Date: May 2026

We use the Google Tag Manager on our websites. The Google Tag Manager is a service of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Through Google Tag Manager, we can include various codes and services on our websites in an orderly and simplified manner. This allows us to manage website tags via one interface. When a tag is triggered, Google may process information (including personal data) and process it. In particular, the following personal data is processed by Google Tag Manager:

• Online identifiers (including cookie identifiers)
• IP adress

We use the Google Tag Manager in our interest to be able to make a simplified and clear integration of various services. In addition, the integration of the Google Tag Manager optimizes the loading times of the various services. The legal basis for this is Art. 6 para. 1 lit. f GDPR.

Google processes the data on our behalf as a so-called Processor pursuant to Art. 28 GDPR. In the context of using the services of the Google Tag Manager, there are also data transfers from Google to affiliated companies and/or subcontractors. In this context, the above-mentioned data may be transferred to the USA and stored there. Further information regarding international data transfers can be found in Section 11 of this Privacy Policy.

We use Efecte to handle incoming support requests. Efecte is a service provided by Efecte Germany GmbH, Fürstenrieder Straße 279a, 81377 München. Efecte is used to integrate contact forms and forward your requests to us. In particular, the following personal data is processed by Efecte when you submit a support request to us:

• E-mail adress
• Name
• Your adress
• Information about your request (including text entries, photographs, videos)

We use Efecte in our interest to integrate a convenient and simple solution for handling support requests and to be able to guarantee you fast and uncomplicated processing of your requests in this way. The legal basis for this is Art. 6 para. 1 lit. f GDPR. The use of Efecte is optional. If you do not agree to us processing your data using Efecte, we offer you alternative contact options for submitting support requests by phone or mail.

Efecte processes the data on our behalf as a so-called Processor pursuant to Art. 28 GDPR. The data processing takes place exclusively in a country of the European Union or the European Economic Area.

We process e-mails that you transfer to us and we transfer to you using the services of our e-mail provider. In the context of e-mail communication, our e-mail provider processes your personal data (i.e. your e-mail address and the information you provide in the e-mail) on our assignment to enable us to communicate with you by e-mail or, if you are our customer, to process the contract. The processing of your personal data occurs on the basis of Art. 6 para. 1  lit. f or Art. 6 para. 1  lit. b GDPR. We delete the data if it is no longer necessary and there are no legal obligations to the contrary. We review the necessity every six months.

With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. In addition, our newsletters contain information about our products, promotions and our company.

For the registration to our newsletter we use the so-called double opt-in procedure. This means that after your registration, we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm that you wish to receive the newsletter shipping. In addition, we store your IP addresses and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

Mandatory information for sending the newsletter are your e-mail address and name. After your confirmation, we store your e-mail address for the purpose of sending the newsletter and your name for the purpose of personal address in the mailings. The legal basis is Art. 6 para. 1 lit. a GDPR. We store your e-mail address for this purpose until you revoke your consent.

For mailing our newsletter, we use the services of service providers who act on our behalf and within the scope of our instructions as so-called Processors in accordance with Art. 28 GDPR personal data. This also includes service providers based in the USA. Further information regarding international data transfers can be found in Section 11 of this Privacy Policy..

If you contact us by phone, we need your personal data (e.g. name, contact details, etc.) to process your inquiry or request. This data processing is necessary to enable us to communicate with you or, if you are our customer, to process the contract. The processing of your personal data is based on Art. 6 para. 1 lit. f or Art. 6 para. 1 lit. b GDPR. We delete the data if it is no longer necessary and there are no legal obligations to the contrary. We review the necessity every six months.

6.10. Within the scope of contacting us via contact form

If you contact us via contact form, we need your personal data (escpecially your first name, last name, salutation, company and e-mail address) to process your inquiry or request. This data processing is necessary to enable us to communicate with you or, if you are our customer, to process the contract. The processing of your personal data is based on Art. 6 para. 1 lit. f or Art. 6 para. 1 lit. b GDPR. We delete the data if it is no longer necessary and there are no legal obligations to the contrary. We review the necessity every six months.

For U.S. users, we process this information for business purposes as described above. Newsletter, webinar, whitepaper, or other marketing consent must be presented as an unchecked choice and must not be pre-selected.

6.11. In the context of surveys with Microsoft Forms

To conduct surveys, we use Microsoft Forms from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). Microsoft Forms enables us to design and evaluate surveys and online forms.

Participation in surveys is voluntary. On the basis of the survey results, we make anonymous evaluations that have no reference to the person surveyed. Nevertheless, Microsoft may collect and store metadata, such as your IP address, when you call up the web application.

The provision of personal data, such as e-mail address, is voluntary. The processing of this data is based on Art. 6 para. 1 lit. a DSGVO. We delete the data if it is no longer required and there are no legal obligations to the contrary.

We have concluded an order processing agreement with Microsoft for the use of Microsoft Forms, which obliges Microsoft to protect the data of our site visitors and not to pass it on to third parties. Processing regularly takes place within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. However, data transfers to the USA cannot be ruled out.

Further information regarding international data transfers can be found in Section 11 of this Privacy Policy.

Further information on Microsoft Forms can be found here: https://support.office.com/de-de/forms.
Further information on Microsoft’s data protection policy can be found at: https://privacy.microsoft.com/de-de/privacystatement.

6.12. In the context of your participation in our annual conference

The digital part of our annual PPM conference cplace Day/DIGI CON takes place on the event platform HyperCon. HyperCon, the service provider used and contractually bound by us, processes personal data on our behalf and within the scope of our instructions as a so-called order processor in accordance with GDPR, Art. 28. When you access this event website, we, respectively, the provider of hosting services contracted by us, will exclusively collect the personally identifiable data your browser transmits to our server. Specifically, these include:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of request (specific page)
• Access status/HTTP status code
• Volume of data transmitted
• Website initiating the request
• Browser
• Operating system and its user interface
• Browser software language and version
• Information about your device

We need these data for technical purposes to provide you with access to the event platform. The legal basis for the processing is Art. 6(1)(b) GDPR (performance of a contract) and, where applicable, Art. 6(1)(a) GDPR (consent).”. These data are stored for the duration of no more than 14 days for security reasons (e.g. to support investigations of misuse or fraudulent activities), and will be deleted thereafter. Data which must be stored as evidence beyond that period are exempt from erasure pending final resolution of the case in question. Hypercon’s privacy policy can be found at: https://www.iubenda.com/privacy-policy/36889631/legal?ifr=true&height=80….

6.12.1 Analytics through Google Analytics 4

Our event websites use Google Analytics 4. See point 5.3.

6.13. In the context of playing embedded videos via Youtube, and the use of Google Fonts

Google Fonts is a typeface visualization service provided by Google Ireland Limited that allows websites to incorporate content of this kind on their pages. In this context and to our knowledge, Google processes usage data and tracking data.

You can find more information on Google Fonts here: https://policies.google.com/privacy

For our websites, Google Fonts are hosted by ourselves, thus no personal data is transferred to Google.

However, if you want to play embedded videos on our websites, Google Fonts are used, which are provided by Google Ireland Ltd. Therefore, we ask you beforehand for your consent according to Art.6 para. 1 lit. a and Art. 49 para. 1 lit. a GDPR. When playing the videos, the following personal data will be processed from you:

• Tracker
• UUID

6.14. In the context of playing embedded videos via Vimeo

Some embedded videos on our websites are provided via Vimeo. Vimeo (Vimeo LLC, 555 West 18th Street New York, NY 10011 USA) is responsible under data protection law for the operation of the Vimeo platform. You can find Vimeo’s data protection notice at: https://vimeo.com/privacy

In this context, Vimeo processes the following personal data of you to our knowledge:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of request (specific page)
• Access status/HTTP status code
• Volume of data transmitted
• Website initiating the request
• Browser
• Operating system and its user interface
• Browser software language and version
• Information about interaction with the Vimeo plug-in
• Device identifier of your equipment if applicable
• Version of the Vimeo software used by us
• Information about playbacks of the video to date
• Information about the way the video has been playback (e.g. full screen)

Before playing a video, we ask for your consent according to Art.6 para. 1 lit. a and Art. 49 para. 1 lit. a GDPR.

Vimeo will inevitably receive the data specified above. Vimeo is a service rendered by a provider from USA. Furthermore, we cannot exclude that data may additionally be routed by Internet servers located outside the EU. In particular, this may be the case when you as a participant are located in a third country. This means that your personally identifiable data will likewise be processed in a third country.. Further information regarding international data transfers can be found in Section 11 of this Privacy Policy.

6.15. As part of the recruiting process

We process the following personal data from you for this purpose:

• Contact data (esp. name, address, date of birth, telephone number, e-mail).
• Application data (i.e. all data that you have submitted or provided to us as part of your application; e.g.: Details of professional qualifications and school education, details of further professional training, cover letters, certificates, references from employers, etc.

We process this data for the following purposes:

• Establishing employment contracts
• Building a talent pool to manage applicants for future positions

The legal basis for the processing is:

• Art. 6 para. 1 lit. b GDPR
• Art. 6 para. 1 lit. f GDPR
• Art. 6 para. 1 lit. a GDPR (especially for our Talent Pool)
• § 26 BDSG

Justification of legitimate interest:

collaboration Factory is in a constant state of development and growth. The acquisition of new partners, customers and thus projects enables us to further penetrate the market. Our project successes and the further distribution of our product are based, among other things, on the cooperation with competent and motivated employees.

In order to cope with current and future tasks, we need to further increase our staffing levels. Recruiting new employees is a decisive criterion in this regard.

Furthermore, collaboration Factory wants to position and present itself in the market as a valuable and long-term employer.

Applicants visit so-called applicant or recruiting fairs with the intention of applying for jobs offered by the companies represented. From this point of view, the personal data used in this context are made available for processing of their own will and impulse. The data to be processed is to be regarded as rather uncritical and is also shared by the applicants on social networks, among other things.

The overall consideration and weighing of the above-mentioned points leads to the assessment that the risk for our applicants is to be classified as very low to non-existent to suffer damage as data subjects according to Article 4 (12) of the GDPR (personal data breach).

Recipients of this data are:

• Internally: supervisors or internal departments responsible for hiring the person, managing directors or persons authorized to represent the company.
• Externally: Order processors for personnel data processing.
• Personio GmbH (Rundfunkplatz 4, 80335 Munich, Germany) has been commissioned as a processor. The service provider used by us and bound by contract processes personal data for us on behalf of and within the scope of our instructions as a so-called order processor pursuant to Art. 28 GDPR.

Deletion of data:

If no employment contract is concluded with the applicant, the application documents will be deleted no later than six months after notification of the rejection decision, provided that no other legitimate interests of the controller conflict with such deletion. Other legitimate interest in this sense is, for example, a duty to provide evidence in proceedings under the General Equal Treatment Act (AGG).

Data stored in the talent pool will be deleted after 5 years at the latest, unless consent is revoked by the applicant.

6.16. Whistleblower-Portal

The portal is used for the integration of contact forms and the forwarding of your reports to the responsible recipient, namely the external ombudsman/external compliance officer. The collaboration Factory does not have access to the data you provide. The collaboration Factory is solely responsible for providing the portal to meet legal requirements.

For this purpose, we process the following personal data, which may be voluntarily provided by you:

• Inventory data (names, addresses)
• Contact data (email, phone numbers, fax, messenger)
• Content data (text entries, photographs, videos)

We process this data for the following purposes:

• Implementation of legal requirements in accordance with the HinSchG (Whistleblower Protection Act)

The legal basis for processing is:

• Art. 6 para. 1 lit. c GDPR
• Art. 28 GDPR
• §§ 10; 12-14 HinSchG

Recipients of this data are:

• External ombudsman/external compliance officer
• Data processors

Data deletion: The data will be deleted two (2) years after the conclusion of the procedure (see §11(5) HinSchG).

6.17. Usage of Hubspot

Our websites use the service HubSpot (HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500). Hubspot is an integrated software solution that we use to cover various aspects of our online marketing. These include: Email marketing, social media publishing & reporting, reporting, campaign controlling, contact management (e.g. user segmentation & CRM), landing pages and contact forms.

Hubspot enables website visitors to take advantage of marketing offers, download marketing content, and get in touch with us. The contact information left by our visitors is stored on HubSpot servers and used by us solely for our marketing efforts. All information we collect is subject to our privacy policy.

As part of our marketing measures, the following data may be collected and processed via Hubspot:

• Geographical position
• Browser type
• Navigation information
• Referral URL
• Performance data
• Information about how often the application is used
• Mobile apps data
• HubSpot subscription service credentials
• Files that are displayed on site
• Domain names
• Pages viewed
• Aggregated usage
• Operating system version
• Internet service provider
• IP address
• Device identifier
• Duration of visit
• Where the application was downloaded from
• Operating system
• Events that occur within the application
• Access times
• Clickstream data
• Device model and version

In addition, we also use Hubspot to provide forms, e.g. our contact form. If you leave personal data (e.g. name, email address, etc.) in our forms, we use this data to process your inquiry or request. This data processing is necessary to enable us to communicate with you. The processing of your personal data is based on Art. 6 para. 1 lit. f or Art. 6 para. 1 lit. b GDPR. The personal data will be kept for as long as it is necessary to fulfill the purpose of processing. The data will be deleted as soon as they are no longer required to achieve the purpose.

Further information in this regard can be found in section 6.10 of this privacy policy.

In the context of the use of HubSpot’s services, the above-mentioned data may be transferred to the USA and stored there. Further information regarding international data transfers can be found in Section 11 of this Privacy Policy..

More information on HubSpot’s privacy policy.
More information from HubSpot regarding EU data protection regulations.
More information about the cookies used by HubSpot can be found here & here.

6.18. Usage of Training bookings and execution

We offer the opportunity to book training courses from the cplace Academy (e-learning, classroom training) on our websites.

The following categories of personal data are processed

• Master data (e.g. surname, first name, company affiliation)
• Contact data (e.g. e-mail address, billing address)
• User data (e.g. GitHub username, user name of the cplace training environments)
• Content data (in particular texts that you leave in the comment fields)
• Communication data (e.g. content in emails in the context of further, personal communication)
• Training status (e.g. status of participation, certificates of attendance)
• Online data (personal data that is transmitted when you visit our cplace training environments or websites, e.g. via your browser, see above)

We process this data for the following purposes:

• Providing an online system to carry out the booking process
• Establishment and conclusion of a contractual relationship for training services
• Preparation, implementation and follow-up activities of the booked training courses

The legal bases for the processing are:

• Art. 6 para. 1 lit. a GDPR
• Art. 6 para. 1 lit. b GDPR
• Art. 6 para. 1 lit. f GDPR

Justification of the legitimate interest:

Our legitimate interest lies in bringing our customers, partners, employees and interested parties closer to the use, possible applications and potentials associated with our product in a methodically and didactically prepared form and also to disseminate cplace knowledge in the community via this channel.

This directly serves the further penetration of our product into the market and thus represents a contribution to the business model of collaboration Factory AG.

The personal data to be processed is not considered critical. In particular, protective measures are also taken (e.g. double opt-in in the booking process), which make the misuse of personal data significantly more difficult. In this processing, no personal data of special categories pursuant to Art. 9 para. 1 GDPR are processed.

The risk for the person concerned of suffering damage in accordance with Art. 4 para. 12 GDPR (violation of the protection of personal data) is to be classified as very low. We therefore consider our legitimate interest to be legitimate and feasible in consideration of the aforementioned points.

The recipients of this data are

• Internal: Employees of collaboration Factory GmbH
• Externally: Processors

The processing of personal data is also carried out by our hosting service providers as our subcontractors.

Our websites and cplace installation are operated on servers of hosting service providers located in Germany, the EU or the EEA.

We currently work with the following hosting service provider:

For the hosting of cplace installations

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

Further information on data protection, security of processing and the status of the hosting service provider’s certifications can be found under the following links:

https://www.hetzner.com/de/legal/privacy-policy https://www.hetzner.com/de/unternehmen/zertifizierung https://www.hetzner.com/AV/TOM.pdf

For the operation of our websites:

Mittwald CM Service GmbH & Co. KG, Königsberger Str. 4 – 6, 32339 Espelkamp

The hosting service providers are contractually binded and function as Processors on our behalf in accordance with Art. 28 GDPR.

6.19. Provision of our Knowledge Base using GitBook

We use GitBook, a service provided by GitBook, Inc., 440 N Barranca Ave #1430, Covina, CA 91723, USA, to provide our knowledge base (kb.cplace.com). GitBook enables us to provide and manage documentation on our products and services for our users.

When you access our knowledge base, we or the service provider acting on our behalf only collect the personal data that your browser transmits to the server. In particular, the following personal data is processed:

• IP address

• Browser type and version

• Language preferences

• Referring website

• Date and time of the request

• Operating system

• Device information

GitBook uses cookies to ensure the functionality of the service.

The legal basis for this is Art. 6 (1) (b) GDPR and (f) GDPR.

We have entered into a data processing agreement with GitBook, which obliges GitBook to protect the data in our knowledge base and not to disclose it to third parties. GitBook stores and processes the data in the USA. Further information regarding international data transfers can be found in Section 11 of this Privacy Policy..

For more information about data protection at GitBook, please visit: https://policies.gitbook.com/privacy-and-security/statement