Datenschutz

We, SAIZ GmbH together with our subsidiaries (hereinafter collectively referred to as "the company," "SAIZ," "we," or "us"), take the protection of your personal data very seriously and would like to inform you here about data protection within our organization.

As part of our responsibilities under data protection law, we are subject to additional obligations following the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter "GDPR"), in order to ensure the protection of personal data of individuals affected by data processing activities. In this policy, we refer to you as the data subject also as “customer,” “user,” “you,” or “data subject.”

Where we determine, either alone or jointly with others, the purposes and means of data processing, we are particularly obliged to inform you in a transparent manner about the nature, scope, purpose, duration, and legal basis of the processing (see Articles 13 and 14 GDPR). With this privacy notice (hereinafter: “Privacy Policy”), we inform you about the manner in which your personal data is processed by us.

Our Privacy Policy is structured in a modular format. It consists of a general section applicable to all processing of personal data and processing scenarios that arise whenever a website is accessed (Section A: General Information), and a specific section, the contents of which relate only to the specific processing scenario mentioned in that section, including but not limited to the more detailed explanation regarding visits to our websites (Section B: Visiting Websites).

(1) Definitions

This Privacy Policy is based on the definitions set out in Article 4 of the GDPR:

‍“Personal data” (Art. 4 No. 1 GDPR) means any information relating to an identified or identifiable natural person (“data subject”). A person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data, or by means of information relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. Identifiability can also exist through the combination of such information with other supplementary knowledge. The form, manifestation, or medium of the information is irrelevant (e.g., photographs, video, or audio recordings may also contain personal data).
“Processing” (Art. 4 No. 2 GDPR) means any operation or set of operations which is performed on personal data, whether or not by automated means (i.e., using technology). This includes, in particular, the collection (i.e., acquisition), recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data, as well as any alteration of the purpose originally underlying the data processing.
“Controller” (Art. 4 No. 7 GDPR) means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Third party” (Art. 4 No. 10 GDPR) means any natural or legal person, public authority, agency, or other body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data; this includes other legal entities within the same corporate group.
“Processor” (Art. 4 No. 8 GDPR) means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller, particularly in accordance with the controller’s instructions (e.g., IT service providers). In the context of data protection law, a processor is not considered a third party.
“Consent” (Art. 4 No. 11 GDPR) of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
‍
‍

(2) Name and Address of the Controller

The entity responsible for the processing of your personal data within the meaning of Article 4 No. 7 GDPR is:

SAIZ GmbH
Pappelallee 78/79
10437 Berlin
Germany
Email: data.privacy@saiz.io

Further information about our company can be found in the legal notice on our website at https://www.saiz.io/impressum

‍

(3) Legal Bases for Data Processing

As a general principle under the law, any processing of personal data is prohibited unless it is permitted under one of the following legal grounds:

Art. 6 para. 1 sentence 1 lit. a GDPR ("Consent"): Where the data subject has given their consent, voluntarily, in an informed and unambiguous manner, by means of a declaration or other clear affirmative action, to the processing of their personal data for one or more specific purposes;
Art. 6 para. 1 sentence 1 lit. b GDPR: Where processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Art. 6 para. 1 sentence 1 lit. c GDPR: Where processing is necessary for compliance with a legal obligation to which the controller is subject (e.g., statutory retention obligations);
Art. 6 para. 1 sentence 1 lit. d GDPR: Where processing is necessary in order to protect the vital interests of the data subject or of another natural person;
Art. 6 para. 1 sentence 1 lit. e GDPR: Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
Art. 6 para. 1 sentence 1 lit. f GDPR ("Legitimate Interests"): Where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (particularly where the data subject is a minor).
‍

For each processing activity carried out by us, we will indicate below the specific legal basis applicable. Processing may be based on more than one legal ground.

‍

(4) Data Erasure and Storage Duration

For each data processing activity we perform, we will state how long the personal data is stored by us and when it is erased or blocked. Unless a specific storage period is stated below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies, unless statutory commercial or tax-related retention obligations require further storage.

Once statutory retention periods no longer apply, the data will be deleted unless you have expressly consented to further use.

However, storage may extend beyond the indicated time in the event of a (threatened) legal dispute with you or in the context of other legal proceedings, or if storage is required by statutory regulations to which we, as the controller, are subject (e.g., § 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO)). When the legally required retention period expires, the personal data will be blocked or deleted, unless further storage is necessary and legally permitted.

Your data is generally stored only on servers located within the EU, subject to any potential transfer as outlined in Sections A.(8) and A.(9).

‍

(5) Data Security

We implement appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or total loss, destruction, or unauthorized access by third parties (e.g., TLS encryption for our website), taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of risk to the rights and freedoms of data subjects in the event of a data breach. Our security measures are continuously improved in line with technological developments.

We are happy to provide more detailed information upon request. Please contact us using the details provided under Section A.(2).

‍

(6) Technical and Organizational Measures

We take technical and organizational measures to ensure that the security and protection requirements of the GDPR are met and that personal data is protected against loss, destruction, manipulation, or unauthorized access by third parties. These measures are regularly updated to reflect the current state of the art.

‍

(7) Cooperation with Processors

As is common in business operations, we engage external domestic and international service providers to conduct our business activities (e.g., in the areas of IT, logistics, telecommunications, sales, and marketing). These providers act solely on our instructions and have been contractually bound, in accordance with Article 28 GDPR, to comply with applicable data protection regulations.

If personal data is shared by us with our subsidiaries, or vice versa (e.g., for marketing purposes), this is done on the basis of existing data processing agreements.

‍

(8) Disclosure of Personal Data to Third Parties; Legal Basis

The following categories of recipients – generally acting asprocessors (see Section A.(7)) – may be granted access to your personal data:

Service providers for the operation of our website and the processing of data stored or transmitted by the systems (e.g., data center services, payment processing, IT security). The legal basis for such disclosure is Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR, unless they act as processors;
Government bodies/authorities, where required to fulfill a legal obligation. The legal basis for the disclosure is Art. 6 para. 1 sentence 1 lit. c GDPR;
Parties involved in the operation of our business (e.g., auditors, banks, insurers, legal advisors, regulatory authorities, parties involved in company acquisitions or joint ventures). The legal basis for the disclosure is Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR.
‍

We use the services of the following third-party providers:

521 PRODUCTS PTY LTD, 18 Tallow Place, Glenwood NSW 2768, Australia („Smartlead“).
Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA („Amazon“).
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg („Amazon EU“).
BacklinkManager Limited, Flat B 112 Blackheath Road, SE10 8DA, London, United Kingdom („ZenABM“)
DataDog Inc., 620 8^th Ave, 45^th Floor, New York, NY 10018, USA („DataDog“).
Finsweet Inc., 1001A E Harmony Rd. #15, Fort Collins, CO 80525, USA („Finsweet“).
Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA („Google US“).
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland („Google EU“; together with Google US „Google“).
Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian's STJ 3141, Malta („Hotjar“).
HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA („HubSpot“).
Instagram LLC., subsidiary of Facebook Inc., 181 South Park Street, San Fransisco, CA 94107, USA („Instagram“).
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland („LinkedIn“).
Meta Platforms Inc., 1601 S. California Ave, Palo Alto, California 94304, USA („Facebook US“)
Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland („Facebook EU“; together with Facebook US („Facebook “).
Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA („Microsoft US“).
Microsoft Ireland Operations Limited, OneMicrosoft Place South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland („Microsoft EU“; together with Microsoft US „Microsoft“).
Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA („Namecheap“).
Overloop SRL, rue des Pères Blancs 4, 1040 Brussels, Belgium („Overloop“).
Webflow, Inc., 398 11^th Street, 2^nd Floor, San Francisco, CA 94103, USA („Webflow“).
Zenleads, Inc. (Apollo.io), 440 N Barranca Ave #4750, Covina, CA 91723, USA („Apollo“).
‍

It is possible that the registered office of a third-party provider is located in a third country, i.e., a country where the GDPR does not have direct legal effect. In such cases, the transfer of data takes place only in accordance with the strict requirements outlined in Section A.(9).

Apart from that, we only share your personal data with third parties if you have given your explicit consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR and/or § 25 para. 2 no. 2 TDDDG.

‍

(9) Conditions for the Transfer of Personal Data to Third Countries

As part of our business relationships, your personal data may be disclosed or transferred to third-party companies, including those located outside the European Economic Area (EEA), i.e., in so-called third countries. Such processing takes place exclusively for the purpose of fulfilling contractual and business obligations and maintaining the business relationship with our customers or, in turn, with their end customers.

Any processing of personal data in a third country is only permitted if the specific requirements of Art. 44 et seq. GDPR are met. This specifically includes the conclusion of Standard Contractual Clauses ("EU SCCs") with the subcontractor. The contractor is required to use the "Processor to Processor" module and to carry out a Transfer Impact Assessment ("TIA").

Further details of any data transfer will be provided to you at the relevant sections of this privacy policy.

For the United States, a Data Privacy Framework (DPF) agreement has been concluded between the European Union and the USA to ensure compliance with European data protection standards when processing data in the USA. Under this framework, any company certified under the DPF commits to upholding these data protection standards. More information is available from the provider at the following link:
https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active

‍

(10) No Automated Decision-Making (including Profiling)

We do not intend to use any of the personal data collected from you for procedures involving automated decision-making, including profiling.

‍

(11) No Obligation to Provide Personal Data

Our customers do not make the conclusion of contracts conditional on the prior provision of personal data. As a visitor to our website or an end customer of our customer, you are generally not legally or contractually obliged to provide us with your personal data. However, certain services may be partially or fully unavailable if the necessary data is not provided. If such a case arises for any of the products or services we offer, you will be explicitly informed of this in advance.

‍

(12) Legal Obligation to Disclose Certain Data

We may, in individual cases, be subject to a legal or regulatory obligation to disclose lawfully processed personal data to third parties, especially public authorities (Art. 6 para. 1 sentence 1 lit. c GDPR).

‍

(13) Your Rights

You may assert your rights as a data subject with regard to the processing of your personal data at any time using the contact information provided in Section A.(2). You have the right to:

Access (Art. 15 GDPR): Obtain information about your data processed by us, including processing purposes, data categories, recipient categories, planned storage duration, the existence of rights to rectification, erasure, restriction of processing or objection, the origin of your data (if not collected by us), and the existence of automated decision-making (including profiling) and, where applicable, meaningful information about the logic involved;
Rectification (Art. 16 GDPR): Request the immediate correction of inaccurate data or completion of your personal data stored by us;
Erasure (Art. 17 GDPR): Request the deletion of your data unless the processing is required to exercise the right of freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise or defend legal claims;
Restriction of Processing (Art. 18 GDPR): Request the restriction of processing if the accuracy of the data is disputed by you or the processing is unlawful;
Data Portability (Art. 20 GDPR): Receive the personal data you provided in a structured, commonly used, and machine-readable format or to request transmission to another controller ("data portability");
Objection (Art. 21 GDPR): Object to the processing of your data, provided the processing is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR, especially if the processing is not required for the performance of a contract. If you object to processing not related to direct marketing, please provide reasons why we should no longer process your data as previously carried out. In the case of a justified objection, we will examine the situation and either cease or adjust data processing or demonstrate compelling legitimate grounds for continuing it;
Withdrawal of Consent (Art. 7 para. 3 GDPR): Revoke any previously given consent (even if granted before the GDPR came into effect on 25 May 2018) at any time. This means we may no longer continue data processing based on that consent going forward;
Lodge a Complaint (Art. 77 GDPR): File a complaint with a supervisory authority, in particular with the authority responsible for us:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219, 10969 Berlin
Phone: +49 30 13889-0
Fax: +49 30 2155050
Email: mailbox@datenschutz-berlin.de
Website: https://www.datenschutz-berlin.de

‍

(14) Changes to This Privacy Policy

In the course of ongoing legal developments in data protection law or due to technological or organizational changes, our privacy policy is regularly reviewed to determine the need for updates or additions. You will be informed of any changes, particularly on our German-language website at: https://www.saiz.io/de. This privacy policy is effective as of April 2025.

In addition to purely informational use of our website, we offer a subscription to our newsletter, which keeps you informed about new products, promotions, company updates, and content related to our mission, services, and products. If you wish to subscribe to the newsletter offered on the website, we require your email address and information that allows us to verify that you are the owner of the specified email address and that you agree to receive the newsletter. We use the double opt-in procedure. No further data is collected unless on a voluntary basis. This data is used solely for sending the newsletter and is only shared with the external service provider HubSpot involved in the newsletter delivery. Otherwise, the data will not be shared with third parties.

When you sign up for our newsletter, the following “newsletter data” is collected, stored, and processed by us:

Name
Address
Telephone number
Email address
Date and time of registration and confirmation
‍

Please note that we evaluate your user behavior when sending the newsletter. For this evaluation, the sent emails contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. To conduct these evaluations, we link the above data and the web beacons with your email address and an individual ID. Links contained in the newsletter also include this ID. The data is collected exclusively in pseudonymized form, meaning the IDs are not linked with your other personal data, and direct identification is excluded.

The processing of newsletter data is for the purpose of sending the newsletter. By registering for our newsletter, you consent to the processing of your personal data (legal basis: Art. 6 (1) lit. a GDPR and § 25 (2) No. 2 TDDDG). We use the double opt-in process for registration. This means that after registering, we will send you an email to the specified address asking you to confirm that you want to receive the newsletter. The purpose of this procedure is to verify your registration and to investigate possible misuse of your personal data.
‍
You can revoke your consent to receive the newsletter at any time. You can unsubscribe using the link provided in every newsletter email, by emailing data.privacy@saiz.io, or by sending a message to the contact details provided in the legal notice (imprint). The legality of the data processing already carried out remains unaffected by the revocation. The newsletter is created for us by the third-party provider HubSpot, which also has access to our account.

The dispatch of our newsletter is carried out using the technical service HubSpot, operated by HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA (“HubSpot”) (https://www.hubspot.com/), to whom we pass the data provided during the newsletter registration. HubSpot is a service that allows organization and analysis of newsletter dispatch. HubSpot offers statistical analysis of usage data, but this is generally done in an aggregated, not individual, form. The usage data generated by HubSpot is generally not individually evaluated. However, if you open a newsletter using the browser link provided in the email, the analytics tool Google Analytics is used on the displayed website. Only Google Analytics has access to the data generated. You can prevent tracking by Google Analytics by using specific browser plugins. You can find Google Analytics’ privacy policy at: https://policies.google.com/privacy

‍If you do not want your data analyzed by Google Analytics, you must unsubscribe from the newsletter. A link for this is included in every newsletter message. Alternatively, you can send us an email to express your decision to unsubscribe.

The purpose of using HubSpot is to manage email addresses, messages, and newsletter distribution in an organized and efficient way.

HubSpot stores and processes the following: first name, last name, email, country, usage data, company, trackers, and various other data types.

The place of processing is the United States.

The legal basis for using HubSpot is Art. 6 (1) lit. f GDPR (pursuit of a legitimate interest), which is our legitimate interest in using an effective, secure, and user-friendly newsletter system. HubSpot uses this information to send newsletters on our behalf. HubSpot does not use the data of our newsletter recipients to contact them independently or to share it with third parties.

Deletion: The data you provide for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and those of HubSpot after the cancellation. Data stored by us for other purposes (e.g. email addresses for the member area) remain unaffected.

For more details, see HubSpot’s privacy policy at:
https://legal.hubspot.com/privacy-policy

‍We have concluded a so-called Data Processing Agreement with HubSpot, in which we obligate HubSpot to protect our customers’ data and not to pass it on to third parties. This agreement can be viewed at the following link:
https://legal.hubspot.com/dpa

Privacy policy

Datenschutzerklärung

Reach out now and start your journey towards more informed, data-driven success.

Company

Our solutions

Social