Data Privacy Policy

Section 1 Who we are and what this Privacy Notice covers

This Privacy Notice explains how Matrix42 GmbH processes personal data when you visit our websites, interact with us at events, contact us, receive marketing communications, or communicate with us in connection with sales and business relationship management.

This Privacy Notice does not apply to personal data that Matrix42 processes on behalf of its customer as a processor in connection with the use of Matrix42 products and services. Such processing is governed by the relevant customer agreement and data processing.

Controller details
Matrix42 GmbH 
Elbinger Strasse 7
60487 Frankfurt am Main, Germany
privacy@matrix42.com

Data Protection Officer details
Bugl & Kollegen GmbH
Eifelstrasse 55
93057 Regensburg, Germany
kontakt@buglundkollegen.de 

If you contact us, we process your personal data as described in Section 3.

Section 2 Your rights

Subject to the conditions set out in the GDPR, you have the right to request access to your personal data, rectification, erasure, restriction of processing and data portability. Where the legal requirements for data portability are met, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format. You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.

Where we process your personal data for direct marketing purposes, you have the right to object at any time, including to profiling related to such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes. Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, you may contact us at privacy@matrix42.com or contact our Data Protection Officer using the details provided above. We will respond to your request in accordance with the time limits required by applicable data protection law.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement.

Our competent supervisory authority is:

The Hessian Commissioner for Data Protection and Freedom of Information 
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany 
Phone: (+49-611) 14080 
E-mail: poststelle(at)datenschutz.hessen.de 
Website: http://www.datenschutz.hessen.de

Section 3 Personal data we process when you use our website or interact with us

(1) If you visit our website for informational purposes only, we process the personal data that your browser automatically transmits to our server. This includes:

– IP address 
– Date and time of request 
– Time zone difference from Greenwich Mean Time (GMT) 
– Content of request (specific page) 
– Access status/HTTP status code 
– Transferred data volume 
– Website from which the request originates 
– Browser 
– Operating system and interface 
– Browser software language and version 

We process these data to provide the website, and to ensure its stability and security. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to provide a secure, stable and functional website, prevent misuse, and maintain the security of our systems. Server log data are retained for [5 years] and are then deleted or anonymised, unless further retention is necessary to investigate security incidents, prevent abuse, or establish, exercise or defend legal claims.

 
(2) If you register for content, webinars, events, trial access, or contact us about our products and services, we may process the following data:

• Company  
• Company address 
• First and last name 
• Position in company 
• E-mail address 
• Phone number
• Details of your request, registration, trial access, event or webinar participation, and interest in our products and services

Where a field is marked as mandatory, the information is required to handle your request, provide the requested content or access, or take pre-contractual steps. If you do not provide mandatory information, we may not be able to process your request or provide the requested content, event registration or trial access.

We process these data to manage your registration, provide the requested content, webinar, event participation or trial access, and respond to your request. Where the processing is necessary to take steps at your request before entering into a contract or to perform a contract, the legal basis is Article 6(1)(b) GDPR. For general business enquiries, relationship management and non-contractual communications, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to respond to business requests, manage B2B relationships and communicate with existing and prospective customers.

We retain these data for the duration necessary to handle your request or provide the requested content, webinar, event participation or trial access. Business contact and relationship management data are retained for up to [5] years after the last relevant interaction, unless a longer retention period is required by law or necessary for the establishment, exercise or defence of legal claims.

 
(3) We use cookies and similar technologies to operate our website, remember preferences, analyse usage and, where applicable, support marketing activities. Strictly necessary cookies and similar technologies are used to provide the website and ensure its security. We use non-essential cookies and similar technologies, such as analytics, preference and marketing technologies, only where required consent has been obtained. Further information, including the technologies used, purposes, providers, storage periods and how to manage or withdraw your consent, is available in our Cookie Notice.

(4) We may also collect personal data when you interact with us outside our website, for example at events, webinars, through social media or professional networks, or when we contact you in a business context.

Depending on the context, this may include your name, company, job title, business contact details, and information about your interest in our products and services.

We process these data to plan and run events, respond to requests, manage leads and business relationships, and carry out direct marketing.

Where we have not collected the data directly from you, the data may originate from publicly available business sources, event organisers, webinar providers, business partners, social media or professional networks. In such cases, we process the categories of personal data described above, such as name, company, job title, business contact details and information about your professional interests or interaction with Matrix42. We provide the information required by Article 14 GDPR within the time limits required by law, unless an exemption applies.

Where the processing is necessary to take steps at your request before entering into a contract or to perform a contract, the legal basis is Article 6(1)(b) GDPR. For B2B communications and relationship management, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to communicate with existing and prospective business customers, manage leads and maintain business relationships. For electronic direct marketing, we rely on consent where required by applicable ePrivacy or marketing laws. Where direct marketing is permitted without consent under applicable law, the legal basis under the GDPR is Article 6(1)(f) GDPR.

We retain these data for as long as necessary for the relevant interaction, event or business relationship management purpose. Lead and business contact data are retained for up to [5 years] after the last relevant interaction, unless you object earlier or a longer retention period is required by law or necessary for the establishment, exercise or defence of legal claims. If you object to direct marketing, we may retain limited information in a suppression list to ensure that we respect your objection.

Section 4 Recipients, sharing and international transfers of personal data

We may share personal data with:

• other Matrix42 group companies, where this is necessary for internal administration, sales, marketing, customer relationship management, support or business operations;
• our authorised partners, such as resellers, implementation partners, co-hosts or sponsors of events or webinars, where this is necessary for the relevant interaction, request, event, webinar, sales process or business relationship;
• service providers acting on our behalf, such as providers of hosting, IT support, communications, event management, marketing, analytics, cookie consent management, customer relationship management and security services, where this is strictly necessary for the management of (customer) relationship with you;
• public authorities, courts, legal advisers or other third parties where this is required by law or necessary to establish, exercise or defend legal claims.

As an international company, we may also transfer personal data to recipients outside the European Union or the European Economic Area where this is necessary for the purposes described in this Privacy Notice, including responding to requests, providing requested content or access, managing events or webinars, managing sales and business relationships, operating and securing our website and IT systems, or using service providers that support these activities.

Where personal data are transferred to a country outside the EU/EEA, we ensure that an adequate level of protection is in place, for example through an adequacy decision of the European Commission, the European Commission’s Standard Contractual Clauses or, where the recipient is certified and the framework applies to the relevant transfer, the EU-U.S. Data Privacy Framework.

You may contact us using the contact details set out above to obtain further information about the safeguards used for international transfers, including how to obtain a copy of them where applicable.

Section 5 Marketing communications

We may use your business contact details to send you information about our products, services, events, webinars, resources, product updates and other Matrix42 business-related content that may be relevant to your role or organisation.

For electronic direct marketing, such as marketing emails, we rely on consent where required by applicable laws. Where electronic direct marketing is permitted without consent under applicable law, the legal basis under the GDPR is Article 6(1)(f) GDPR. Our legitimate interests are to promote our products, services and events to existing and prospective business customers and to maintain customer relationships.

You can unsubscribe from marketing emails at any time via the preference centre or the unsubscribe link included in our emails. You can also object to other forms of direct marketing at any time by contacting us using the details set out above. If you object to direct marketing, we will no longer process your personal data for direct marketing purposes. We may retain limited information, such as your email address and marketing preference, in a suppression list to ensure that we respect your unsubscribe request or objection.

We retain marketing contact data for up to [5 years] after the last relevant interaction, unless you unsubscribe or object earlier, or a longer retention period is required by law or necessary for the establishment, exercise or defence of legal claims.

Section 6 Website Analytics

We use analytics tools to understand how our website is used and to improve its performance, content and user experience. Depending on the technology used, this may include online identifiers, cookie IDs, device and browser information, IP address, pages visited, interactions with our website, referral information and usage statistics.

We use non-essential analytics cookies and similar technologies only where the required consent has been obtained, unless the relevant analytics technology is strictly necessary or otherwise exempt under applicable law. Where the processing involves personal data and is based on consent, the legal basis is Article 6(1)(a) GDPR.

Further information, including the analytics technologies used, providers, purposes, storage periods, international transfers and how to manage or withdraw your consent, is available in our Cookie Notice.

Section 7 Advertising and remarketing

We may use advertising and remarketing technologies to measure the effectiveness of our campaigns and to show relevant advertising. Depending on the technology used, this may include online identifiers, cookie IDs, device and browser information, IP address, pages visited, interactions with our website, referral information, advertising identifiers and campaign information.

We use advertising and remarketing cookies, pixels and similar technologies only where the required consent has been obtained. Where the processing involves personal data and is based on consent, the legal basis is Article 6(1)(a) GDPR.

Further information, including the technologies used, providers, purposes, storage periods, international transfers and how to manage or withdraw your consent, is available in our Cookie Notice.

Section 8 Advertising measurement and conversion tracking

We may use advertising measurement and conversion tracking technologies to understand whether users interact with our ads and subsequently engage with our website, content or services. Depending on the technology used, this may include online identifiers, cookie IDs, device and browser information, IP address, advertising identifiers, campaign information, conversion event data and information about your interaction with our ads, website, content or services.

In some cases, this may include the use of hashed identifiers where this is supported by the relevant advertising platform and permitted by applicable law.

We use advertising measurement and conversion tracking cookies, pixels and similar technologies only where the required consent has been obtained. Where the processing involves personal data and is based on consent, the legal basis is Article 6(1)(a) GDPR.

Further information, including the technologies used, providers, purposes, storage periods, international transfers and how to manage or withdraw your consent, is available in our Cookie Notice.

Section 9 Audience matching and campaign optimisation 

We may use first-party business contact data, such as business email addresses and other business contact details, including hashed identifiers, to create, exclude, improve or measure advertising audiences and to optimise our campaigns across advertising platforms.

Hashing is used to help match identifiers with advertising platforms, but the data may still constitute personal data. We do not use special-category data for these purposes.

We carry out audience matching and campaign optimisation only where the required consent has been obtained. Where the processing involves personal data and is based on consent, the legal basis is Article 6(1)(a) GDPR.

Further information, including the advertising platforms used, providers, purposes, storage periods, international transfers and how to manage or withdraw your consent, is available in our Cookie Notice.

Section 10 Social media features

Our website may include links to third-party social media services or social media features, such as embedded posts, buttons or plug-ins.

If you only click on a link to a social media service, the relevant provider will process your personal data in accordance with its own privacy notice.

Embedded social media features, buttons, plug-ins or similar technologies that may transmit personal data to third-party providers or store or access information on your device are activated only where the required consent has been obtained.

When you activate or interact with such features, the relevant provider may receive information about your use of our website and process personal data in accordance with its own privacy notice.

Further information, including the social media features used, providers, purposes, storage periods, international transfers and how to manage or withdraw your consent, is available in our Cookie Notice.

Section 11 Embedded third-party content

Our website may include embedded third-party content or services, such as videos, maps, forms, media players or similar features.

When such content is activated or used, the relevant provider may receive information about your use of our website, such as your IP address, device and browser information, online identifiers, cookie IDs, the page visited and your interaction with the embedded content. The relevant provider may process personal data in accordance with its own privacy notice.

We activate non-essential embedded third-party content and related cookies or similar technologies only where the required consent has been obtained.

Further information, including the embedded content and services used, providers, purposes, storage periods, international transfers and how to manage or withdraw your consent, is available in our Cookie Notice.

Section 12 Chatbot

If you use our chatbot, we process the information you provide in the chat and related technical and usage data in order to answer your request, suggest relevant resources, support service processes and, where applicable, forward your request to the responsible Matrix42 team.

Depending on the context, this may include your name, business contact details, company, the content of your messages, information about your request, technical identifiers, timestamps and chatbot usage information.

Where the chatbot is used to respond to your request, provide support or take steps at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR where applicable. For general enquiries, routing requests, improving the chatbot and ensuring its security and functionality, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to respond to enquiries, provide efficient support, improve our communications and services, and ensure the security and functionality of the chatbot.

The chatbot may be provided with the support of external technology providers acting on our behalf. These providers may process personal data as processors and, where applicable, may be located outside the EU/EEA as described in Section 4.

Please do not provide special-category data, confidential information or information about third parties in the chatbot unless this is necessary for your request.

We retain chatbot data for [5 years] after the chat or for as long as necessary to handle and document your request, unless a longer retention period is required by law or necessary for the establishment, exercise or defence of legal claims.

Where chatbot-related cookies or similar technologies are used, further information, including the technologies used, providers, storage periods and how to manage or withdraw your consent, is available in our Cookie Notice.

Section 13 Content engagement measurement

In certain cases, we may use tools to measure how shared content is accessed and used, for example whether content was opened, viewed, clicked or downloaded, and for how long. Depending on the technology used, this may include your business contact details, online identifiers, IP address, device and browser information, timestamps, interaction data and information about the content accessed.

We use this information to understand the effectiveness of our communications and to improve our content, services and customer communications.

Where content engagement measurement involves cookies, pixels, tracking links or similar technologies, we use such technologies only where the required consent has been obtained, unless they are strictly necessary or otherwise exempt under applicable law. Where the processing involves personal data and is based on consent, the legal basis is Article 6(1)(a) GDPR.

Where content engagement measurement is carried out without cookies, pixels or similar technologies and is permitted under applicable law, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to measure the relevance and effectiveness of our business communications and improve our content and services.

Further information, including the tools used, providers, purposes, storage periods, international transfers and how to manage or withdraw your consent where applicable, is available in our Cookie Notice or the relevant point-of-collection notice.

Section 14 Involvement of partners 

In some cases, we may offer content, events, webinars or other resources together with authorised Matrix42 partners, such as resellers, implementation partners, co-hosts or sponsors.

Where personal data are shared with a partner, we will inform you at the point of collection about the relevant partner, the purposes of the sharing, the categories of personal data shared, and whether the partner acts as an independent controller, joint controller or processor.

Where a partner receives personal data for its own purposes, such as follow-up communications, sales or marketing, the partner is responsible for its own processing and will process the data in accordance with its own privacy notice. Where required by applicable ePrivacy, marketing or data protection laws, we will share personal data with partners for such purposes only with your consent.

Where partner involvement includes international transfers, the safeguards described in Section 4 apply.

Section 15 Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our data processing practices or legal requirements. The latest version will be available on our website.

LAST UPDATED: (August 12, 2026)