Introduction

The following information is intended to give you an overview of the processing of your personal data on our website www.theblockbrain.ai (hereinafter referred to as “website“). We also want to inform you about your rights under the data protection laws. The processing of your personal data by us is always in accordance with the General Data Protection Regulation (hereinafter referred to as “GDPR“) and all applicable country-specific data protection regulations.

Table of contents

1. Responsibility
2. Data Protection Officer
3. Use of third party services
4. Provision of the Website
5. Cookies
6. Contact options
7. Newsletter
8. Social Networks
9. Your rights
10. Up-to dateness and change of the data protection notice

1. Responsibility

Responisble in the sense of the GDPR is:

Blockbrain GmbH
Marienstraße 37
70178 Stuttgart

E-mail: info@theblockbrain.io

2. Data Protection Officer

You can reach our data protection officer as follows:

Niklas Hanitsch
secjur GmbH
Steinhöft 9
20459 Hamburg

Phone: +49 40 228 599 520

E-mail: dsb@secjur.com

You can contact our data protection officer directly at any time with all questions and suggestions regarding data protection and the exercise of your rights.

3. Use of third party services

We use third-party services for certain functions and services on our website. The specific services can be found in the corresponding chapters.

In some cases, we use service providers that are based in a third country, i.e. outside the EU. We only transfer data to a third country in which there is an appropriate level of data protection or suitable guarantees within the meaning of Art. 44-49 GDPR. You have the right to request a copy of the appropriate safeguards we have put in place. For this purpose, please send us an e-mail to the e-mail address mentioned in this privacy policy.

4. Provision of the Website

4.1 General information

When you visit our website, data is automatically processed that your browser transmits to our server. This general data and information is stored in the server’s log files (in so-called “server log files”). The following can be collected:

As a hosting provider we use WP Engine, based in London, whose servers are located in Germany for our purposes.

4.2 Purpose of the processing

When using this general data and information, we do not draw any conclusions about your person. The purposes pursued by us include in particular:

• the guarantee of a smooth connection set-up of the website,
• the clarification of acts of abuse or fraud,
• problem analysis in the network, and
• the evaluation of system security and stability.

4.3 Legal basis

The legal basis for data processing is our legitimate interest within the meaning of Art. 6 (1) (f) GDPR. We have an overriding legitimate interest in being able to offer our service in a technically flawless manner.

4.4 Storage period

The log files are stored for security reasons (e.g. for the clarification of abuse or fraud) for a maximum of 7 days and then deleted. Data whose further retention is required for evidentiary purposes will be retained until the matter has been finally clarified.

4.5 Recipients of personal data

We use the following service providers:

Provider	Address	Third country	Suitable guarantee	More information
WP Engine	Irongate House, 22-30 Duke’s Place London, EC3A 7LP United Kingdom	UK	adequacy decision	Privacy Policy

5. Cookies

5.1 General information

We use cookies on our website. These are text files that your browser automatically creates and that are stored on your terminal device when you visit our site. In the cookie, information is stored that arises in connection with the specific end device used.

5.2 Technically necessary cookies

We use technically necessary cookies. These are cookies that are technically necessary to provide all the functions of our website.

5.2.1 Purpose of the processing

We use technically necessary cookies for the following purposes:

• Provide services,
• to enable the use of our website functions,
• as well as to offer different languages.

5.2.2 Legal basis

The legal basis for data processing is our legitimate interest within the meaning of Art. 6 (1) (f) GDPR . We have an overriding legitimate interest in being able to offer our service in a technically flawless manner.

5.2.3 Storage period

We delete your personal data as soon as they are no longer required to achieve the purpose for which they were collected. Technically necessary cookies are only stored for the respective session. When you leave our website and close your browser, the cookies are deleted.

5.2.4 Overview of technically necessary cookies

Name	Provider	Purpose	Period of validity	Type
CookieConsent	Cookiebot	Stores the user’s cookie consent status for the current domain	1 year	http Cookie

5.2.5 Recipients of personal data

We use the following service providers:

Provider	Address	Third country	Suitable guarantee	More information
Cookiebot by usercentrics	Usercentrics A/S Havnegade 39 1058 Copenhagen, Denmark	USA	Standard Contractual Clauses	Privacy Policy

5.3 Analysis and marketing cookies

We also use analysis and marketing cookies. These are cookies that are not technically necessary. We use them to understand your behaviour on our website and to improve our offer.

5.3.1 Purpose of the processing

We use technically necessary cookies for the following purposes:

• Reach measurement and tracking,
• Evaluation of visitor behaviour,
• Optimisation of our offer,
• and targeted advertising.

5.3.2 Legal basis

The legal basis for the data processing is your consent according to Art. 6 (1) (a) GDPR. The cookies are only set after you have given your consent via our Cookie banner.

5.3.3  Storage period

We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. The storage period of the personal data depends on the providers used.

5.3.4 Overview of analysis and marketing cookies

We use the following analytics and marketing cookies:

Name	Provider	Purpose	Period of validity	Type
_ga	Google	Registers a unique ID that is used to create statistical data about how the visitor uses the website.	2 years	http
_ga_#	Google	Used by Google Analytics to collect data about the number of times a user visits the website, as well as the data of the first and last visit.	2 years	http

5.3.5 Recipients of personal data

We use the following service providers:

Provider	Address	Third country	Suitable guarantee	More Information
Google Analytics	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland	USA	Standard Contractual Clauses	Google analytics

5.4 Other functional services

We use the following third-party tools to provide certain features on our website:

Provider	Address	Purpose of the processing	Legal basis	Storage period
Google Tag Manager	Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Irland	Analysis of our online offer	Art. 6 (1) (a) GDPR	We delete your personal data as soon as they are no longer required to fulfill the purpose for which they were collected.
Google Optimize	Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Irland	Testing tool to optimize the website	Art. 6 (1) (a) GDPR	We delete your personal data as soon as they are no longer required to fulfill the purpose for which they were collected.

6. Contact options

6.1 General information

Through our website you have the opportunity to contact us by e-mail.

In the course of contacting you and answering your inquiry, we process the following personal data from you:

• E-mail address
• Other personal data that you provide to us when contacting us.

6.2 Purpose of the processing

We process your data to respond to your enquiry and other matters arising from it.

6.3 Legal basis

If your request is based on pre-contractual measures or an existing contract with us, the legal basis is the fulfillment of the contract and the implementation of pre-contractual measures according to Art. 6 (1) (b) GDPR .

If your request is made independently of contractual or pre-contractual measures, our overriding legitimate interests pursuant to Art. 6 (1) (f) GDPR  constitute the legal basis. The overriding legitimate interest corresponds to the above-mentioned purposes.

6.4 Storage period

We delete your personal data as soon as they are no longer required to achieve the purpose for which they were collected. In the context of contact inquiries, this is generally the case when the circumstances indicate that the specific matter has been conclusively processed.

7. Newsletter

7.1 General information

We offer you the opportunity to receive information about our services. With our newsletter, we inform customers and business partners about our offers at regular intervals.

We process the following personal data within the scope of the newsletter dispatch:

• E-mail address

7.1.1 Newsletter subscription

If you register for the newsletter via our website, we will send a confirmation email in the double opt-in procedure to the email address you entered for the first time for the newsletter dispatch. This confirmation email is used to check whether you, as the owner of the email address, have authorized the receipt of the newsletter. In the process, the registration for the newsletter is logged.

7.1.2 Newsletter dispatch to existing customers

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services, such as those already purchased, from our range by e-mail, provided you have not objected to the sending. In accordance with § 7 (3) UWG, we do not need to obtain your separate consent for this. You can subsequently object to the sending at any time, which we will also point out to you with each sending.

7.1.3 Newsletter tracking

Our newsletters contain so-called tracking pixels. This is a miniature graphic that is embedded in emails. This allows us to track, for example, whether and when an email was opened by you and which links in the email were called up by you. This enables us to statistically evaluate the success or failure of online marketing campaigns. The personal data collected by the tracking pixel is stored and analyzed by us in order to optimize the newsletter dispatch and to better adapt the content of future newsletters to your interests.

7.2 Purpose of the processing

We process your personal data for the following purposes:

• Newsletter dispatch: implementation of marketing measures.
• Double opt-in procedure: Fulfillment of our legal obligations to provide proof.
• Newsletter tracking: display of personalized advertising, market research, performance measurement.

7.3 Legal basis

The legal basis for the processing of your personal data in the context of the:

• Newsletter subscription is your consent according to Art. 6 (1) (a) GDPR ,
• Newsletter dispatch to existing customers is our overriding legitimate interest Art. 6 (1) (f) GDPR ,
• as well as newsletter tracking is your consent according to Art. 6 (1) (a) GDPR .

7.4 Storage period

We delete your personal data as soon as they are no longer required to achieve the purpose for which they were collected. In the context of the newsletter dispatch, this is generally the case when you revoke your consent or you object to the processing.

There is therefore a corresponding opt-out link in every newsletter. In addition, you can also unsubscribe from the newsletter at any time on our website or inform us of this in another way. We automatically interpret an unsubscription from the receipt of the newsletter as a revocation or objection.

7.5 Recipients of personal data

We use the following service providers:

Provider	Address	More information
Mailerlite	Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland	Privacy Policy mailerlite.com/gdpr-compliance

8. Social Networks

8.1 General information

We maintain presences in social networks in order to be able to communicate with you and inform you about our services.

We would like to point out that your data may be processed outside the European Union or the European Economic Area. In particular, there is a risk here that supervisory authorities may have access to your personal data. In addition, your data subject rights may be more difficult to enforce.

Through the use of social media, the following user data is usually processed: Inventory data (e.g., first and last name, address, age, gender), content data (e.g., texts, photographs, videos), usage data (e.g., visits to websites, interests), metadata (e.g., device information, IP address).

This user data is often processed in social networks for advertising purposes or to analyze user behavior by the providers, without us being able to influence this. In addition, the providers often create usage profiles, on the basis of which user-based advertising can subsequently be placed inside and outside the social network. For this purpose, cookies are often used or the usage behavior is directly assigned to your own member profile of the social networks (if you are logged in here). In addition, we use the user data to communicate with you via the social medium and to provide you with information.

Since we do not have access to the databases of the respective providers, we would like to point out that it is best to assert your rights directly with the respective provider. However, if you require assistance, please feel free to contact us. Further information on the processing of your data in social networks and the possibility of exercising your right of objection or revocation (opt-out) are listed below.

8.2 Purpose of the processing

The purpose of the processing is the maintenance of presences in social media.

8.3 Legal basis

The legal basis for the processing of personal data is our overriding legitimate interest pursuant to Art. 6 (1) (f) GDPR . The overriding legitimate interest corresponds to the above-mentioned purposes.

8.4 Recipients of personal data

We maintain presences in the following social media:

Social Network	Provider	Third country	Suitable guarantee	More information
LinkedIn	LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland	USA	Standard Contractual Clauses	Privacy Policy Opt-out possibility Joint Controller Addendum
Twitter	Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Irland	USA	Standard Contractual Clauses	Privacy Policy
Discord Inc.	De Haro Street #200 San Francisco, CA 94107, USA	USA	Standard Contractual Clauses	Privacy Policy

9. Your rights

9.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data relating to you is being processed.

9.2 Information (Art. 15 GDPR)

You have the right to receive information from us at any time and free of charge about the personal data stored about you as well as a copy of this data in accordance with the statutory provisions.

9.3 Rectification  (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you. You also have the right to request that incomplete personal data be completed, taking into account the purposes of the processing.

9.4 Erasure (Art. 17 GDPR)

You have the right to demand that we erasure the personal data concerning you without delay if one of the reasons provided for by law applies and insofar as the processing or storage is not necessary.

9.5 Restriction of processing (Art. 18 GDPR)

You have the right to demand that we restrict processing if one of the legal requirements is met.

9.6 Data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format. Furthermore, you have the right to transfer this data to another controller without hindrance from us, to whom the personal data has been provided, provided that the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the processing is carried out with the aid of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

In addition, when exercising your right to data portability pursuant to Article 20 (1) GDPR, you have the right to have the personal data transferred directly from one controller to another controller, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of other individuals.

9.7 Objection (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of data processing in the public interest pursuant to Article 6 (1) (e) GDPR or on the basis of our legitimate interest pursuant to Article 6 (1) (f) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

In individual cases, we process personal data in order to carry out direct advertising. You may object to the processing of personal data for the purpose of such advertising at any time. If you object to the processing for direct marketing purposes, we will no longer process the personal data for these purposes.

9.8 Revocation of consent under data protection law

You have the right to revoke your consent to the processing of personal data at any time with effect for the future.

9.9 Complaint to a supervisory authority

You have the right to complain about our processing of personal data to a supervisory authority responsible for data protection.

10. Up-to-dateness and changes of the data protection notice

This data protection notice is currently valid and has the following status: December 2022.

If we continue to develop our website and our offers or if legal or official requirements change, it may be necessary to amend this data protection notice. You can access the current data protection information at any time here.

—