data to support our customer relationship, particularly for direct marketing or market research. We will not sell or otherwise market your data to third parties unless you have consented.

6. Transfers to third countries

If using third-party services involves disclosing or transferring data to a third party in a country outside the European Union (EU) or European Economic Area (EEA), further processing takes place only on the basis of your consent, a legal obligation, our legitimate interests or where necessary to fulfil our contractual or pre-contractual obligations. Subject to statutory or contractual permissions, we process data, or have it processed, in a third country only where the specific conditions of Articles 44 et seq. GDPR are met. This means, for example, processing based on special safeguards such as an officially recognised level of data protection equivalent to the EU or compliance with officially recognised contractual obligations (EU Standard Contractual Clauses).

7. Legal basis for personal data processing

Where we obtain your consent to process personal data, Article 6(1)(a) GDPR provides the legal basis.

For processing personal data necessary to provide the requested service, we rely on Article 6(1)(b) GDPR.

Where processing is required to fulfil a legal obligation applicable to our company, Article 6(1)(c) GDPR provides the legal basis.

Where processing is necessary for a legitimate interest of our company or a third party, and that interest is not overridden by the data subject’s interests or fundamental rights and freedoms, Article 6(1)(f) GDPR provides the legal basis.

8. Erasure and retention periods

We retain your data only until the purpose has been fulfilled and no other statutory retention obligations apply, such as commercial or tax-law requirements.

If you have given consent, we retain your data until you withdraw it, provided there is no other legal basis for processing and no statutory retention period preventing erasure.

In individual cases, longer retention may be appropriate, for example as evidence to defend or enforce civil or public-law claims.

9. Hosting and technical access data

We use Webflow, Inc., based in the United States, to host this website. When you access our pages, technically necessary data is processed. This includes, in particular, your IP address, the URL requested, the date and time of access, and browser and device information. This processing supports the delivery, stability and security of the website.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest is providing a secure and reliably available website. Webflow processes data on our behalf in providing the website and uses subprocessors for this purpose.

Personal data may be processed in the United States. Webflow participates in the EU–US Data Privacy Framework. Where the transfer concerned is covered, it relies on the European Commission’s adequacy decision under Article 45 GDPR. The Webflow Data Processing Addendum provides EU Standard Contractual Clauses for other relevant cases.

Further information: Webflow DPA · Webflow privacy policy

10. Cookies

We use technically necessary cookies to remember your cookie choices and provide consent management. Optional cookies and similar technologies for marketing are used only after you have given your consent. You can change your choices and withdraw your consent for the future at any time through “Cookie preferences”. Further information about the Meta Pixel is provided in section 18.

10.1 Managing and recording your choices

We use CCM19 by Papoo Software & Media GmbH, Auguststraße 4, 53229 Bonn, Germany, to manage your cookie choices. CCM19 asks for your choices and controls the loading of optional services. Your choices are stored in a technically necessary cookie in your browser. The cookie and your choices are configured to remain valid for 180 days. You are asked to choose again after legally relevant changes.

To document your choices, CCM19 processes a randomly generated consent ID, the time, language and selected purposes and services, as well as technical connection and device information. Processing takes place on our behalf in Germany. According to CCM19, consent records are automatically deleted after the configured validity period and an additional grace period of one month.

Your choices are stored as technically necessary information on the basis of section 25(2) TDDDG. Where personal data is processed to demonstrate your consent, the legal basis is Article 6(1)(c) in conjunction with Article 7(1) GDPR. Optional services are used on the basis of your consent. You can change your choices or withdraw consent for the future at any time through the cookie settings.

11. Analytics and tracking tools

After you consent to marketing, we use the Meta Pixel to measure and evaluate our advertising. This processing is explained in section 18. The technical delivery of the website and management of your cookie choices are separate from these optional marketing purposes.

Google Analytics 4, Google Ads and the LinkedIn Insight Tag are planned for this website but are not currently enabled. Before using them, we will add the specific settings, cookies and retention periods to this notice and the consent manager. They will only be used with your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. You can withdraw your consent at any time via the privacy settings with effect for the future.

11.1 Google Analytics 4

We plan to use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse website usage statistically. This may involve page views, interactions, referring pages, device and browser information and cookie identifiers. IP addresses are processed technically; Google states that Google Analytics 4 does not log or store them. Data may be transferred to Google LLC in the United States. Retention will be specified during setup; no Analytics retention period is currently configured for this website.

11.2 Google Ads

Google Ads, provided by Google Ireland Limited, is intended to measure the effectiveness of our advertising campaigns and resulting enquiries. This may involve ad click identifiers, cookies, pages visited, timestamps and device and browser information. Before activation, we will specify and disclose separately whether audience features will also be used. Transfers to Google LLC in the United States are possible. Specific measurement features and retention periods have not yet been determined; this website does not currently use Google Ads tracking.

11.3 LinkedIn Insight Tag

We plan to use the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company, Ireland, to measure the effectiveness of our LinkedIn advertising. This may involve URLs, referring pages, IP addresses, browser and device information, timestamps and cookie identifiers. Audience features may also be used depending on the future configuration. Processing in the United States is possible. The tag is not yet active here; the specific features and retention periods will be added before activation.

Before activation, we will also check the necessary agreements and safeguards for international data transfers. Google describes safeguards including the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses. The grounds applicable to the specific integration will be documented before use.

We use Google Search Console to review our visibility in Google Search. Its verification meta tag confirms website ownership; the tag itself does not load a tracking script or establish an additional browser connection to Google. Plain links to our LinkedIn profiles or Google services do not embed an Insight Tag or Analytics either. When you visit the linked website, its privacy notice also applies.

12. YouTube Videos

We embed YouTube videos on our video page. Preview images are provided through our Webflow asset library. The YouTube player is only loaded after you give permission by clicking “Load video”. This establishes a connection to YouTube/Google. Your IP address, browser and device information and video usage data may then be processed, including outside the EU. We use the enhanced privacy mode via youtube-nocookie.com. This reduces certain personalisations but does not prevent all data processing. You can remove the player by clicking “Disable video”. This ends the embedding on our page but does not reverse transfers that have already taken place.

For the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading the player is based on your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. Google determines further retention according to processing purposes and legal requirements. For possible transfers to Google LLC in the United States, Google describes safeguards including the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses.

13. Contact Form

We process the information you provide to answer your enquiry and communicate with you. If your enquiry concerns entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR. We handle other general enquiries under Article 6(1)(f) GDPR; our legitimate interest is responding to enquiries and communicating with prospective customers. Technical information, including your IP address and submission time, is processed under Article 6(1)(f) GDPR to provide and secure form submissions. Acknowledging the privacy notice confirms that you have taken note of it; it is not blanket consent to advertising or other additional processing purposes.

We use Form.taxi, operated by wrkt*biz Reinhard Söllradl, Eferding, Austria, to receive and forward contact enquiries technically. Acting as a processor, the service handles the contact details, industry, message and acknowledgement of the privacy notice you enter, as well as technical metadata such as IP address, browser information and submission time. According to the provider, processing and hosting take place within the EU.

Form.taxi states that submitted forms are kept in its submission archive for no longer than one year; submissions identified as spam are deleted after one month. Separately, we retain correspondence received by us for as long as necessary to handle the enquiry and, where applicable, comply with statutory retention obligations. The legal bases for contact enquiries stated above also apply to technical transmission through Form.taxi.

14. Recruitment

You can apply directly through our website, by email or by post. Open positions are listed in the “Careers” section of our website.

14.1 Scope of processing

Personal data is necessary to participate in recruitment. This includes identification data such as first name, surname and date of birth; contact details such as address, telephone number or email address; and information about education or employment history, such as school and employment references, training, internships and previous employers. This data may come from documents you provide, such as a cover letter, CV, application photo, certificates or other evidence of qualifications.

14.2 Purpose and legal basis

We process the data described above to conduct recruitment. Where you have consented, Article 6(1)(a) GDPR provides the legal basis. Where processing is intended to establish an employment or contractual relationship, the legal basis is Article 88(1) GDPR in conjunction with Section 26(1) BDSG, or Article 6(1)(b) GDPR.

14.3 Retention period

Data is erased once it is no longer needed for its collection purpose. If recruitment leads to employment or another service relationship, the data continues to be stored and is transferred to the personnel file. Otherwise, recruitment ends when a rejection is received, and the data is erased after six months. Data is not erased where further processing and retention are necessary in an individual case to establish, exercise or defend legal claims. We then have a legitimate interest in continued processing and retention under Article 6(1)(f) GDPR. Data is also retained where statutory requirements oblige us to do so.

14.4 Withdrawal and objection

You may withdraw consent at any time with future effect and object to processing your personal data at any time. In particular, you may withdraw your application at any time. During recruitment, provide only the personal data needed to participate and conduct the process. There is no statutory or contractual obligation to provide data. However, without it we cannot conduct recruitment or consider your application. The same applies if you object to data processing. You may request changes to your stored data at any time. To withdraw consent, write to TurnFriendly Software GmbH, Schillstraße 4, 90491 Nuremberg, or email hello@turnfriendly.com.

15. Children and young people

People under 16 should not send us data without parental or guardian consent. We do not request, collect or disclose data from children and young people under 16.

16. Security

We have implemented technical and organisational security measures in accordance with statutory requirements to protect your data against loss, destruction, manipulation and unauthorised access.

These measures include encrypted data transfer between your browser and our server. All employees, people involved in processing and service providers engaged by us are bound to comply with the GDPR, BDSG and other relevant data protection laws and to handle data confidentially.

Our safeguards are reviewed regularly and continuously updated in line with technological development.

17. Your rights

If we process your data, you have extensive rights as a data subject. To exercise them, write to TurnFriendly Software GmbH, Schillstraße 4, 90491 Nuremberg, or email hello@turnfriendly.com. Your rights are explained below.

17.1 Withdrawal of consent

Where we require your consent to process data, we obtain it and use the data for the purposes specified with that consent. Your consent is recorded digitally.

17.2 Right of access

Under Article 15 GDPR, you may obtain information about data we process concerning you at any time. In particular, you may ask about processing purposes, categories of data processed, categories of possible recipients and planned retention periods.

17.3 Right to rectification

Under Article 16 GDPR, you may request correction or completion of inaccurate data stored by us.

17.4 Right to erasure

Under Article 17 GDPR, you may request erasure where storage is no longer necessary and no other legal basis exists for processing. You may also request erasure if you objected to processing and no overriding legitimate grounds remain, if your data was processed unlawfully, or if EU or national law requires erasure.

17.5 Right to restriction

Under Article 18 GDPR, you may request restriction where you contest accuracy for a period allowing the controller to verify it; where processing is unlawful but you oppose erasure; where the processing purpose has ended but you need the data for legal claims; or where you have objected under Article 21 GDPR and it has not yet been established whether the controller’s legitimate grounds override your interests.

17.6 Right to data portability

Under Article 20 GDPR, you may receive data concerning you in a commonly used, structured and machine-readable format. Under certain conditions, you may also request direct transfer from one controller to another where technically feasible.

17.7 Right to object

You may object at any time to use of your data for the purposes described above under Article 21 GDPR, where the objection concerns direct marketing or grounds relating to your particular situation. For direct marketing, you have a general right to object that we will implement without requiring grounds relating to a particular situation.

17.8 Right to lodge a complaint

Without prejudice to other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, workplace or the alleged infringement, if you believe processing of your personal data infringes the GDPR.

A list of supervisory authorities for the private sector and their addresses is available at: German supervisory authorities.

18. Meta Pixel

After you have provided your consent, we use the Meta Pixel on our website.

The provider for users within the European Union and the European Economic Area is:

Meta Platforms Ireland Limited Merrion Road Dublin 4 D04 X2K5 Ireland

The Meta Pixel is part of the Meta Business Tools and enables us, in particular, to measure the effectiveness of our advertising on Facebook and Instagram, record conversions, analyse and optimise advertising campaigns and, where applicable, create audiences for subsequent advertising.

18.1 Data Processed

Depending on the specific use and configuration, the following information in particular may be processed or transmitted to Meta:

• websites and URLs accessed,

• time of page access,

• referrer information,

• IP address,

• browser and device information,

• cookie or similar identifiers,

• information about interactions with our website,

• events or conversions defined by us, and

• information used to attribute a website visit or conversion to an advertising campaign.

Meta may combine information received via the Meta Pixel with other information already available to Meta, for example through the use of Facebook, Instagram or other Meta services.

Where Meta processes this information as an independent controller, the subsequent processing is carried out under Meta’s own responsibility.

18.2 Purposes of Processing

We use the Meta Pixel in particular for:

• conversion measurement,

• measuring the effectiveness of our advertising on Meta platforms,

• analysing advertising campaign performance,

• optimising our advertising activities, and

• where applicable, creating audiences for retargeting.

18.3 Legal Basis

The Meta Pixel is activated only after you have provided your consent.

The legal bases are:

• Section 25(1) TDDDG for storing information on or accessing information from your device, and

• Art. 6(1)(a) GDPR for the associated processing of personal data.

You may withdraw your consent at any time with effect for the future via our cookie or privacy settings.

18.4 Responsibility of Meta and TurnFriendly

For certain processing operations involving personal event data in connection with the Meta Business Tools, TurnFriendly Software GmbH and Meta Platforms Ireland Limited may act as joint controllers within the meaning of Art. 26 GDPR.

This joint controllership relates in particular to the collection of certain personal data via the Meta Pixel and its subsequent transmission to Meta for certain purposes defined by Meta.

For other processing activities, Meta may act as a processor or as an independent controller. The specific allocation of data protection responsibilities depends on the respective purpose of processing and the contractual terms applicable to the Meta Business Tools.

18.5 Storage Period

Under the terms applicable to the Meta Business Tools, Meta may store event data for a maximum period of two years.

Audiences created on the basis of such event data may, under Meta’s terms, be stored until they are deleted using the relevant account tools.

We have no direct influence over any additional processing or retention periods applied by Meta.

18.6 Transfers to Third Countries

Personal data may also be processed by Meta Platforms, Inc. and other Meta companies in the United States or other countries outside the European Economic Area.

Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework for certain categories of data, including the Meta Business Tools.

Where the relevant requirements are met, such transfers may be based on the corresponding adequacy decision of the European Commission. Depending on the specific processing activity, additional transfer mechanisms may also apply.

Further information about data processing by Meta and about your privacy and settings options can be found in Meta’s privacy information and the terms applicable to the Meta Business Tools.

19. Changes to our Privacy Policy

We reserve the right to adapt our security and privacy measures where necessary due to technical developments. In such cases, we will also update our privacy notice. Please refer to the current version of this notice. Last updated: 30 October 2026.