Privacy Policy
This policy explains which personal data DEEP Ecosystems collects when you visit www.deep-ecosystems.com, become a member, use the DEEP community and the DEEP Public Funding Monitor, and why. We process personal data in line with the EU General Data Protection Regulation (GDPR) and German data protection law.
1. Who is responsible
The controller for the processing described here is:
DEEP Ecosystems 500 UG (haftungsbeschränkt)
Westendstraße 125, 80339 Munich, Germany
Managing director: Thomas Kösters
Commercial register: District Court of Munich, HRB 262046
Email: [email protected]
For all questions about data protection and to exercise your rights, please write to [email protected].
2. Overview
| What we process | Purpose | Legal basis (GDPR) |
|---|---|---|
| Technical data when you visit the website (IP address, browser, pages, time) | Delivering and securing the website | Art. 6(1)(f) – legitimate interest in a secure, working website |
| Account and membership data (name, email, profile, purchases) | Providing your membership, the community, courses and the Funding Monitor | Art. 6(1)(b) – contract |
| Payment and invoicing data | Processing payments, invoicing, bookkeeping | Art. 6(1)(b) and (c) – contract, legal obligation |
| Contact and newsletter data | Answering requests, sending the newsletter | Art. 6(1)(b) for requests, Art. 6(1)(a) – consent for the newsletter |
| Consortium matching data (community profile ID, contact details) | Bringing members together for funding applications | Art. 6(1)(b) – contract |
| Analytics and marketing cookies | Understanding use of the website, measuring campaigns | Art. 6(1)(a) – your consent, § 25(1) TDDDG |
3. Visiting the website
Our website and member area run on the Kajabi platform, operated by Kajabi LLC, USA. When you visit a page, your browser automatically sends technical data such as your IP address, browser type and version, operating system, referring page, and the date and time of access. Kajabi processes this data on our behalf to deliver the website and to protect it against misuse. Server log data is deleted after a short period unless it is needed to investigate a security incident.
To display the website, it also loads fonts and code libraries from content delivery networks (Google Fonts, Font Awesome, jsDelivr, cdnjs). Your browser connects to these servers and transmits your IP address. We use them on the basis of our legitimate interest in a fast and consistent website (Art. 6(1)(f) GDPR).
4. Cookies and consent
We use cookies and similar technologies. Cookies that are strictly necessary for the website and your login are set without consent (§ 25(2) TDDDG). Analytics and marketing cookies are only set if you agree in our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the cookie settings on the website; withdrawal does not affect processing that took place before.
The cookie banner is provided by Cookie-Script (Objectis Ltd., Lithuania), which stores your consent choice in a cookie.
5. Membership, community and courses
When you register or buy a membership, we process your name, email address, password (stored encrypted), your purchases and access rights, and anything you add to your profile or post in the community. We use this data to provide your account, the DEEP community, courses and resources, and to send you service messages. Your community profile, name and posts are visible to other members.
We keep this data for as long as your account exists. After you close your account we delete it, unless we must keep it for tax or commercial law reasons (up to 10 years for invoices and bookkeeping records).
6. Payments
You can pay by bank transfer or credit card. For bank transfers, we process your name, account details and the payment reference. Card payments are handled by the payment service provider integrated in our platform; we do not receive or store your full card number. Invoices and payment records are kept for the statutory retention periods (up to 10 years).
7. Contact and newsletter
If you contact us by email or form, we process your details to answer your request (Art. 6(1)(b) GDPR) and delete them once the request is closed, unless retention periods apply.
If you subscribe to our newsletter, we use your email address and name to send it, based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in each newsletter. We may record whether newsletters are opened and which links are clicked, to improve our content.
8. DEEP Public Funding Monitor and consortium matching
The Funding Monitor shows public funding calls from a database we maintain in Google Sheets (Google Ireland Ltd.). Loading the calls does not transmit personal data to us beyond your IP address.
Your browser stores a few settings locally (local storage), for example which call details you have already opened as a free preview. This data stays on your device and is not sent to us.
To check whether you have access to member features, the Funding Monitor asks our platform about your membership status while you are logged in. This information is used only in your browser to show or lock features.
Looking for consortium. When you mark a call as "Looking for consortium", we store your community profile ID next to that call in our Google Sheets database, using Google Apps Script. Other users only see how many members are looking, not who. Once enough partners are listed, we share your name, organisation and contact details with the other interested members and with the Call Writer who offers participation, so that the consortium can form (Art. 6(1)(b) GDPR). You can remove your mark at any time; data already shared stays with its recipients. Details are set out in our Consortium Matching Terms and Conditions.
Starting an application. When you use "Start application", you enter your name and email so that we can invite you to a collaborative workspace in Notion (Notion Labs, Inc., USA) with a summary of the call and a first outline for your application. We use this data to provide the service you requested (Art. 6(1)(b) GDPR).
9. Analytics and marketing
The following services are only used with your consent (section 4).
Google Analytics
Google Analytics, provided via Google Tag Manager by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, helps us understand how visitors use our website (pages visited, time spent, device and approximate location). Google Analytics 4 does not store full IP addresses. Data may be transferred to Google LLC in the USA. More information: Google Privacy Policy.
Meta Pixel
We use the Meta Pixel of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, to measure the effect of our advertising on Facebook and Instagram and to show relevant ads. When you are logged in, the pixel may transmit encrypted (hashed) contact data such as your email address, name, city and country to Meta so that visits can be matched to Meta accounts ("advanced matching"). For the collection and transmission of this data we are jointly responsible with Meta (Art. 26 GDPR); Meta is responsible for any further processing. More information: Meta Privacy Policy.
Platform analytics
Kajabi records how the website and member area are used (for example page views and purchases), partly via its service provider RudderStack, so that we can see statistics about our site and products.
10. Videos
Videos on our website are hosted by Wistia, Inc., USA. When you play a video, Wistia processes your IP address and viewing data (for example how much of the video was watched) to deliver the video and provide statistics to us.
11. Recipients and transfers outside the EU
We only share personal data with the service providers named in this policy, as far as necessary for the purposes described, and with other members where this is part of a service you use (community, consortium matching). Our service providers process data on our behalf under data processing agreements (Art. 28 GDPR).
Some providers (Kajabi, Google, Meta, Wistia, Notion) are based in the USA or may access data from there. Transfers take place on the basis of the EU-US Data Privacy Framework where the provider is certified, and otherwise on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR).
We may also disclose personal data where we are legally required to, or where this is necessary to establish, exercise or defend legal claims.
12. How long we keep data
We delete personal data as soon as it is no longer needed for the purpose it was collected for, unless statutory retention obligations apply (in Germany up to 10 years for invoices and bookkeeping records under § 147 AO and § 257 HGB). Data based on your consent is deleted when you withdraw it.
13. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR);
- have incorrect data corrected (Art. 16 GDPR);
- have your data deleted (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR);
- receive your data in a common, machine-readable format (Art. 20 GDPR);
- withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR);
- lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to the use of your data for direct marketing at any time, without giving reasons.
To exercise your rights, write to [email protected].
14. Other points
We do not use automated decision-making, including profiling, that has legal effects on you. Providing personal data is not required by law; without the data needed for an account or a purchase, we cannot provide that service. Our services are not directed at people under 18.
Our website contains links to other websites, for example to funding bodies. Their operators are responsible for how they handle your data.
15. Changes to this policy
We may update this policy when our services or the law change. The current version is always available on this page, with its effective date at the top. We will inform members of significant changes by email or in the member area.
