Data protection

5. Consent Management with CookieYes

We use CookieYes to manage and document your cookie settings. The provider is CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.

CookieYes stores your selections in your browser so that they can be applied when you visit the site again. In addition, consent records may be processed, specifically a consent ID, the time and scope of your selections, and a truncated or masked IP address.

The processing is necessary to implement your selections and to document the required consents. The legal basis is Article 6(1)(c) of the GDPR in conjunction with our data protection documentation obligations. The required storage of your cookie preferences on your device is based on Section 25(2)(2) of the TDDDG.

CookieYes is used as a data processor. The duration of the consent cookie is specified in the cookie table. According to CookieYes, consent logs are retained for up to five years under the Basic plan and can be exported within this period.

Further information: CookieYes Privacy Policy and CookieYes DPA.

6. Contact Requests

If you contact us via a form or by email, we will process the information you provide. This may include your name, company, email address, phone number, subject line, message content, and attached documents. Technical connection data may be processed for the purposes of transmission and protection against misuse.

We use this data to process your inquiry and communicate with you.

If your inquiry relates to a contract or pre-contractual measures, the legal basis is Article 6(1)(b) of the GDPR. We process other inquiries based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and responding to incoming inquiries.

We use our hosting and email service providers for the technical transmission and storage of data:

For our business email communication, we use Microsoft 365 with Exchange Online. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. In particular, email addresses, message content, attachments, and technical communication data are processed. Microsoft processes the mailbox data as a data processor to provide the service. Processing outside the European Economic Area, particularly in the U.S., is possible. For such transfers, Microsoft specifically provides for EU Standard Contractual Clauses.

We generally delete data from general contact inquiries no later than December 31 of the calendar year following the year in which the data was last processed. To the extent that statutory retention requirements apply or certain data is needed for specific legal claims, we retain this data separately for the required period.

7. Event Registrations

When you register for an event, we process the information requested on the form. Depending on the event, this includes, in particular, your name, email address, company, and, if applicable, other information necessary for organizational purposes.

This processing is necessary for the registration, organization, conduct, and follow-up of the respective event, as well as for related communication.

To the extent that processing is necessary to carry out the agreed-upon participation, it is based on Article 6(1)(b) of the GDPR. Additional organizational processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the proper organization of the event.

Technical transmission and storage are handled by the service providers listed in the “Contact Inquiries” section.

We generally delete registration data no later than December 31 of the calendar year following the year in which the event ends. Documents and data subject to statutory retention requirements regarding specific legal claims are retained separately for the required period in each case.

Registering for an event does not automatically result in your inclusion in our newsletter mailing list.

8. Newsletter and MailPoet Sending Service

If you subscribe to our newsletter, we will use your email address and the additional information provided in the registration form to send you the Odego Quarterly Newsletter, which contains information about events, expert articles, and our offerings.

We use MailPoet to manage subscriptions. The newsletter is sent via the MailPoet Sending Service.

The contractual provider and recipient of the mailing data is: WooCommerce Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland, a company of the Automattic Group.

Newsletter registration is based on your consent in accordance with Article 6(1)(a) of the GDPR. We use the double opt-in procedure for confirmation: After registering, you will receive an email containing a confirmation link. Your subscription will be activated only after you have confirmed it.

To document your registration and consent, we store the necessary information, including, in particular, the time of registration and confirmation, as well as the associated technical verification data.

MailPoet is used as a data processor for administration and distribution. In particular, the recipient’s email address, necessary personalization data, message content, and technical distribution information are processed.

Data may be processed by companies within the Automattic Group and other subcontractors outside the European Economic Area, particularly in the United States. To safeguard such transfers, Automattic provides for EU Standard Contractual Clauses.

You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in each issue or by sending a message to the contact information listed above.

We will retain your subscription data until you unsubscribe. After that, we will delete any data that is no longer needed.

We retain records of consent for the duration of the subscription and until the end of the third calendar year following termination, solely for the purposes of providing evidence and defending our legal rights. Data will only be retained for a longer period if necessary to address specific legal claims.

To ensure that unsubscriptions or objections to advertising are honored, a minimal flag consisting of the email address and block status may be retained. It is not used for advertising. We review at least once a year whether it is still necessary and delete it as soon as it is no longer needed.

Further information: MailPoet/Automattic Privacy Policy.

No Individual Tracking of Opens and Clicks

We use MailPoet with open, click, and cookie-based activity tracking disabled. Data necessary for sending and delivery management—such as delivery status, undeliverable messages, and unsubscriptions—will continue to be processed.

9. Cloudflare: Delivery and Security

We use services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, to ensure the secure and reliable delivery of our website.

In doing so, Cloudflare processes, in particular, IP addresses as well as technical query and connection data. The purposes of this processing are to deliver content, detect malicious access attempts, and protect against attacks.

The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the availability and security of our website. Cloudflare processes this data as a data processor to provide its services.

Processing in the United States is possible. For such transfers, Cloudflare relies on its certification under the EU-U.S. Data Privacy Framework; for other relevant transfers, the Cloudflare DPA provides for standard contractual clauses.

Cloudflare’s retention periods apply to the security and log data used.

Additional information: Cloudflare Privacy Policy and Cloudflare DPA.

10. Form Protection with Cloudflare Turnstile

We use Cloudflare Turnstile to protect our forms from automated logins and abusive submissions. The provider is Cloudflare, Inc., as mentioned in the previous section.

Turnstile processes technical signals, including IP address, browser information, TLS connection characteristics, and the associated webpage. Cloudflare processes this data on our behalf to provide form protection and, on its own behalf, to improve bot detection.

Our legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in protecting against spam and misuse. To the extent that storage or access to the end device is absolutely necessary for this purpose, it is carried out on the basis of Section 25(2)(2) of the TDDDG.

The retention period for the processed signals corresponds to that of Cloudflare.

For transfers to third countries, the safeguards described in the Cloudflare section apply. Further information: Turnstile Privacy Policy.

11. Multilingual Support with WPML

We use WPML to make our website available in multiple languages.

WPML can store the selected language in the browser, specifically via the cookie listed in the cookie overview.

The legal basis for the processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing a consistent multilingual website. To the extent that storage is absolutely necessary for the language function you have requested, it is carried out on the basis of Section 25(2)(2) of the TDDDG.

Further information: WPML Privacy Policy.

12. Google Tag Manager

We use Google Tag Manager to technically manage the integration of certain services. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager container is not loaded on our website until you have consented to the “Analytics” category in the cookie banner. When it is loaded, your IP address and technical connection data, in particular, are transmitted to Google.

The services integrated via Tag Manager are explained in the respective sections of this Privacy Policy.

The legal basis is Article 6(1)(a) of the GDPR. To the extent that information is stored on or read from your device, Section 25(1) of the TDDDG serves as the additional legal basis.

You can revoke your consent at any time via the cookie settings. For any transfers to third countries, the safeguards described in the following Google Analytics section apply.

13. Google Analytics 4

We use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze the use of our website and improve our services.

Google Analytics is activated only after you give your consent in the “Analysis” category. In particular, the following data may be processed: pages visited, interactions, timestamps, referring pages, device and browser information, approximate location information, and pseudonymous user identifiers.

The IP address is processed to derive location information and is subsequently discarded; Google Analytics 4 does not store it as an IP address.

The legal basis is Article 6(1)(a) of the GDPR, as well as § 25(1) of the TDDDG for storage and access on your device. Google acts as a data processor in the context of the analysis.

Data may be transferred to Google LLC and other Google recipients in the United States. Google uses the EU-U.S. Data Privacy Framework and, where applicable, standard contractual clauses for this purpose. Information on the safeguards can be found in Google’s guidelines on international data transfers.

Retention Period

We have set a retention period of 14 months for user- and event-level data. When a user becomes active again, the retention period for the relevant user ID starts over. User-related data for regular visitors may therefore be stored for a longer total period.

Once the respective retention period has expired, the relevant data is automatically deleted as part of Google Analytics’ monthly deletion processes. This setting does not apply to aggregated standard reports. The expiration times of the cookies used are listed separately in the cookie overview.

You can revoke your consent at any time via the cookie settings. For more information, see the Google Privacy Policy and Google Analytics Data Retention.

14. YouTube Videos

We embed YouTube videos on individual pages. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are loaded only after the required consent has been given via our cookie settings. A placeholder is displayed before the video is loaded; external YouTube thumbnails are not loaded at this time.

Once enabled, YouTube receives, in particular, your IP address and technical information about the video view. YouTube may use cookies and similar storage technologies and process information about your interaction with the video. If you are signed in to Google, information may be associated with your Google account.

The legal basis is Article 6(1)(a) of the GDPR, as well as § 25(1) of the TDDDG for data storage and access on your device.

Google also processes data on its own behalf as part of its own services. Processing may take place in the United States. The transfer safeguards described by Google are linked in the section on Google Analytics.

The durations of the cookies and storage technologies used can be found in the cookie overview. Information on further storage by Google can be found in the Google Privacy Policy.

15. Locally Embedded Fonts

The font files used on our website are hosted locally. Loading these font files does not establish a connection to Google Fonts or Adobe Fonts.

This Privacy Policy is available in German and English. In the event of any discrepancies between the language versions, the German version shall prevail. Your statutory data protection rights remain unaffected.

Effective: October 13, 2026

Our legal notice contains further information about the company.