Website Privacy Policy

1. Scope and contact

This notice explains how FutureNext GmbH processes personal information when you visit the Virtualbadge.io marketing website, request information or a demo, or receive our marketing communications.

For customer accounts, subscriptions, certificates and recipient-facing services, see our separate SaaS Privacy Policy.

Controller
FutureNext GmbH
Mafinex Technologiezentrum
Julius-Hatry-Str. 1
68163 Mannheim, Germany

Privacy contact:support@virtualbadge.io
External data protection officer: heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany; datenschutz@heydata.eu; www.heydata.eu

2. Visiting the website

To send pages to your browser and maintain a reliable website, we process technical request information. This includes your IP address, the requested page, request time, referrer and browser information, and access status. Error and security records help us investigate failures and misuse.

The purpose is website delivery and protection. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in making the website available and protecting it against attacks. Processing is limited to what is necessary for those purposes.

Hosting and delivery provider: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA, provides the hosting and delivery infrastructure for the public website and processes technical visitor data. Data locations and international transfer safeguards are described in section 7. Further information is available in Webflow's privacy policy, Webflow's DPA and Webflow's Privacy FAQs.

3. Enquiries, demos and business contacts

If you contact us, we process the details you provide, such as your name, work contact details, organisation and message, together with correspondence needed to handle the request. The contact form is provided through HubSpot Forms and the demo time selection through HubSpot Meetings. If you book a demo, we also process the booking and meeting information needed to arrange it.

We use this information to answer questions, arrange the requested interaction and manage our business relationship. Article 6(1)(b) GDPR applies to steps you request toward a contract with you personally. For enquiries made on behalf of an organisation, our basis is Article 6(1)(f): our interest in communicating with business contacts and handling their requests.

We may also invite you to participate in voluntary surveys or provide feedback. If you participate, we use the information you choose to provide to understand your feedback and improve our products and services. Where personal information is collected, we explain the relevant data use when presenting the survey or feedback request.

The contact form on our website submits your information directly to HubSpot. We use HubSpot to manage contacts and related communications. This can include contact details, company information, enquiry or sales activity, correspondence and relevant attachments. Contact-form submissions are not stored through Webflow Forms.

HubSpot entity and hosting region: Our contracting entity is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. Our selected HubSpot data-hosting region is the EU. Information about international support and subprocessor access and the provider's published transfer safeguards appears in section 7.

Demo booking: HubSpot Forms and HubSpot Meetings. The subsequently scheduled video call takes place through Microsoft Teams, which processes the participant details, communication content and connection data needed for the call. Microsoft's privacy statement and enterprise privacy terms provide further information.

Chat: The website provides an active chat function through HubSpot Conversations. You can start a chat without providing your name or email address. If the conversation needs to be escalated to a customer-support person, we request your email address so that support can respond and follow up. We process your messages and the technical and conversation data needed to provide and follow up on the chat.

Retention: We retain enquiry, chat-escalation and demo contact records during active contact or negotiations with the organisation concerned. If no customer relationship develops, we delete the contact record after two years without such activity. An open sales record or automated marketing emails alone do not extend this period. Information may be retained longer where necessary for a specific legal claim or a statutory record-keeping obligation.

HubSpot’s own processing is explained in its privacy policy. Our use of HubSpot website analytics is described in section 5.

Demo-call recordings, transcripts and summaries: With your consent (Article 6(1)(a) GDPR), we use Sally to record demo calls and generate transcripts and AI-produced summaries of the conversations. Sally is provided by Aliru GmbH, Julius-Hatry-Straße 1, 68163 Mannheim, Germany. It processes meeting materials on our behalf. Aliru describes German hosting and AI processing in its participant privacy notice.

We use demo transcripts and AI summaries for documentation, follow-up and staff training.

We store demo recordings, transcripts and summaries in Sally. You can withdraw consent or request erasure through our privacy contact. Applicable legal exceptions may affect erasure.

For targeted business-to-business sales outreach, our staff may add a person's name, role, organisation and business contact details to HubSpot even where that person did not provide the information directly to us. We use those details to contact potentially relevant organisations about our services. Our basis is Article 6(1)(f) GDPR: our legitimate interest in developing business relationships, balanced against the person's reasonable expectations. At the first communication, we identify the source used for that contact, including whether it was publicly accessible, and provide access to this notice. The separate rules governing the permitted communication channel continue to apply. You may object to direct marketing at any time.

4. Product and marketing emails

We use HubSpot to send product updates and other marketing communications about our products and services. We process contact details and communication preferences for this purpose. Trial users also receive product and marketing updates by email.

For marketing based on your consent, the legal basis is Article 6(1)(a) GDPR. Where all requirements of section 7(3) UWG are met, we may also use an email address obtained in a customer relationship to advertise our own similar products or services under that provision.

You can withdraw consent or object to marketing at any time, without charge, using the unsubscribe link in each marketing email or contacting support@virtualbadge.io. Withdrawal does not affect earlier lawful processing.

We retain subscription and permission records while the communication is active and afterwards only as needed to demonstrate compliance and respect your communication choices. Necessary account and service messages are covered by our SaaS Privacy Policy.

5. Cookies, analytics and advertising

Cookies and similar technologies can store information on, or read information from, your device. They may support essential functions or optional measurement and advertising.

For device storage or access subject to German law, consent is required under section 25(1) TDDDG unless an exception under section 25(2) applies. The legal basis for processing associated personal data is considered separately under the GDPR.

We ask for your consent to optional analytics and advertising technologies. You can review your choices using the Cookie Settings button below. Rejecting those optional purposes does not prevent ordinary access to the website.

Your cookie choices

The cookie settings offer four categories:

• Necessary (Always Active): technologies required for basic website functions and remembering your privacy choices. These cannot be switched off in the settings.
• Analytics: optional measurement of website use and interactions, including Google Analytics and HubSpot website analytics.
• Marketing: optional advertising measurement and audience-related technologies, including Google Ads, Meta and LinkedIn.
• Personalization: optional technologies for remembering choices and providing more personalised features.

You can accept all optional categories or select individual categories and click Save Settings. You can reopen the settings at any time and save a new selection, including withdrawing optional consent. Withdrawal does not affect processing that was lawful before it. Changing cookie choices does not unsubscribe you from marketing emails; use the unsubscribe link in the email for that.

Cookie Settings

Cookies and their lifetimes

The table below lists cookies used on our website, their purposes and their lifetimes on your device. Cookie lifetimes are separate from providers' retention of personal information.

The __hs_do_not_track cookie tells HubSpot's tracking code not to send tracking information. We use it to keep HubSpot website analytics disabled while Analytics consent is missing or declined; it is intended to be removed when you grant Analytics consent. It does not itself prevent every HubSpot cookie or script from loading or prevent information you submit through a form from being processed. See HubSpot's cookie explanation.

The LinkedIn rows identify cookies used in connection with the optional LinkedIn service. Their individual functions include security, preferences and routing; the Marketing label identifies the choice for enabling that service on our website. See LinkedIn's cookie table.

Dealfront/Leadfeeder also uses browser local storage (_lfa and _lfa_expiry).

The category identifies which choice controls the optional purpose; it does not mean that a cookie is set whenever that category is enabled. In particular, the fa-consent-* cookies store your choices and belong to Necessary even when their names include “analytics” or “ad”.

Services using cookies and similar technologies

We use Google Tag Manager to manage technologies deployed on the website. The relevant services are described below.

Consent management: We use FlowAppz Cookie Consent to present cookie choices and store preferences in first-party cookies in your browser for three months. Your consent preferences are not sent to FlowAppz. See its Cookie Consent privacy policy.

Google Analytics 4: We use Google Analytics 4 to understand website use and measure interactions with our pages. This involves browser identifiers, device/browser information and page and interaction data. Google states that Analytics processes IP addresses during collection but does not log or store them. Our GA4 property is linked to our Google Ads account, with personalised advertising enabled for the link. The basis is consent under Article 6(1)(a) GDPR and section 25(1) TDDDG where applicable. Our GA4 retention settings are two months for event data and fourteen months for user data. The retention period for the user identifier restarts with new activity. These settings do not limit the retention of aggregated standard reports. See Google's Analytics data safeguards.

Meta Pixel: We use Meta Pixel, provided for European users by Meta Platforms Ireland Limited, Ireland, to measure advertising results and support advertising to website visitors. The pixel transmits website-interaction and browser/device information to Meta. The basis is consent under Article 6(1)(a) GDPR and section 25(1) TDDDG where applicable. We and Meta are joint controllers for the collection and transmission of pixel data. Under Meta's Controller Addendum, we provide information about our pixel use, and Meta handles rights requests concerning the data it stores. Meta is responsible for its subsequent processing. You can also contact us to exercise your rights. Further information is available in Meta's privacy policy.

HubSpot website analytics: We use the HubSpot tracking code to measure website visits and interactions. It processes website activity, IP addresses and browser identifiers. See HubSpot's tracking-code information. The basis is analytics consent under Article 6(1)(a) GDPR and section 25(1) TDDDG where applicable.

Google services: Google's European entity is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We also use Google Tag Manager for tag delivery and Google Ads to measure advertising results, including whether an ad leads to an enquiry or trial signup. Advertising measurement uses online identifiers and campaign/interaction data. Google's terms distinguish Analytics/Tag Manager processor services from ordinary Google Ads controller services; see its service information and privacy policy.

LinkedIn Insight Tag: We use LinkedIn's tag for advertising measurement and audience reporting. LinkedIn Ireland Unlimited Company is the provider's European controller. The tag sends page/referrer, IP address, device/browser and visit-time information. LinkedIn states that direct member identifiers are removed within seven days and the remaining pseudonymous tag data is deleted within 180 days. See its Insight Tag explanation and privacy policy.

Dealfront/Leadfeeder: We use its website-visitor technology to analyse company-level website visits. The tracker processes IP addresses, browser identifiers, visit activity and traffic-source information to associate visits with companies. The provider describes its Web Visitors Tracker as processing on the customer's behalf; see its tracker information and privacy notice.

The basis for these optional advertising and company-visit tags is the corresponding consent under Article 6(1)(a) GDPR and section 25(1) TDDDG where applicable. These optional technologies are intended to run only after the corresponding consent.

6. External content, downloads and free tools

Following an ordinary external link takes you to another provider’s service. Embedded content can instead transmit information while it is loaded on our page.

A certificate service performed for an issuing organisation is covered by the SaaS policy even when reached from this website.

If you opt in when requesting a download, we use your contact details to send automated marketing emails related to that download. You can unsubscribe at any time using the link in each marketing email or contacting our privacy contact. Section 4 explains the legal bases and your choices for marketing communications.

Our free certificate and badge tools include a separate signup step for a SaaS free trial. The processing of your trial account and subsequent use of the service is explained in our SaaS Privacy Policy.

7. Who receives information and international transfers

FutureNext GmbH is based in Germany and is the controller under the GDPR for the processing described in this website notice. Information about the SaaS service is available in our SaaS Privacy Policy.

The relevant providers are identified in the sections above. Other possible recipients include authorised staff and professional advisers handling the particular matter, and authorities where disclosure is required by law. Each disclosure must have an applicable legal basis and appropriate limits.

Providers acting on our instructions are subject to data-processing terms. Some providers also act as independent controllers for their own purposes, as described in the provider information above.

Our selected HubSpot data-hosting region is the EU. Some of our website service providers also process information outside the European Economic Area (EEA), including in the United States.

The table below summarises data locations and the safeguards described in the providers' published terms. These include the EU–US Data Privacy Framework for covered transfers to participating US organisations and the European Commission's Standard Contractual Clauses.

You can obtain further information about applicable transfer safeguards and request a copy through our privacy contact in section 1, subject to necessary redactions.

8. Retention and security

Where German commercial or tax law requires retention, we keep qualifying business correspondence for six years, invoices and accounting vouchers for eight years, and accounting books and annual accounts for ten years, generally from the end of the relevant calendar year. Longer retention may be required for ongoing legal or tax proceedings. The legal basis is Article 6(1)(c) GDPR.

If a legal obligation or a specific dispute requires longer retention, we restrict further use to that purpose and retain only the necessary records.

We apply technical and organisational measures appropriate to the data and risks to protect the confidentiality, integrity and availability of personal information. No method of transmission or storage can guarantee absolute security.

9. Your rights

Under the applicable conditions, you may request access, correction, erasure, restriction of processing and data portability. You may withdraw consent at any time without affecting earlier lawful processing.

You may object, for reasons arising from your particular situation, to processing based on legitimate interests. You may object to direct marketing at any time, including related profiling.

Contact us using section 1. We may ask for proportionate information to verify your identity. You may also complain to a supervisory authority, including one in the country of your habitual residence, workplace or the alleged infringement.

10. Required information and automated decisions

Our contact and demo forms clearly distinguish required fields from optional fields. Without the information needed to handle your request, we may be unable to respond or arrange the requested interaction.

We do not use website contact or prospect data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

11. Changes

We update this notice when the processing it describes changes and indicate the revision date. Where required, we provide information before a new purpose or material change takes effect. Reading this notice or continuing to use the website is not consent to new processing.