The protection of your data is a top priority for our team at Foundamental. We therefore exclusively process your personal data in compliance with the terms of this Privacy Policy as well as the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We may offer links to third-party services on our website. However, we are not responsible for the processing of your data by these services.

1. Name and contact details of Controller and Company Data Protection Officer

This Privacy Policy pertains to data processing by all our office locations.

Controller:
Foundamental GmbH
Represented by Patric Hellermann
Budapester Str. 5
10787 Berlin
Germany

Phone: +4915221482769
Mail: info@foundamental.com

The data protection officer can be reached at:
Foundamental GmbH
Data Protection Officer
Budapester Str. 5
10787 Berlin
Germany

Mail: dataprotection@foundamental.com

2. Collection, storage and deletion of personal data as well as type and purpose and data use

If you would like to get in touch with us, you can use the contact form on our website. Depending on your request, we collect the following information:

  • Your name;

  • E-mail address;

  • Job title;

  • The company you act for;

  • Your message;

The processing of personal data is based on our legitimate interest in the response of your request pursuant to Art. 6 (1), sentence 1, lit. f, GDPR.Moreover, if you would like to send us a request for funding, we need the following data:

  • Your name;

  • E-mail address;

  • Name of your company;

  • Description of your company;

  • Website of your company;

  • Stage of your company;

  • The amount of money you are raising (in US Dollar);

  • Location of your company;

  • Your message;

  • Your pitch deck;

The above-mentioned data is collected in order to:

  • identify you, possibly as a contact person acting on behalf of a company;

  • if you ask for financing in order to be able to carry out due diligence;

  • correspond with you;

  • process any applicable liability claims and assert any claims against you.

If you would like to send us a request for funding, your data is processed in response to your request and processing is required pursuant to Art. 6 (1), sentence 1, lit. b, GDPR for the above-listed purposes to ensure adequate service and for the mutual fulfillment of obligations arising from a possible contract. If you do not provide these data, we cannot decide about your request.

We will also process your data if and to the extent necessary to comply with our legal obligations, such as duties arising from legislation on tracing profits from serious criminal offenses (German Anti-Money Laundering Act). The legal basis for this processing of personal data is Art. 6 (1), sentence 1, lit. c, GDPR.

If, in the course of a contractual relationship, it should become necessary to defend ourselves against liability claims, or if we need to follow up with one of our clients with regard to any outstanding invoices, the associated necessary processing of personal data is based on our legitimate interest in the adequate defense of our legal position pursuant to Art. 6 (1), sentence 1, lit. f, GDPR.

The personal data we collect in the context of contractual relationships will be stored for as long as we need it for the purposes for which it was collected and will then be deleted, unless we are obligated to comply with longer storage requirements due to retention and documentation duties based on tax and trade law (from the German Commercial Code (HGB), German Value Added Tax Code (UStG) or German Revenue Code (AO)) pursuant to Art. 6 (1), sentence 1, lit. c, GDPR, if further processing is required due to ongoing legal disputes, or if you have consented to further storage pursuant to Art. 6 (1), sentence 1, lit. a, GDPR.

If we process your data based on your consent, we will inform you in advance of the scope of this consent. You can revoke such consent at any time with future effect, whereby the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

3.     Data processing via logfiles

When you access our website, the browser deployed on your terminal device will automatically send information to our website server. This information is temporarily saved in a so-called log file. In this process, the following information will be collected without any action on your part and stored until its automated deletion

  • IP address of the computer sending the request,

  • Date and time of website access,

  • Name and URL of the retrieved file,

  • Website from which our site was accessed (referral URL),

  • Browser used and, if applicable, your computer’s operating system as well as the name of your access provider.

The above-listed data will be processed by us for the following purposes:

  • Ensuring a smooth connection setup to the website,

  • Ensuring easy use of our website,

  • Evaluation of system security and stability,

  • Clarification of any improper page access (DoS/DDoS attacks, etc.), as well as

  • Further administrative purposes.

The legal basis for the processing of personal data is Art. 6 (1), sentence 1, lit. f, GDPR. Our legitimate interest is derived from the above-listed purposes for data collection. We generally do not use collected data for the purpose of drawing conclusions about your person. However, we reserve the right to do so if required to investigate improper page access.

4. Data processing with HubSpot

For the purpose of offering downloads and of customer relationship management, we use the service of HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA (“HubSpot”). HubSpot has adopted the EU-US Privacy Shield, and, thereby, ensures that the level of data protection is adequate even when data is processed in the United States.

On the basis of your consent (Art. 6 para. 1 sentence 1 lit. a GDPR), which you can voluntarily give us by clicking on the corresponding button in the "cookie banner" when you call up the website, HubSpot creates pseudonymized user profiles for us. To do so, HubSpot uses so called web beacons and cookies. Cookies are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit this website. The cookie is used to store information that is related to the specific device you are using. However, this does not mean that we will immediately become aware of your identity. Web beacons are small pixels or gifs integrated in the webpage code or an email and allow checking that a user has accessed some content or opened an email. For the withdrawal of your consent, please see sec. 7 of this Privacy Policy.

These technologies allow HubSpot to process the following data of website visitors or users of downloads or email recipients:

  • Contact information (if provided by user)

  • Navigational data (including website usage information such as IP address, referrer URL, date and time of website accesses and number of sessions)

  • Email data

  • System usage data

  • Application integration data

  • Other electronic data

These data are transferred to a HubSpot servers which can be located outside the EU/EEA and stored there. For data transfer to third countries please see sec. 8 of our Privacy Policy. We use them to evaluate the use of our website, to compile reports on website activity, to personalize our marketing activities, for market research purposes, to tailor these internet pages to meet our visitors’ requirements and for personalized user experiences. The data may also be transferred to third parties if this is required by law or if third parties act as sub-processors of HubSpot.

5. Data processing with Lever

For job applicants we offer a contact form using the service of Lever, Inc., 155 5th St. Floor 6, San Francisco, CA 94103, USA (“Lever”). You can fill in the contact form on our website and additionally add a link to your LinkedIn profile. Lever has adopted the EU-US Privacy Shield, and, thereby, ensures that the level of data protection is adequate even when data is processed in the United States.

If you apply with your LinkedIn profile, we process the data you provide there in order to evaluate your application. If you choose to use the entry form, you must provide us with the following data:

  • Resume/CV, may include: name, geographic location, age, contact details, profession, gender, employment history, employment references, salary and other preferences and other personal details that you provide is with;

  • Full name

  • Email

  • Your motivation to apply for the job

Please note that your LinkedIn profile or your resume/CV can include special categories of personal data including information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs.

On voluntary basis you can add:

  • phone number,

  • current workplace (company),

  • additional information

  • web profiles like:  LinkedIn, Twitter, GitHub, Portfolio, other.

Insofar you provide us with personal data to apply for a job offer we process your personal data on the legal basis of sec. 26 German Data Protection Act (Bundesdatenschutzgesetz – BDSG). According to this provision processing of your data is allowed in the context of a decision about your employment.

If we need your data after completing the application process, we may continue to process your data if it is necessary for the enforcement of our rights. The legal basis may be for example Art. 6 (1) sentence 1, lit. f GDPR if we have a legitimate interest to enforce or defend against claims.

In case of refusal we delete your data after 6 months unless you have agreed on a storage and processing of your data for future job opportunities for up to 1 year by putting a check mark in the respective box at the end of your application.

The legal basis for the use of the service of Lever is Art. 6 (1), sentence 1, lit. f, GDPR. Our legitimate interest is to offer our job applicants a better experience of job application.

On the basis of your consent (Art. 6 (1), sentence 1, lit. a GDPR), which you can voluntarily give us by clicking on the corresponding button in the "cookie banner" when you call up the website, Lever creates pseudonymized user profiles for us. To do so, Lever uses so called cookies. Cookies are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit this website. The cookie is used to store information that is related to the specific device you are using. However, this does not mean that we will immediately become aware of your identity.

These technologies allow Lever to process the following data of our website users:

  • device’s Internet Protocol (“IP”) address. Lever may use your IP address to identify the general geographic area from which you are accessing the website.

  • browser type,

  • the web page visited before you came to our website,

  • information you search for on our website,

  • locale preferences,

  • identification numbers associated with your devices,

  • your mobile carrier,

  • date and time stamps associated with transactions,

  • system configuration information,

  • metadata concerning your Files,

  • and other interactions with the Service.  

These data are transferred to Lever servers which can be located outside the EU/EEA and stored there. For data transfer to third countries please see sec. 9 of our Privacy Policy. We use the tracking technologies to offer our job applicants a better experience of job application and to evaluate our job ads. For the withdrawal of your consent, please see sec. 7 of this Privacy Policy.

6. Google Analytics

For the purpose of designing and continuously optimizing our websites according to our visitors’ needs, we use Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on the basis of your consent (Art. 6 (1), sentence 1, lit. a GDPR), which you can voluntarily give us by clicking on the corresponding button in the "cookie banner" when you call up the website. Data will also regularly be transmitted to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as part of the processing described below. Google Ireland Limited and Google LLC are hereinafter jointly referred to as "Google". Google has adopted the EU-US Privacy Shield, and, thereby, ensures that the level of data protection is adequate even when data is processed in the United States. For the withdrawal of your consent, please see sec. 7 of this Privacy Policy.

Google Analytics creates pseudonymized user profiles for us. To do so, Google uses cookies. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit this website. The cookie is used to store information that is related to the specific device you are using. However, this does not mean that we will immediately become aware of your identity.

The Google Analytics cookies collect information about your use of this website, such as 

  • Browser type/version,

  • operating system,

  • Referrer URL (the previously visited page),

  • Host name of the accessing computer (IP address),

  • Time of the server request.

These data are transferred to a Google server in the USA and stored there. Google will use them to evaluate the use of our website, to compile reports on website activity and to provide other services relating to website activity and internet usage to be used by us for market research purposes and to tailor these internet pages to meet our visitors’ requirements. The data may also be transferred to third parties if this is required by law or if third parties act as sub-processors of Google. Under no circumstances will your IP address be merged with other Google data.

Moreover, we use Google Tag Manager, a Google solution that allows us to manage website tags through a single interface. Tags are small pieces of code on our site that are used, among other things, to measure traffic and visitor behavior, measure the impact of online advertising and social channels, use remarketing and targeting, and test and optimize our website. The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not collect personally identifiable information. The tool triggers other tags that may themselves collect data. Google Tag Manager does not access this data. If deactivation has been made at the domain or cookie level, it will persist for all tracking tags implemented with Google Tag Manager. For more information please visit Google’s website https://www.google.com/tagmanager/use-policy.html

We also use the Google Firebase service to analyze and categorize user groups and to send push messages.

If you disable tracking by Google Analytics (see also sec. 7 of this Privacy Policy), you will not be tracked by the Google Tag Manager nor by Firebase.

Further information on data protection in connection with Google Analytics can be found in the Google Analytics help section https://support.google.com/analytics/answer/6004245?hl=en.

7. Withdraw your consent to tracking technologies

You can withdraw your consent you gave to us by choosing one of the options mentioned below:

Your current state: Allow all cookies (Necessary, Preferences, Statistics). 
Change your consent  |  Withdraw your consent

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

8. Google Maps

On our websites, we also make use of Google Maps, another service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data will also regularly be transmitted to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as part of the processing described below. Google Ireland Limited and Google LLC are hereinafter jointly referred to as "Google". Google has adopted the EU-US Privacy Shield, and, thereby, ensures that the level of data protection is adequate even when data is processed in the United States.

Google Maps offers an interactive map which enables website visitors to conveniently display our company’s offices and have planned a route to either of these locations. By incorporating this service, data of our website visitors may be transmitted to Google. This processing takes place on the legal basis of Art. 6 (1), sentence 1, lit. f GDPR because of our legitimate interest to make our websites more attractive to our website visitors. With Google Maps we can offer an interactive map which allows to our website visitors to display our locations and to get driving directions.

Google will receive the information that you have visited the respective subpage of our website. In addition, Google will receive and store on its own servers further information concerning your visit to our website (including your IP address). Please note that such transmissions and storage of data would happen regardless of whether you are logged in to a Google account or not. However, if you are logged in to your Google account, Google can connect the information it received from your visit to our website with your user account.

Further information on the purposes and the scope of the collection and processing of personal data by Google can be found in Google’s privacy information, likewise further information on your rights in this regard and the setting options you have to safeguard your privacy: https://policies.google.com/privacy?hl=en&gl=en

9. Data disclosure to third parties; Data transfer third countries

Your personal data will not be disclosed to third parties except for the purposes listed below.

Your personal data will be disclosed to the service providers mentioned in section 4 to 6 and 7 of this Privacy Policy. In addition, we may disclose your personal data to our affiliate companies if we have a legitimate interest for. Moreover, we maintain contracts with IT service providers as well as infrastructure and platform service providers and marketing and market research service providers which process your data on our behalf. The legal basis for this data processing is Art. 6 (1), sentence 1, lit. b, GDPR. Our legitimate interest is to guarantee reliable and safe data processing for the performance of our activities and the management of our company with the support of professional service providers as well as optimization of our business and marketing activities.

We have concluded adequate data processing agreements with all parties mentioned above and we ensure that the necessary guarantees are respected in order to ensure an adequate level of data protection where services providers or servers of services providers are located outside the EU/the EEA.

10.  Rights of data subjects

You have the following rights:

  • To obtain information from us about the personal data we process according to Art. 15 GDPR. In particular, you may request information about the purposes of the processing, the categories of personal data, the categories of recipients to whom your personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, the existence of the right to request rectification, erasure, restriction of processing or to object, the right to lodge a complaint, the source of your data if they were not collected by us, as well as the existence of automated decision-making, including profiling, as well as meaningful information about the associated details;

  • To request without delay the rectification of incorrect or incomplete personal data stored by us according to Art. 16 GDPR;

  • To request, according to Art. 17 GDPR, the erasure of personal data stored with us, unless the processing is necessary for exercising the right of freedom of expression and information, full compliance with legal obligations, for reasons of public interest, or for the establishment, exercise or defense of legal claims;

  • To request restriction of processing your personal data according to Art. 18 GDPR, if you contest the accuracy of the data, if the processing is unlawful but you oppose the erasure of the data, and if we no longer need the personal data but you require them for the establishment, exercise or defense of legal claims, or if you exercised your right to object to processing according to Art. 21 GDPR;

  • To request your personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to demand the transmission to another controller according to Art. 20 GDPR; and

  • To lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. You can generally contact the supervisory authority at your usual place of residence or workplace or at our seat for this purpose.

11. Right to object

To the extent your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1), sentence 1, lit. f, GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21, GDPR on grounds relating to your particular situation. To exercise this right to object, it is sufficient to contact our Data Protection Officer via the contact details as mentioned above. Please see also sec. 7 of this Privacy Policy for tracking technologies.

12. Period of Data Storage and routine deletion

Insofar nothing else is explicitly stated above we process and store personal data only for the period, which is required to meet the purpose of processing, or as long and to the extent as statutory laws require us to process and/or store such data.

If the purpose of processing does not apply anymore or the applicable statutory retention requirement expires, we will as a matter of routine erase data or restrict the processing of data in accordance with the applicable statutory laws.