Privacy Policy

1. Data protection at a glance

General information. The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Detailed information is set out below.

Who is responsible? Data processing on this website is carried out by the website operator, whose contact details are in “Information on the controller” below.

How we collect your data. Some data is collected when you provide it to us, for example in a contact form. Other data is collected automatically or with your consent when you visit the website, in particular technical data (e.g. internet browser, operating system, or time of the page request).

What we use your data for. Part of the data is collected to ensure the website is provided without errors. Other data is used only with your consent: to analyse how you use the site (statistics) and to measure the effect of our advertising and show it to you again (marketing).

Your rights. You have the right to receive information about the origin, recipients, and purpose of your stored personal data free of charge at any time, to request its correction or deletion, to withdraw consent, and, under certain circumstances, to request restriction of processing. You also have a right to lodge a complaint with the competent supervisory authority. A full description is set out in our GDPR / Data Subject Rights notice.

2. Hosting

This website is hosted externally. The personal data collected here is stored on the servers of the host. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

External hosting takes place to fulfil our contract with potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of secure, fast and efficient provision of our online services (Art. 6(1)(f) GDPR). Where consent has been requested, processing is based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time. Our host processes your data only to the extent necessary to fulfil its performance obligations and follows our instructions.

We use the following host: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare delivers our website via its global server network (Cloudflare Workers and CDN) and processes every page request in doing so, in particular your IP address, browser and device details, the address requested and the time of the request. We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR (Cloudflare Data Processing Addendum). Cloudflare is certified under the EU-U.S. Data Privacy Framework (see section 7).

3. General information and mandatory disclosures

Data protection. We take the protection of your personal data very seriously and treat it confidentially and in accordance with statutory data protection regulations and this privacy policy. Data transmission over the internet (e.g. email) can have security gaps; complete protection against third-party access is not possible.

Information on the controller. The controller responsible for data processing on this website is:

BeFunded — Wheels & Wings Lab GmbH
Rathausgasse 17
12529 Schönefeld, Germany
Email: services@be-funded.de

Storage period. Unless a more specific period is stated, your personal data remains with us until the purpose for processing no longer applies. On a justified deletion request or withdrawal of consent, your data is deleted unless we have other legally permissible reasons for storing it (e.g. tax or commercial-law retention periods); in that case deletion takes place once those reasons no longer apply.

Legal bases. Where you have consented, we process data on the basis of Art. 6(1)(a) or Art. 9(2)(a) GDPR. For third-country transfers with explicit consent, Art. 49(1)(a) GDPR also applies. For cookies/device access with consent, Section 25(1) TDDDG applies. For contract performance or pre-contractual measures we rely on Art. 6(1)(b) GDPR; for legal obligations on Art. 6(1)(c) GDPR; and otherwise on our legitimate interest under Art. 6(1)(f) GDPR. The applicable basis in each case is set out in the relevant section.

Recipients of personal data. We work with various external parties and in some cases transfer personal data to them, only where necessary for contract performance, where we are legally obliged (e.g. transfer to tax authorities or to the research-allowance certification body, BSFZ), where we have a legitimate interest under Art. 6(1)(f) GDPR, or where another legal basis permits. When using processors, we transfer data only on the basis of a valid data processing agreement; joint processing is covered by a joint controller agreement.

SSL / TLS encryption. For security, this site uses SSL/TLS encryption, recognisable by “https://” and the lock symbol in your browser. When activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies. Our website uses cookies, which do no harm to your device. They are stored temporarily (session cookies) or permanently (persistent cookies) and may be first-party or third-party. Necessary cookies are stored on the basis of Art. 6(1)(f) GDPR; where consent has been requested, processing is based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG and can be withdrawn at any time. You can configure your browser to manage or delete cookies; disabling them may limit functionality.

Consent management. On your first visit our cookie banner asks for your consent, separately for two categories: statistics (Google Analytics, Microsoft Clarity) and marketing (Google Ads, Meta pixel, Instantly, Ahrefs Web Analytics). Until you consent, and after “Decline”, none of these services sets cookies; Microsoft Clarity, Meta pixel, Instantly and Ahrefs do not load at all, and Google Analytics and Google Ads only send cookieless signals (see “Google Consent Mode” in section 5). We store your choice with its date and version in your browser’s local storage (key bf_consent) so that the banner does not appear on every page. We ask again after twelve months or when the list of services changes. You can change or withdraw your choice at any time via “Cookie settings” in the footer; if you withdraw a consent, we delete that category’s cookies on our domain and reload the page. Legal basis for storing your choice: Section 25(2) no. 2 TDDDG and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Server log files. The provider automatically collects and stores information your browser transmits: browser type and version, operating system, referrer URL, host name, time of the request and IP address. This data is not merged with other sources and is collected on the basis of Art. 6(1)(f) GDPR (legitimate interest in error-free presentation and optimisation).

Contact form. If you send enquiries via the contact form, your details including the contact data provided are stored for processing the enquiry and any follow-up questions. We do not pass this on without your consent. Processing is based on Art. 6(1)(b) GDPR (contract/pre-contractual), otherwise on our legitimate interest (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR). The data remains until you ask us to delete it, withdraw consent, or the purpose no longer applies; statutory retention periods remain unaffected.

Enquiry by email or fax. If you contact us by email or fax, your enquiry and all resulting personal data is stored and processed to handle your request, on the same legal bases as above and not passed on without your consent.

Advertising and campaign parameters. If you reach our website via an advert or a campaign link, the address contains parameters describing where the visit came from, for example gclid for Google Ads as well as utm_source, utm_medium, utm_campaign, utm_term and utm_content. We store these parameters temporarily in your browser and transmit them together with an enquiry so that we can trace which channel the enquiry came from. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our advertising). Where information that is not strictly necessary is stored on or read from your device in the process, this is done on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Funding check. On some of our landing pages you can answer a few questions about what you want funding for, how far along your project is and roughly how big it is. Together with your contact details, we transfer your answers into our CRM system (see Pipedrive) so we can get back to you with an assessment, and use publicly available information about your company, such as its website, to check whether it shows signs of its own technical development. It is the company that is assessed, not you as a person. If you end the check without leaving contact details, we do not store your answers; our statistics (see Google Analytics) only record how far you got and which buttons and questions you clicked. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR (legitimate interest in suitable advice).

5. Analytics and tag management

Google Tag Manager. Provided by Google Ireland Limited, Dublin. We use the Tag Manager to embed the services in the statistics and marketing categories. It loads on every page view, even without consent; without consent, and after “Decline”, it only triggers Google Analytics and Google Ads in a restricted mode (see “Google Consent Mode” below), and all other services only once you agree. When it loads, Google receives your IP address and details about your browser and device. The Tag Manager itself sets no cookies and creates no user profiles; which services it triggers depends on your choice, which we pass on to it via Google Consent Mode. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Google LLC in the USA (see section 7).

Google Analytics. A web analytics service by Google Ireland Limited, used only after you consent to the “statistics” category in our cookie banner. Without this consent Google Analytics sets no cookies and only sends cookieless signals (see “Google Consent Mode”). Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR. In GA4, IP addresses are not stored persistently and location data is shortened; user and event data is retained for a maximum of 14 months. Among other things, we record individual events on our pages, for example submitting a form, booking an appointment or clicking our phone number. Data may be transferred to Google LLC in the USA (see section 7).

Cloudflare Turnstile. Provided by Cloudflare, Inc., San Francisco, USA. On form entries, Turnstile checks whether the input comes from a human or from an automated program. Technical details such as the IP address, browser and device information and behaviour within the form are evaluated for this. Turnstile sets no advertising cookies and creates no user profiles. Legal basis: Art. 6(1)(f) GDPR (protection from abusive automated access and spam).

Google Ads (conversion tracking and remarketing). Provided by Google Ireland Limited, Dublin. We advertise via Google Ads and measure which advert led to an enquiry or a booked appointment. For this, after you consent to the “marketing” category, Google sets cookies and processes the click identifier (gclid), your IP address, browser and device information and the events triggered on our website. On this basis our adverts may also be shown to you again on other websites (remarketing). Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time. Without consent to “marketing”, Google Ads sets no cookies and only receives cookieless signals without advertising identifiers (see “Google Consent Mode”).

Google Consent Mode. We use Google Consent Mode in advanced mode. The Google Tag Manager therefore loads on every page view, even before you have made a choice; all consent states start as “denied”. Without your consent, Google Analytics and Google Ads set no cookies and read none. Google then only receives cookieless signals for aggregated measurement and modelling, such as the time of the visit, browser and device details, the referring page, your consent status and, if you arrive via an advert, the click identifier from the address bar (gclid). As with any request, Google also receives your IP address. These signals are used to estimate visits and conversions statistically. Only once you consent to a category do the Google services in that category set cookies. Legal basis for the cookieless signals: Art. 6(1)(f) GDPR; our legitimate interest is data-minimising measurement of which adverts and pages lead to enquiries. Data may be transferred to Google LLC in the USA (see section 7).

Enhanced conversions. When you submit a form on our website or book an appointment, we additionally transmit your email address to Google Ads in encrypted form (SHA-256 hash value) so that Google can attribute the enquiry to the preceding advert click. The address in plain text does not leave your browser. The transmission only takes place after you consent to the “marketing” category. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. To that extent Google processes this data as a processor on the basis of the Google Ads Data Processing Terms.

Microsoft Clarity. Provided by Microsoft Ireland Operations Limited, Dublin. After you consent to the “statistics” category, Clarity records how you use our pages, for example mouse movements, clicks and scrolling behaviour, and presents this use in heatmaps and session replays. Entries in form fields are masked automatically. For this, Clarity sets cookies on our domain (_clck, _clsk) and on Microsoft domains (clarity.ms, bing.com). Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Microsoft Corporation in the USA (see section 7).

Ahrefs Web Analytics. Provided by Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581. We use Ahrefs Web Analytics to see through which channels visitors reach our website; the script is only loaded after you consent to the “marketing” category. The tool sets no cookies, stores no identifiers on your device and builds no cross-device profiles. Your IP address, the page called up, the referring page and the browser and device type are transmitted; only aggregated details are evaluated from them, such as the approximate location at country level. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. There is no EU adequacy decision for Singapore; the transfer is based on the European Commission’s Standard Contractual Clauses (see section 7).

Cloudflare Web Analytics. Provided by Cloudflare, Inc., San Francisco, USA. Cloudflare’s reach measurement works without cookies and without recognising individual visitors, and gives us aggregated details on page views and loading times. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and fast delivery and in data-minimising reach measurement).

6. Plugins and tools

Google Fonts (local hosting). This site uses Google Fonts for a uniform display, installed locally. No connection to Google’s servers takes place when you visit our website.

Meta pixel. Provided by Meta Platforms Ireland Limited, Dublin. The Meta pixel is only loaded after you consent to the “marketing” category. It records which pages you call up and which actions you trigger there, and attributes these to your Facebook or Instagram account if you are logged in there. We use this data to measure the effect of our adverts and to show you adverts again. For the collection and transmission of the data, we and Meta are joint controllers pursuant to Art. 26 GDPR. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Meta Platforms, Inc. in the USA (see section 7).

Instantly (visitor identification). Provided by Foo Monk, LLC (Instantly.ai), 30 N. Gould St., Ste. R, Sheridan, Wyoming 82801, USA, delivered technically via leadsy.ai and instantly.ai. The script is only loaded after you consent to the “marketing” category. It evaluates your IP address in order to determine the company from whose network you are visiting our website, so that we can approach you about the funding programmes that suit you. Identifying you as a person is not intended. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data is processed in the USA (see section 7).

Calendly. Provided by Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. We embed Calendly for appointment booking. When the booking calendar is opened, your IP address and technical details about your browser and device are transmitted to Calendly; if you have consented to the “marketing” category, our website loads the Calendly script beforehand so that the calendar appears faster. If you book an appointment, Calendly additionally processes the data you provide, in particular name, email address and the chosen appointment. Within the calendar, Calendly uses its own cookie banner to ask for your consent to cookies and services it does not need for the booking, for example analytics. Services for payment processing and fraud prevention are loaded by Calendly even without that consent; Calendly names its service providers in its privacy notice and its list of sub-processors. Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures) as well as, for the services Calendly asks consent for, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Calendly is certified under the EU-U.S. Data Privacy Framework (see section 7).

Pipedrive (customer management). Provided by Pipedrive OÜ, Tallinn, Estonia. We transfer enquiries from our forms and appointment bookings into our CRM system Pipedrive in order to process and follow them up. The contact data you provide, details about your project and technical details on the origin of your enquiry are processed, in particular the click identifier (gclid) and the utm parameters described under advertising and campaign parameters, which we store with your enquiry. Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in the orderly processing of enquiries). Pipedrive processes the data as a processor on our behalf.

Resend (email delivery). Provided by Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA. We use Resend to send the emails for enquiries from our forms: the notification to our team with all details from the form, the address of the page and the details described under advertising and campaign parameters, and the confirmation of receipt to your email address. Resend processes this data as a processor on our behalf (Data Processing Addendum pursuant to Art. 28 GDPR). Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in reliable delivery). The data is processed in the USA (see section 7).

Sanity (images in our blog). We manage the content of our blog in the content management system Sanity (Sanity AS, Norway, and Sanity US Inc., USA). Your browser loads the images of blog articles directly from Sanity’s image CDN (cdn.sanity.io). In doing so, Sanity receives your IP address, details about your browser and device and the address of the image. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast and reliable delivery of our content). Sanity uses sub-processors such as Google Cloud for this; processing in the USA is possible (see section 7).

7. International data transfers

Some providers we use (in particular Google, Meta, Microsoft, Cloudflare, Calendly, Instantly, Resend and Sanity) may process personal data in the United States. For transfers to the USA we rely on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (DPF) where the recipient is certified. Google LLC, Meta Platforms, Inc., Microsoft Corporation, Cloudflare, Inc., Calendly, LLC and Resend (Plus Five Five, Inc.) are certified under the DPF (verifiable at www.dataprivacyframework.gov). As an additional safeguard, these providers also incorporate the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Ahrefs processes data in Singapore, for which there is no adequacy decision; that transfer is based on the Standard Contractual Clauses of the European Commission. A transfer only takes place where the requirements of Chapter V GDPR are met.

8. Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority. A full description and how to exercise these rights is set out in our GDPR / Data Subject Rights notice.