Under Articles 13 and 14 GDPR
This is a convenience translation for information purposes. Only the German version is legally binding.
This site sets no cookies, loads nothing from third party servers and measures no visitor behaviour. The further sections concern the businesses we contact, the companies and people in our signal lists, and our customers.
No data protection officer has been appointed, as the requirements of Art. 37 GDPR are not met. Questions on data protection are answered by the controller directly at the address above.
Every request is logged by the web server. The following are recorded:
Without this information, operations can neither be maintained nor defended against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure and uninterrupted operation. The logs are deleted automatically after 14 days and are not combined with other data.
This site sets no cookies. This is a technical fact: the public pages run outside the session management of the application, so that no session identifier can arise at all.
An exception applies to the customer portal at
/portal. Logging in there requires a session, and a
session requires a cookie. What is set there and why is described in section 6.
A single further exception concerns the notice at the bottom of the
page. When you close it, an entry with the content gelesen
is stored in your browser's session storage so that it
does not reappear on every page. This entry never leaves your browser,
is not transmitted to any server and is deleted as soon as you close
the tab. It serves solely the function you triggered yourself and is
therefore exempt from consent under § 165 (3) of the Austrian
Telecommunications Act 2021.
No fonts, scripts, maps, videos or images are loaded from third party servers. Any such request would transmit the visitor's network address to the third party provider without the visitor having been able to consent. For the same reason, there is no analytics tool, no tracking pixel and no social network integration here.
The site is delivered via the network of Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. Cloudflare receives the request, filters out attacks and forwards it to our server. In doing so, Cloudflare processes the network address and the technical characteristics of the request. The basis is a data processing agreement under Art. 28 GDPR. Insofar as data is transferred to the United States, the transfer is based on the standard contractual clauses of the European Commission and on the adequacy decision of the European Commission for the United States.
If you write to us or call us, we process your details to handle the enquiry. The legal basis is Art. 6 (1) (b) GDPR insofar as the initiation of a contract is concerned, otherwise Art. 6 (1) (f) GDPR. We delete the message once it has been dealt with and no retention obligation stands in the way.
This section concerns businesses that we write to or call. It fulfils the information obligation under Art. 14 GDPR, which applies precisely where the data was not collected from the person concerned.
All sources mentioned are publicly accessible. We do not buy address databases and do not evaluate private profiles.
Art. 6 (1) (f) GDPR, legitimate interest in business contact with businesses and their representatives.
The legitimate interest is the initiation of a business relationship between businesses. Only business data of representatives in their professional role is processed; data from the private sphere is excluded.
For the approach itself, we use service providers as processors under Art. 28 GDPR, in particular for sending and delivering messages and for operating the servers. In addition, we use the information on companies and their management for our signal lists; what applies there is set out in section 4.
This section fulfils the information obligation under Art. 14 GDPR towards the people registered in the management or representation of German companies whose details may appear in our signal lists.
The details come from publicly accessible official publications and from the websites of the companies themselves. We do not pass on the full date of birth; where age is relevant to a theme, we supply the year of birth only. We derive no characteristics under Art. 9 GDPR from names, in particular neither origin nor faith.
We assign the companies to industries, identify business occasions such as an approaching succession, opened proceedings or an incorporation, and compile lists from them for businesses that offer advisory, financing, insurance or other services to businesses. The legal basis is Art. 6 (1) (f) GDPR. The legitimate interest lies in the initiation of business relationships between businesses. The details of the people are processed in their professional role; details from the private sphere are not used.
Recipients are the businesses that order a signal list from us. They use the details for their own business activity, are controllers in their own right and are contractually bound to comply with data protection and competition law. For the operation of the servers we use processors under Art. 28 GDPR.
We retain the details for as long as the company exists and the person holds their role. If a detail ceases to apply, we mark it as no longer current and no longer supply it.
You may object to the use of your details at any time, informally and without giving reasons. A message to info@hdhgroup.de is sufficient. We will then permanently remove you from every future list and inform the recipients who have already received your details. The same applies to companies.
This section concerns businesses that order a list from us.
We process the company name and address, name and function of the contact person, email address and telephone number, the tax number together with the tax office where provided, and the package chosen. The purpose is the performance of the contract; the legal basis is Art. 6 (1) (b) GDPR.
In addition, we store the shortened network address range of the order, without its last segment. It serves solely to prevent automated orders. The legal basis is Art. 6 (1) (f) GDPR.
The invoice is created as a PDF and archived by us. Under § 132 of the Austrian Federal Fiscal Code (BAO), records must be retained and kept legible for seven years. We therefore delete invoice data only after this period has expired, even if you request the deletion of your account in the meantime. The legal basis in this respect is Art. 6 (1) (c) GDPR.
Payment is made by bank transfer to our account. In the process, we receive from your bank the details that a transfer contains. We send you the list after receipt of payment to the email address provided. The legal basis is Art. 6 (1) (b) GDPR.
Orders placed before 23 October 2026 could be paid via a payment service. For these payments, the following applies:
We process payment via Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. The amount, the currency, the order number, a short description of the service, the company name, your email address and the language of the interface are transmitted to Mollie.
We never see your means of payment. You enter card number, IBAN or your bank login details directly with Mollie. Only the information as to whether payment was made comes back to us. Mollie is independently responsible for payment processing and is supervised by the Dutch central bank. The legal basis for the transmission is Art. 6 (1) (b) GDPR.
Customers who ordered a buyer list before 23 October 2026 work with it in a personal portal. The following applies:
For your access, we store email address, name, company, the chosen language and the password. The password exists only as a cryptographic hash and cannot be read even by us.
When you log in, the portal sets a session cookie. It contains a random identifier without personal reference, is not used for audience measurement and expires at the latest two hours after the last action, and immediately upon logging out. The cookie is strictly necessary for the service you have requested and is therefore exempt from consent under § 165 (3) of the Austrian Telecommunications Act 2021. For this reason, there is no consent banner in the portal either.
What you work on in the portal belongs to you: notes, processing status, follow ups and the watch list are assigned to your access alone. We neither evaluate them nor pass them on. An exception are explicit feedback messages on individual entries: if you report that a business does not fit, we read this and use it to improve the assignment. The legal basis is Art. 6 (1) (b) GDPR, for the evaluation of feedback Art. 6 (1) (f) GDPR.
We record the time of the last login and failed login attempts in order to detect and slow down unauthorised access. The legal basis is Art. 6 (1) (f) GDPR.
For each buyer, the portal offers buttons that open a search on Google, LinkedIn, XING, North Data, YouTube or Google Maps. Nothing is embedded and nothing is preloaded. As long as you do not click, none of these providers learns anything about you. Only with the click do you leave our site; from then on the terms of the respective provider apply, and your network address and the search term are transmitted there. The decision rests with you at every single click.
The buttons for email and telephone open only your own application. No message is sent from the portal.
Your access and your list remain available for as long as you wish to use them; access is unlimited in time. On request, we delete the account together with the notes. The invoice data with its seven year retention period remains unaffected.
Under the GDPR, you have the right to
The objection under Art. 21 GDPR is the most important here: an informal objection is sufficient, it requires no reasons, and we then permanently cease any approach and remove you from every future list. A message to info@hdhgroup.de is enough. Every message from us also contains a one click unsubscribe option.
You may lodge a complaint with a data protection supervisory authority. The authority competent for us is:
You may also contact the supervisory authority of your habitual residence or place of work.
As of: November 2026