Privacy Policy

1. Privacy at a Glance

1.1 General Notes
This information gives you a quick overview of what happens to your personal data when you visit our website. Personal data is information by which you can be personally identified.

Who is responsible?
The data processing on this website is carried out by the website operator. You will find the contact details in the section “Controller” further below.

How do we collect your data?

• Directly: when you provide it to us (e.g. via forms).

• Automatically: by our IT systems when you visit the website (e.g. browser data, IP address).

What do we use your data for?
Part of the data is collected to ensure the smooth operation of the website. Other data may be used to analyze how visitors use the site.

What rights do you have with respect to your data?
You have the right to obtain information, correction, deletion, restriction, objection, data portability, as well as the right to lodge a complaint with a supervisory authority.

Analysis tools and third parties
When you visit our website, your browsing behavior may be analyzed using cookies and analytics tools. This is typically done anonymously. Details and objection options can be found in the following sections.

2. General Information and Mandatory Disclosures

2.1 Data protection
Protecting your personal data is important to us. We treat your data confidentially and in accordance with legal data protection regulations, especially the GDPR, and this Privacy Policy.

2.2 Controller
rankingCoach GmbH
c/o wework
Pilgrimstraße 6
50674 Cologne, Germany
Phone: +49 221 828 298 34
Email: support@rankingcoach.com

2.3 Purposes and legal bases of processing
We process personal data for providing our website, communication, analytics, and fulfillment of contracts. Legal bases are Art. 6(1)(a), (b), and (f) GDPR.

2.4 Recipients and transfer to third countries
Data may be passed on to external service providers. A list of subcontractors is available in our directory. Transfers to third countries occur only on the basis of suitable safeguards (e.g. EU Standard Contractual Clauses or EU‑US Data Privacy Framework).

2.5 Storage duration
Data is only stored as long as it is needed for the respective purpose or statutory retention periods apply.

2.6 Your rights
You have the following rights at any time with respect to your personal data:

• Access (Art. 15 GDPR) — to the data we process

• Rectification (Art. 16 GDPR) — of incorrect or incomplete data

• Deletion (Art. 17 GDPR) — insofar as no retention obligations conflict

• Restriction of processing (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Objection (Art. 21 GDPR) — particularly against direct advertising

• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future

• Right to complain to a competent data protection supervisory authority (Art. 77 GDPR)

2.7 Supervisory authority
You can find a list of data protection supervisory authorities here:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

2.8 Obligation to provide data
Providing personal data is voluntary. However, for contract conclusion (e.g. payment processing) certain information is required.

2.9 Encryption and payment transactions
All data transfers on our website — including enquiries via forms as well as payment data — are made exclusively via encrypted SSL/TLS connections. Thus your data is protected from unauthorized access by third parties.

2.10 Objection to promotional emails
The use of contact details published under the legal notice obligation by third parties for sending unsolicited advertising and information materials is hereby expressly contradicted. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, such as by spam emails.

3. Data Protection Officer

Statutory data protection officer
We have appointed the following Data Protection Officer:
Colin Simbach
TÜV Informationstechnik GmbH
TÜV NORD Group
Langemarckstraße 20
45141 Essen, Germany
Phone: +49 201 8999 461
Email: privacyguard@tuvit.de

4. Data Collection on Our Website

Cookies and Consent Management
Our website uses cookies. Cookies are small text files stored on your device.

Technically necessary cookies
Certain cookies are technically required for the operation of our website. These cookies are not subject to consent. The legal basis is § 25(2) TTDSG and Art. 6(1)(f) GDPR (legitimate interest in the error‑free provision of our services).

Analysis and marketing cookies
All other cookies not technically necessary (e.g. for analytics, statistics, or marketing) are used only with your explicit consent. The legal basis is § 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR. Consent can be revoked at any time via the settings in the cookie banner.

Consent Management Tool
We use Usercentrics to obtain and document your consents for storing certain cookies on your device or using certain technologies. The provider is Usercentrics GmbH, Sendlinger Straße, 80331 Munich, Germany. Legal basis: Art. 6(1)(c) GDPR (legal obligation) and Art. 7 GDPR.

Server log files
When you visit our website, our hosting provider automatically collects and stores information in so‑called server log files, which your browser transmits. These include:

• Browser type and version

• Operating system used

• Referrer URL

• Hostname of the accessing device

• Time of access

• IP address

A merging of this data with other data sources does not take place. The collection is for technical monitoring, security, and optimization. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the website).

Contact form
If you send us an inquiry via our contact form, we process your data to answer your inquiry and for any follow-up questions. No disclosure to third parties without your explicit consent. Legal basis: Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time with future effect, e.g. by email. Storage duration: until your matter is resolved or you withdraw consent, provided that no statutory retention obligations prevent deletion.

Registration on our website
You may register on our website to use additional features. The data collected will be used exclusively to provide the features for which you have registered. Mandatory fields must be fully completed; otherwise registration is not possible. Purpose: user management, notifications of offer changes or technical updates. Legal basis: Art. 6(1)(a) GDPR (consent). Revocation: at any time by informal email. Storage duration: as long as your account is active. Legal retention obligations remain unaffected.

Registration via Facebook Connect
Alternatively, you can register via Facebook Connect. After clicking “Log in with Facebook,” you will be redirected to Facebook. With your consent, Facebook transmits certain profile data to us — including name, email address, profile or cover photo, gender, birthday, country, language, and your Facebook ID. We use this data solely to create and personalize your user account. Legal basis: your explicit consent under Art. 6(1)(a) GDPR. More information can be found in Facebook’s privacy policy and terms of use.

Registration via Google Connect
Alternatively, you can register via Google Connect. After clicking “Log in with Google,” you will be redirected to Google. With your consent, Google transmits certain profile data to us — such as name, email, profile picture, or language settings. We use these data only to create and personalize your user account. Legal basis: your explicit consent under Art. 6(1)(a) GDPR. More information is available in Google’s privacy policy and terms of use.

Data processing for customer and contractual data
We process personal data insofar as it is necessary for the establishment, performance, or termination of a contractual relationship. Examples: name, address, bank details, booked services, usage history. Legal basis: Art. 6(1)(b) GDPR (contract or pre‑contractual measures). Storage duration: after contract termination, subject to legal retention obligations.

Data transfer in orders of digital content
To fulfill the contract, it may be necessary to pass on your data to third parties — e.g. to payment service providers (banks, Stripe, PayPal, etc.). No further disclosure occurs unless you have explicitly consented. Legal basis: Art. 6(1)(b) GDPR.

5. Use of Subcontractors and Third Parties (Subprocessors) under Art. 28 GDPR

5.1 Principle

In the course of providing our services, we make use of carefully selected external service providers (“subcontractors” or “subprocessors”) under Art. 28 GDPR. They process personal data exclusively on our behalf and following our instructions, based on a data processing agreement (DPA) pursuant to Art. 28(3) GDPR.

5.2 Categories of Subprocessors

We use subprocessors in the following areas:

• Hosting & infrastructure (cloud services, databases, CDN)

• Operation of our online marketing software (SEO, ads, listings)

• Customer support & communication

• Billing & payment processing

• Contract management with partners & end customers

• Website tracking & product improvement

• Cybersecurity measures

• Marketing activities (including testimonials)

• Employee & applicant management

• Newsletter distribution

• AI‑assisted processing

• Internal communication

• Data infrastructure & analytics platforms

5.3 Subprocessor Overview

*Data transfers to third countries (USA, UK, Israel) are based on Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.

5.4 Technical and Organizational Measures (TOMs)

All subprocessors are contractually obligated to implement appropriate technical and organizational measures pursuant to Art. 32 GDPR. This includes, in particular:

• Access controls (entry cards, 2FA)
  
• Encryption of data transmissions (TLS)
  
• Data minimization & pseudonymization
  
• Backups & redundancies
  
• Logging & auditing
  
• Staff training

5.5 Data transfer to third country
Some of our subprocessors are located outside the European Union (EU) or European Economic Area (EEA), particularly in the USA, Israel, and the UK. In using these services, personal data may be transferred to those third countries. We point out that comparable data protection standards as in the EU may not be guaranteed there. In order to ensure an adequate level of protection, we have concluded Standard Contractual Clauses (SCCs) with all relevant providers adopted by the European Commission. These oblige the providers to process our users’ data in accordance with GDPR standards. In addition, where possible, we apply technical and organizational safeguards (e.g. encryption, minimizing the transmitted data) to best protect your data.