Privacy Policy

This privacy policy applies to geostars.com and the GeoStars app (app.geostars.com), a service of Suchhelden GmbH.

Privacy Policy

Last updated: 10.09.2025

Protecting your personal data matters a great deal to us. Below you will find information on which data we process on our website and in our company, for which purposes we do so, and which rights you have.

Your personal data is processed in accordance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Name and address of the controller

Suchhelden GmbH, Heinrichstraße 14c, 49080 Osnabrück, Germany
Represented by the management: André Hehemann, Dimitri Prugow, Oskar Majzner
Phone: +49541-507960-0, email: info@suchhelden.de

Contact details of the data protection officer

C&S Consulting
Data protection officer Matthias Wöstemeyer
Mittelheide 11
49124 Georgsmarienhütte, Germany
Website: https://datenschutz-gmh.de/
Email: datenschutz@suchhelden.de

Processing of personal data on our website

1. Provision of the website and creation of log files

Simply visiting our website and accessing the information it contains does not require you to provide any personal data.

During your visit to our website, we only collect and use data that your browser transmits to us automatically:

• date and time you accessed one of our web pages
• your browser type
• your browser settings
• your IP address
• the pages you visited
• host name of the accessing computer
• Referrer URL
• amount of data transferred in each case

We use this data to make your visit to our site technically possible. We also use it for statistical purposes and to improve the design and layout of our website. We store the IP address to ensure and maintain IT security (e.g. detecting and blocking so-called DOS attacks) and operability.

The legal basis for the temporary storage of the data is Art. 6(1)(f) GDPR.

2. Inquiries by email, phone, fax or contact form

If you contact us by email, phone, fax or contact form, we process the personal data you send us in order to handle your request. This includes in particular:

• your contact details (e.g. name, email address, phone number, website)
• content data of your inquiry (e.g. your request, documents you send)
• other information you provide

This data is received exclusively by the internal departments responsible and, where applicable, technical service providersthat act as part of data processing on our behalf (e.g. hosting or email providers).

Legal bases for the processing

• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), if your inquiry relates to an existing or planned contractual relationship.
• Legitimate interest (Art. 6(1)(f) GDPR) in handling general inquiries efficiently.
• Consent (Art. 6(1)(a) GDPR), where it has been obtained explicitly.

Retention period

We store your data only for as long as is necessary to process your request. After the communication has concluded, your data is deleted after 6 months, unless statutory retention obligations apply. Where statutory retention periods exist (e.g. for tax or commercial law reasons), deletion takes place only after they have expired.

3. Newsletter

You can sign up for our newsletter on our website to receive regular information about our services, offers and news.

Sign-up and double opt-in
We use the double opt-in procedure for sign-ups: after you sign up, you receive a confirmation email with an activation link. Your sign-up only takes effect once you confirm it.

Data categories
When you sign up, we process the data you enter in the form, in particular:

• your email address (required)
• optionally further details (e.g. name, company), if you enter them

Use of a delivery service provider
The newsletter is sent by Brevo (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany. We have concluded a data processing agreement with Brevo under Art. 28 GDPR.

Legal basis
The processing takes place solely on the basis of your consent (Art. 6(1)(a) GDPR).

Tracking in the newsletter
For statistical analysis, we may record whether an email was opened and which links were clicked. We use this information to improve our newsletter technically and to tailor it better to our subscribers' interests.

Withdrawal and unsubscribing
You can withdraw your consent to receiving the newsletter at any time with effect for the future, e.g. via the unsubscribe link at the end of every newsletter or by contacting us using the contact details above.

Retention period
We store your data for as long as your newsletter subscription is active. After you unsubscribe, your data is deleted from the newsletter distribution list. Further storage may take place where statutory retention obligations apply or where it is necessary to defend legal claims.

More information: https://www.brevo.com/de/legal/privacypolicy/

4. Recipients or categories of recipients of the data

Within our company, access to your data is granted only to those departments and employees that need it to handle your inquiry or to provide our services.

In addition, your data may be transferred to the following recipients or categories of recipients:

• Processors under Art. 28 GDPR: external service providers that process data on our behalf (e.g. hosting providers, email service providers, IT support).
• Other external recipients: third parties that decide independently about the data processing (e.g. banks for payment processing, tax advisors, lawyers).
• Authorities and public bodies, where we are legally obliged to disclose data.

5. Information on the rights of data subjects

As a data subject, you have the following rights under the GDPR:

• right of access to the data stored about you (Art. 15 GDPR)
• right to rectification of inaccurate or incomplete data (Art. 16 GDPR)
• right to erasure ("right to be forgotten") under the conditions of Art. 17 GDPR
• right to restriction of processing under Art. 18 GDPR
• right to data portability under Art. 20 GDPR
• right to object to the processing under Art. 21 GDPR
• right to withdraw consent you have given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, you can contact the controller named above at any time.

You also have the right to lodge a complaint with a supervisory authority. You can contact one in the member state of your residence, your place of work or the place of the alleged infringement.

If you have questions or concerns about data protection, we would appreciate it if you first contacted our data protection officer. In many cases, this is the quickest way to resolve an issue.

6. Planned data transfer to a third country

Processing of personal data in third countries (outside the European Union (EU) and the European Economic Area (EEA)) only takes place in line with the statutory data protection requirements. This applies in particular to cases in which we use third-party services or transfer data to recipients outside the EU/EEA.

Unless there is explicit consent or a legal obligation for the transfer exists (Art. 49 GDPR), we ensure that one of the following safeguards is met:

• Adequacy decision of the EU Commission (Art. 45 GDPR): the level of data protection in the third country has been officially recognized as adequate by the EU.
• EU Standard Contractual Clauses (Art. 46 GDPR): the recipient has committed contractually to complying with EU data protection standards.
• Further safeguards: these include binding corporate data protection rules (Binding Corporate Rules, BCR), certifications or comparable mechanisms under Art. 44–49 GDPR.

EU-US Data Privacy Framework (DPF)

Under the EU-US Data Privacy Framework (DPF), on July 10, 2023 the EU Commission recognized the level of data protection at certain companies in the USA as adequate.

You can find the list of certified companies and further information on the DPF on the website of the US Department of Commerce:
https://www.dataprivacyframework.gov/

In our privacy notices we state which service providers we use are certified under the DPF.

D. Cookies/plugins/tools

Our website uses cookies. Cookies are small text files that are stored on your device and contain certain information. They serve to make our website more user-friendly, more effective and more secure.

1. Technically necessary cookies
These cookies are required to operate our website and enable basic functions such as page navigation or access to protected areas. Without these cookies, our website cannot work properly.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing our website in a technically error-free and optimized way).

2. Optional cookies (e.g. statistics, marketing)
In addition, we may use cookies that are not strictly necessary but help us improve what we offer (e.g. for reach measurement or marketing purposes). These cookies are only set after you give your explicit consent.
Legal basis: Art. 6(1)(a) GDPR (consent).

3. Managing cookies
You can withdraw or adjust your consent at any time via our consent management tool. You can also set your browser to allow cookies only case by case, block them entirely, or delete them automatically when you close the browser.

1. Google Analytics

We use Google Analytics to measure and analyze the use of our online offering on the basis of a pseudonymous user identification number. This identification number contains no unique data such as names or email addresses. It serves to assign analytics information to a device in order to recognize which content users have viewed within one or several sessions, which search terms they used, whether they returned to that content or interacted with our online offering. The time of use and its duration are also stored, as are the sources referring users to our online offering and technical aspects of their devices and browsers. In doing so, pseudonymous user profiles are created with information from the use of different devices, and cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides coarse geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, IP address data is used solely for this derivation of geolocation data before being deleted immediately. It is not logged, not accessible and not used for any further purposes. When Google Analytics collects measurement data, all IP lookups are carried out on EU-based servers before the traffic is forwarded to Analytics servers for processing;

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;

Legal bases: consent (Art. 6(1) sentence 1(a) GDPR);

Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms);

Option to object (opt-out): opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertising: https://adssettings.google.com/authenticated.

More information: https://privacy.google.com/businesses/adsservices (types of processing and of the data processed).

2. YouTube

Our website includes at least one plugin or video player from YouTube, which belongs to Google Inc., based in San Bruno, California, USA. The controller within the EU is Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. As soon as you visit a page of our website that contains a YouTube plugin or video player, a connection to YouTube's servers is established (only if you have previously consented under Art. 6(1)(a) GDPR). The YouTube server is then informed which specific page of our website you visited. If you are also logged into your YouTube account, you allow YouTube to assign your browsing behavior directly to your personal profile. You can prevent this assignment by logging out of your account beforehand.

You can find further information on the collection and use of your data by YouTube in their privacy notices at www.google.de/intl/de/policies/privacy/.

Basis for third-country transfer: EU-US Data Privacy Framework (DPF)

3. Google Maps

We embed the Google Maps map service on our website to give you a convenient way to view locations and plan routes.

When you open pages with Google Maps embedded, personal data (e.g. your IP address, location data, device information) is transmitted to Google. This information may be transferred to Google servers in the USA and processed there.

Google Maps is only embedded after you give consent via our consent management tool. Without your consent, no connection to Google's servers is established and no data is transferred.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Legal basis: Consent (Art. 6(1)(a) GDPR)
Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms)
More information: Google's privacy policy: https://policies.google.com/privacy

4 Google Tag Manager

We use Google Tag Manager to manage and embed so-called website tags centrally via one interface. Tag Manager itself does not process any personal data of users. It only triggers other tags, which may in turn collect data. Google Tag Manager does not access that data.

We use Google Tag Manager to run our website efficiently and flexibly on a technical level and to control analytics and marketing services better.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in efficiently managing website tags
Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms)
More information: https://marketingplatform.google.com/about/tag-manager/, Google's privacy policy: https://policies.google.com/privacy

5 SalesViewer®

We use the SalesViewer® service to analyze visitor interactions on our website. For this purpose, JavaScript-based software sets a cookie that allows certain usage data to be collected and processed (e.g. IP address, interaction and movement data).

This data is processed exclusively in pseudonymized form and encrypted into an identification key (hash value). Personal identification of website visitors is therefore not possible. We use the resulting information solely for internal marketing and optimization purposes.

The processing only takes place after you give consent via our consent management tool. Without consent, SalesViewer® is not loaded.

Service provider: SalesViewer® GmbH, Huestraße 30, 44787 Bochum, Germany
Legal basis: Consent (Art. 6(1)(a) GDPR)
Further information & opt-out option: https://www.salesviewer.com/de/datenschutzerklaerung

6 Spotify

We embed audio content from the music streaming service Spotify on our website. The provider is Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden.

When you play embedded Spotify content, Spotify processes personal data (e.g. IP address, device information, usage and interaction data). Cookies may be stored on your device in the process. Spotify is only embedded after you give consent via our consent management tool. Without your consent, no data is transferred to Spotify.

Service provider: Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden
Legal basis: Consent (Art. 6(1)(a) GDPR)
Basis for third-country transfer: Depending on the processing, a transfer to third countries, in particular the USA, may take place. Spotify relies on the EU Commission's Standard Contractual Clauses for this.
More information: Spotify's privacy policy: https://www.spotify.com/de/legal/privacy-policy/

7 UserWay (accessibility widget)

We use the accessibility widget from UserWay Inc. to make our website more accessible. The widget lets users adjust font sizes, contrast and other display options, for example.
The settings you make are stored in your browser so that they are retained when you visit our website again. According to UserWay, no personal data of end users is processed. Only anonymous functional data (e.g. how often certain controls were used) may be collected to ensure the widget works properly.

Legal basis:
The processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in providing our website in an accessible and user-friendly way.

Recipients/third-country transfer:
The service provider is UserWay Inc., 100 SE 2nd St. Suite 2000, Miami, FL 33131, USA. As part of the technical provision, the data may also be processed on servers in the USA or in Israel. The EU Commission's Standard Contractual Clauses are used as a safeguard.

More information:
UserWay's privacy policy: https://userway.org/privacy

8 Google Ads conversion tracking

We use the Google Ads conversion tracking service to measure the success of the ads we run through Google. A cookie is set as soon as a user clicks on an ad we placed via Google Ads. If the user then visits certain pages of our website, we can see that the ad led to the desired user action (e.g. an inquiry, purchase or newsletter sign-up).

Conversion tracking gives us only statistical evaluations that help us measure the effectiveness of our ads and optimize our advertising. We receive no information that would allow users to be personally identified. Google itself, however, processes data (e.g. IP address, device information, interactions) in order to provide conversion tracking.

The processing only takes place after you give consent via our consent management tool.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Legal basis: Consent (Art. 6(1)(a) GDPR)
Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms)
Option to object (opt-out): You can disable personalized advertising in your Google settings: https://adssettings.google.com/. You can also prevent cookies from being stored by adjusting your browser settings accordingly.
More information: Google's privacy notices: https://policies.google.com/privacy, information on Google Ads: https://ads.google.com/intl/de/home/

9 Microsoft Clarity

We use Microsoft Clarity on our website, a service for analyzing usage behavior on websites. With Microsoft Clarity we analyze how visitors use our website in order to improve content, navigation, page design and usability. In particular, clicks, mouse movements, scrolling behavior, pages viewed and technical information about the device and browser used may be processed.
Microsoft Clarity uses cookies and similar technologies to recognize visits, merge sessions and produce usage analyses. Pseudonymous identifiers are processed in the process. Microsoft Clarity also uses IP-based geolocation to place users regionally.
The processing takes place solely on the basis of your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via our consent settings.

The recipient of the data collected via Microsoft Clarity is Microsoft. According to Microsoft, Clarity data is stored in the Microsoft Azure cloud. For customers in the EU, Microsoft names Microsoft Ireland Operations Limited as the contracting party and points to intra-group Standard Contractual Clauses for transfers to Microsoft Corporation in the USA.

The retention period differs by data category. Playback data is generally stored for 30 days. Click data, heatmap data and favorited or labeled sessions may be stored for up to 13 months.

You can find further information on Microsoft Clarity at learn.microsoft.com/de-de/clarity/faq, and further information on the processing of personal data by Microsoft at microsoft.com/de-de/privacy/privacystatement.

E. Social networks

We do not use any social media plugins or trackers on our website that transmit data to social networks automatically. However, we do provide links to our profiles on social networks. If you click one of these links, you are taken directly to the platform in question. The privacy terms of the respective provider then apply.

If you are a member of one of these networks and do not want your visit to our website assigned to your profile there, please log out of your social media account before clicking the link.

1. Facebook & Instagram
Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
Privacy policies:
• Facebook: www.facebook.com/about/privacy
• Instagram: https://instagram.com/about/legal/privacy/

2. Xing
Provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany
Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

3. LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Privacy policy: https://www.linkedin.com/legal/privacy-policy

4. YouTube
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://policies.google.com/privacy

F. Security measures

We use technical and organizational security measures to protect personal data, in particular against accidental or deliberate manipulation, loss, destruction or access by unauthorized persons. Our security measures are improved continuously in line with technological developments. Please note that when data is transmitted over the internet, third parties may still gain knowledge of that data or alter it, despite all security measures.

G. Contact

If you have questions or suggestions about this privacy policy, please contact us at the address given in our legal notice.

H. Updates to our privacy policy

Ongoing technical developments in IT and on the internet also require the existing privacy policy to be adapted. We therefore reserve the right to add to or change this privacy policy.