Privacy policy

Stand: 07.10.2026 (as of 7 October 2026)

This privacy policy explains, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit our website dealpilot-sales.de, request a consultation or trial access, use the DealPilot software, or are contacted by us as part of our outbound sales service. If the German and English versions differ, the German version prevails.

1. Controller

DealPilot UG (haftungsbeschränkt)
Uhlenbruch 15b
33098 Paderborn
Germany

• Represented by: Ahmed Sürer
• Email: info@dealpilot-sales.de
• Phone: +49 160 97758241

For any data protection questions, contact us at info@dealpilot-sales.de.

2. Data protection officer

We have not appointed a data protection officer because we are currently not required to do so under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG).

3. Key points at a glance

• Our website uses no cookies, no tracking and no analytics tools.
• Fonts are served from our own server. We do not embed any Google services, including reCAPTCHA.
• Data from the contact form is stored in our own CRM system so that we can handle your request.
• The DealPilot app only uses strictly necessary cookies for login and workspace selection.
• Data that our customers store in DealPilot (e.g. their prospects and clients) is processed by us as a processor on the customer's instructions (Art. 28 GDPR). The customer, not us, is responsible for that data (see section 10).

4. Visiting the website and server log files

When you visit our website, our hosting provider automatically processes information sent by your browser:

• IP address
• date and time of access
• page or file requested, amount of data transferred, HTTP status code
• referrer URL (previously visited page), if transmitted
• browser type and version, operating system (user agent)

Purpose: delivering the website, operational stability and security (e.g. defending against attacks and abuse), error analysis.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free provision of our website.

Retention: Log data is deleted after [[LOG-SPEICHERDAUER]] unless it is needed longer to investigate a specific security incident.

Recipient: [[HOSTER]] as processor (see section 13).

5. Cookies and similar technologies

Website (dealpilot-sales.de): We do not set cookies and do not access information on your device that is not required for operation. A cookie banner is therefore not needed.

DealPilot app: Within the application (after login) we only use the following strictly necessary cookies:

These cookies are strictly necessary to provide the service you have explicitly requested. Under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), no consent is required. The subsequent processing is based on Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (login security).

6. Fonts

The fonts used on our website are stored locally on our server. No connection to third-party servers (e.g. Google Fonts) is made when you load a page.

7. Contact form: requesting a consultation

When you request a consultation via our form, we process:

• name, company, business email address, phone number
• your area of interest (e.g. software, outbound sales service), team size, your message
• the appointment slot you selected
• time of the request

Purpose: handling your request, scheduling the appointment, follow-up by our sales team and preparing a possible contract. Your details are stored as a prospect (lead) in our own DealPilot CRM. You receive a confirmation email.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps taken at your request). Where you make the request on behalf of a company and do not become a contracting party yourself, we rely on Art. 6(1)(f) GDPR; our legitimate interest is handling the company's request.

Mandatory fields: We need the fields marked as mandatory to handle your request. Without them we cannot accept it.

Retention: If no contract is concluded, we delete your data 12 months after our last contact. If a contract is concluded, the periods in section 15 apply.

Spam protection: The form contains a field that is invisible to humans (honeypot). If it is filled in, we discard the request as spam. No additional data is collected and no third-party services are used.

8. Trial access

DealPilot is currently in its beta phase. Companies can request free access via our website. We first process the same details as in Section 7 and store them as a prospect in our CRM. In addition:

• We review every request personally. There is no automatic activation.
• If we approve your request, we set up your own workspace with its own database, separate from other customers, and hand over your login details.
• Trial access is free and lasts until the date we tell you when activating it. We will let you know in good time before it ends.
• If trial access ends without a subscription, the workspace is locked and, 30 days later, deleted completely with all data stored in it.
• While you use it, we process usage data required for operation (login times, log entries on changes in the workspace).

Legal basis: Art. 6(1)(b) GDPR (reviewing your request, providing trial access and pre-contractual measures).

Your own data in trial access: If you import or enter personal data of third parties (e.g. contacts of your prospects), your company is the controller. We then process that data solely as a processor under our data processing agreement (DPA).

Retention: Rejected or completed access requests are deleted 90 days after the decision. Workspace: deleted 30 days after trial access ends unless a subscription is taken out. Your prospect record in our CRM: deleted 12 months after the last contact, unless a contract is concluded.

9. Contact by email or phone

If you contact us by email or phone, we process your details to handle your request on the basis of Art. 6(1)(b) GDPR (contract- or request-related matters) or Art. 6(1)(f) GDPR (other matters; our legitimate interest is responding to you). Business correspondence is retained in accordance with statutory periods (section 15).

10. Use of the DealPilot app by customers

10.1 Data for which we are the controller

To perform our contracts with customers, we process as controller:

• the customer's contract and billing data (company, address, VAT ID, contact person, plan, number of users, invoices, payment status)
• user accounts (name, email address, role, password stored only as a hash)
• technical usage and security data (login times, IP address at login, sessions, audit log entries)
• support requests

Legal basis: Art. 6(1)(b) GDPR (performance of contract), Art. 6(1)(c) GDPR (statutory retention obligations under the German Commercial Code (HGB) and Fiscal Code (AO)) and Art. 6(1)(f) GDPR (application security, traceability of changes, prevention of abuse).

We send customers and users service-related emails (e.g. login, password reset, invoices, notices about the contract and security). We do not send marketing newsletters without your separate consent.

10.2 Data that customers store in DealPilot

Our customers store data about their prospects, clients and employees in DealPilot, e.g. business contact details, call notes, appointments, offers, invoices, dunning notices and staff commissions. The respective customer is the controller of this data under the GDPR. We process it solely on the customer's behalf and instructions under a data processing agreement (Art. 28 GDPR).

If your data is stored in DealPilot by one of our customers and you wish to exercise your rights, please contact that company. If your request reaches us, we will forward it to the customer.

10.3 Customer portal

Clients of our outbound sales service receive access to a customer portal. Section 10.1 applies accordingly to portal accounts.

11. Outbound sales service: information for contacted persons

On behalf of our clients, we call businesses to present their products or services and arrange appointments. If we have contacted you in this context, the following applies:

• Controller: [[ROLLE-VERTRIEBSDIENSTLEISTUNG: either "our respective client is the controller; we act as processor" OR "we are the controller" OR "joint controllership under Art. 26 GDPR" – decide before publication]]. We will tell you the client's name during the call and on request.
• Categories of data: name, position, company, business phone number and email address, call notes, call outcome, appointments arranged.
• Source of data: [[DATENQUELLEN: e.g. lists provided by the client, publicly available business directories, company websites]].
• Purpose and legal basis: business contact and appointment setting, Art. 6(1)(f) GDPR. The legitimate interest is direct marketing to businesses (Recital 47 GDPR). Promotional calls to businesses are only made where at least presumed consent within the meaning of Section 7(2) No. 1 of the German Act against Unfair Competition (UWG) can be assumed.
• Retention: [[SPEICHERDAUER-VERTRIEBSDIENSTLEISTUNG: e.g. campaign duration plus 6 months; do-not-call flags after objection as long as necessary]].
• Objection: You may object to the use of your data for marketing purposes at any time (section 18). We record your objection and will not call you again.

12. Payment processing with Stripe

We use the payment service Stripe to bill subscriptions. Our contracting party is Stripe Payments Europe, Limited, [[STRIPE-ANSCHRIFT: copy current address from the Stripe agreement]], Dublin, Ireland. When you take out a subscription, your payment data (e.g. account holder name, IBAN for SEPA direct debit or card details), billing data, email address and amount are transmitted directly to Stripe. We do not store card details or full bank details ourselves.

Stripe processes data partly as our processor and partly as an independent controller, in particular for fraud prevention and to comply with its own legal obligations (e.g. anti-money laundering). Stripe's privacy policy applies to that processing: https://stripe.com/privacy

Enterprise customers may also pay by invoice; in that case we process the payment data ourselves.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (legal obligations).

Third country: Stripe may transfer data to Stripe, Inc. in the USA (see section 14).

13. Recipients and processors

We only share your data where necessary for the purposes described. Recipients are:

We have concluded agreements under Art. 28 GDPR with our processors. We only disclose data to authorities where we are legally obliged to do so.

14. Transfers to third countries

We host our website and app in the EU. Data is only transferred outside the European Economic Area in the following cases:

• Stripe: Stripe may transfer data to Stripe, Inc. in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR); Stripe additionally uses the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• [[DRITTLAND-HOSTER: only fill in if the hosting provider is a US company (e.g. Vercel Inc.) – then state DPF and/or SCCs as the basis. Delete this item for a purely European provider (e.g. Hetzner).]]

15. Retention overview

We delete personal data as soon as the purpose no longer applies and no statutory retention obligation prevents deletion.

Statutory periods start at the end of the calendar year in which the document was created. During the retention period we restrict processing (Art. 6(1)(c) GDPR).

16. No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

17. Your rights

Under the GDPR you have the following rights:

• access to your data stored by us (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR, see section 18)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

A message to info@dealpilot-sales.de is sufficient to exercise these rights.

18. Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing, you may object at any time without giving reasons. We will then no longer process your data for this purpose.

No particular form is required, e.g. an email to info@dealpilot-sales.de or a statement during a call.

19. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is:

[[ZUSTAENDIGE-AUFSICHTSBEHOERDE]] [[ANSCHRIFT-AUFSICHTSBEHOERDE]]

20. Data security

All data is transmitted encrypted (TLS/HTTPS). Passwords are only stored as hashes. Each customer's data is kept in a separate database. Further technical and organisational measures are described in Annex 1 of our data processing agreement.

21. Information for users outside the EU

21.1 United Kingdom (UK GDPR)

For individuals in the United Kingdom, the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) apply. The purposes and legal bases in this policy apply accordingly, and your rights correspond to those in sections 17 and 18. You can complain to the Information Commissioner's Office (ICO, ico.org.uk). The UK recognises the European Economic Area as adequate; transfers to Stripe in the USA rely on the UK Extension to the Data Privacy Framework or the UK Addendum to the Standard Contractual Clauses. UK representative under Art. 27 UK GDPR: [[UK-VERTRETER or "not appointed" – see legal review]].

21.2 Switzerland (FADP)

For individuals in Switzerland, the Swiss Federal Act on Data Protection (FADP/DSG) in the version in force since 1 September 2023 applies in addition. You have in particular the rights of access, rectification, erasure and data portability. You can complain to the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). Germany and the EU are listed as providing adequate protection in Annex 1 of the Swiss Data Protection Ordinance (DPO); transfers to Stripe in the USA rely on the Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses. Swiss representative under Art. 14 FADP: [[CH-VERTRETER or "not appointed" – see legal review]].

21.3 USA / California (CCPA/CPRA)

Our services are aimed at businesses. To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to us:

• We collect the categories described in this policy: identifiers (name, email, phone, IP address), professional information (company, position), commercial information (plan, invoices) and internet activity data (server log files). Purposes and retention are described in sections 4 to 15.
• We do not sell personal information and do not share it for cross-context behavioral advertising ("sale" or "sharing" as defined in the CCPA). This also applies to the preceding 12 months.
• We do not use sensitive personal information to infer characteristics about you.
• You have the right to know, delete and correct, and the right not to be discriminated against for exercising your rights. Send requests to info@dealpilot-sales.de. We will verify your identity before responding. You may use an authorized agent.

22. Changes to this privacy policy

We update this policy when our processing or the legal situation changes. The version published on this page applies.