Privacy Policy

General Information

Data Controller

The controller within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection provisions is:

Justaddsugar GmbH

Data Protection Officer (external):
Nelly Born
Tel.: 030 467 240 6-55
Email: n.born@pagestreet.de

Website: www.sugarlens.de

Legal Bases for Processing Personal Data

We process some of your personal data on the basis of the following legal bases:

Consent of the data subject

Where we obtain the consent of the data subject for specific purposes, Art. 6(1)(a) GDPR is the legal basis.

Performance of contractual obligations

Where processing is necessary for the performance of a contract to which you are a party, Art. 6(1)(b) GDPR is the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.

Legal requirements and obligations

Where processing is necessary to comply with a legal obligation, Art. 6(1)(c) GDPR is the legal basis.

Protection of legitimate interests

Where processing is necessary to protect our legitimate interests or those of a third party, and your interests, fundamental rights and freedoms do not override the former interest, Art. 6(1)(f) GDPR is the legal basis.

Storage Period and Deletion of Personal Data

Personal data is deleted or blocked as soon as no purpose continues to provide a legal basis for the processing.

Recipients of Personal Data

Internally, only those departments process personal data that need it to fulfil their processing purposes. This also applies to the processors, service providers and vicarious agents engaged by us. All bodies and persons working with personal data are obliged to maintain data secrecy and have been instructed to handle such data sensitively.

Personal data is only disclosed to third parties where this is in compliance with data protection regulations. In particular, persons engaged to conduct our business operations (e.g. banks, tax advisors, providers of EDP and IT services) as well as state bodies/authorities may receive your personal data where this is necessary to fulfil a legal obligation.

Data Processing in Third Countries

Our services may require the processing of personal data in countries outside the EU/EEA (“third countries”) by our processors. Where personal data is processed and no level of data protection corresponding to the European standard exists in the country — as confirmed by an adequacy decision of the EU Commission pursuant to Art. 45(3) GDPR — we have concluded EU Standard Contractual Clauses with the relevant processors in order to establish appropriate safeguards within the meaning of Art. 46 GDPR. A copy of the EU Standard Contractual Clauses can be found here. Where third-country processing takes place, we indicate this below.

Data Subject Rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller:

Right of access

Pursuant to Art. 15 GDPR you have the right to request information about the personal data we process. In particular, you may request information about:

• the purposes of processing,
• the category of data,
• the categories of recipients to whom your data has been or will be disclosed, as well as information on whether the personal data is transferred to a third country or to an international organisation (in this context you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR),
• the planned storage period,
• the existence of a right to rectification, erasure, restriction of processing or objection,
• the existence of a right to lodge a complaint, and the origin of your data where it was not collected by us,
• as well as the existence of automated decision-making including profiling pursuant to Art. 22(1) and (4) GDPR and — at least in these cases — meaningful information about the logic involved as well as the scope and intended effects of such processing for the data subject.

Right to rectification

Pursuant to Art. 16 GDPR you have the right to the rectification and/or completion of your personal data where it is inaccurate or incomplete. We must carry out the rectification without undue delay.

Right to restriction of processing

Pursuant to Art. 18 GDPR you have the right to request the restriction of the processing of your data, in particular where you contest the accuracy of the data or the processing is unlawful. Where processing has been restricted, you will be informed by us before the restriction is lifted.

Right to erasure

Pursuant to Art. 17 GDPR you have the right to the erasure of your personal data, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

Right to notification

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data was disclosed of the rectification, erasure of the personal data or restriction of processing, unless this proves impossible or involves disproportionate effort.

Right to data portability

Pursuant to Art. 20 GDPR you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.

Right to object

Pursuant to Art. 21 GDPR you have the right to object to the processing where the processing is based on Art. 6(1)(e) or (f) GDPR.

Right to withdraw the data protection consent declaration

Pursuant to Art. 7(3) GDPR you have the right to withdraw your data protection consent declaration at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.

Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

Supplementary Information on Data Processing When Visiting Our Website

We are responsible for our website www.sugarlens.de and its sub-pages (the “website”). Personal data is processed through the use of our website. Below we provide detailed information about the processing that takes place.

Provision of the Website and Creation of Log Files

When our website is accessed, we automatically collect data and information from the user’s device (so-called log files).

Information & duration of processing

The following information is processed when the website is visited:

• information about the browser type and version used
• the operating system of the device
• referrer URL
• date and time of the server request
• IP address (anonymised after 24 h)
• website visited
• amount of data in bytes
• access log files
• error log files

The log files are deleted within two days at the latest.

Purpose of processing & legal basis

The data is required to display the website on the user’s device, to ensure its functionality, and to analyse any malfunctions. The data also serves to optimise the website and to ensure the security of our information technology systems.

The legal basis is Art. 6(1)(f) GDPR. The collection of log files is strictly necessary for the operation of the website. There is consequently no option for the user to object.

Processor

To provide our website we use the service of Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Germany, with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf.

Cookies and Local Storage

Cookies

We do not use any cookies on our website.

Local storage

To provide the website we use exclusively technically necessary information in the local storage of your browser: login and session data (only in the logged-in area), language setting, interface settings, and your consent decision. This information is strictly necessary for the operation of the website and is stored without consent pursuant to Sec. 25(2)(2) TDDDG. Any processing of personal data is based on Art. 6(1)(f) GDPR. The duration of storage depends on when you delete the data stored in local storage.

Optional services

Via our consent banner you can agree to optional services (e.g. statistics/analytics). Such services are currently not active. Should we use such a service in the future, this will only happen after your express consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG; this privacy policy will then be supplemented accordingly. You can withdraw your consent at any time via “Cookie settings” in the footer.

Demo Request Form

When you request a demo via our form, we process your name, your email address, your company name, and an optional message exclusively to handle your request. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. The data is deleted as soon as your request has been conclusively handled.

Supplementary Information on the Use of Our sugarLENS Platform

The following information applies to the processing of personal data when using the sugarLENS platform.

Data Processing During Registration

When registering on our platform, the following personal data is processed:

• Name
• Email address

Data Processing When Using the Platform

When using the customer portal, the following data may be processed:

• Name
• Email address
• User ID
• Usage metadata (timestamps, session data, requests)
• Asset metadata and creator data

AI Assistant (“sugarChat”)

When using sugarChat, the following data is processed and stored:

• Chat history: your inputs (messages/prompts) and the assistant’s responses are stored in order to continue the conversation and to make your chat history available to you.
• Document uploads: files you upload (e.g. PDF, DOCX, PPTX, TXT, CSV, JSON, MD), the text extracted from them, and any generated summaries are stored so that the assistant can respond on the basis of the content.
• Context/notes: notes about your preferences saved by the assistant, as well as shared team knowledge.

This content is assigned exclusively to you or to authorised users and is protected by access restrictions (row-level security). Chat histories and uploaded documents are stored until you delete the respective conversation or file, or until your user account is terminated.

Purposes, Legal Basis and Duration of Processing

The data is processed for the proper performance of the contract in order to provide and use the platform. The legal basis is Art. 6(1)(b) GDPR. The data is deleted upon termination of the contractual relationship, insofar as no other purposes for its processing remain.

Processors

To provide the platform we use the services of the following processors, with each of whom we have concluded a data processing agreement:

• Database, authentication and file storage: Supabase (Supabase Inc.); data held in the EU (Frankfurt am Main region). As Supabase is based in the USA, we have concluded the EU Standard Contractual Clauses with them.
• Application hosting and runtime environment (backend): Railway (Railway Corp.); hosting in the EU (EU-West region, Amsterdam, Netherlands). As Railway is based in the USA, an adequacy decision of the EU Commission applies to this company, which is certified under the Data Privacy Framework.
• Hosting of the web interface (frontend): Vercel (Vercel Inc.); delivery via data centres in the EU (Frankfurt am Main and Stockholm). As Vercel is based in the USA, an adequacy decision of the EU Commission applies to this company, which is certified under the Data Privacy Framework.
• AI application (analysis of creatives and creators, the integrated assistant “sugarChat”, generation of text embeddings for semantic search): Google Vertex AI / Gemini, Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland; configured for the EU (Europe-West4 region or EU multi-region). If the European configuration is unavailable, a similar provider may be used as a substitute. This provider is also hosted in the EU.

Supplementary Information on Communication With Us

The following information applies to any communication with us. Where the communication takes place within a contractual relationship or another contractual connection, the data processing is also governed by the supplementary information under 5.

Telephone

You can contact us by telephone.

Information processed & duration of processing

In addition to your telephone number, we process the personal data that you provide to us during the call. The data is deleted — unless there is another reason for the processing — as soon as the matter has been resolved with you.

Purpose of processing & legal basis

The personal data is processed by us exclusively for the purpose of handling the enquiry and in case of follow-up questions. Where the communication is aimed at concluding a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not override our interest in responding to your enquiry; since you are contacting us, a response is also in your interest and you are aware that we must process your personal data in order to respond to your enquiry.

Email

You can contact us via email. We would like to point out that there are possibilities for third parties to gain insight into email communication. If it is important to you that the information you provide is not exposed to the risk of unlawful third-party access, we therefore recommend another means of communication. However, if you contact us via email, we assume that the further exchange via this communication channel is also in your interest.

Processor

As an email service provider we use the service “Google Workspace” of Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland, as our processor, with whom we have concluded a data processing agreement.

Information processed & duration of processing

In addition to your email address, we process the personal data that you make available to us within the email communication. The data is deleted — unless there is another reason for the processing — as soon as the matter has been resolved with you.

Purpose of processing & legal basis

The personal data is processed by us exclusively for the purpose of handling the enquiry and in case of follow-up questions. Where the communication is aimed at concluding a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not override our interest in responding to your enquiry; since you are contacting us, a response is also in your interest and you are aware that we must process your personal data in order to respond to your enquiry.

Video Telephony

We also use video telephony for communication.

Processor

To carry out video telephony we use the service “Google Meet” of Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland, with whom we have concluded a data processing agreement. The processor may process personal data in the USA in order to ensure smooth video telephony. The processor has therefore concluded the EU Standard Contractual Clauses with its sub-processors in order to establish appropriate safeguards within the meaning of Art. 46 GDPR.

Information processed & duration of processing

During video telephony the following communication data is processed:

• master personal data (if you provide it of your own accord)
• contents of the online meeting (if you appear in a personally identifiable manner with contributions in spoken and/or written form)
• authentication data
• log files, protocol data
• metadata (e.g. IP address, time of participation, etc.)
• profile data (e.g. your username, if you provide it of your own accord)

The personal data is deleted as soon as the matter has been resolved with you and provided there is no other reason for the processing.

Purpose of processing & legal basis

The personal data is processed by us exclusively for the purpose of handling the enquiry and in case of follow-up questions. Where the communication is aimed at concluding a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not override our interest in responding to your enquiry; since you are contacting us, a response is also in your interest and you are aware that we must process your personal data in order to respond to your enquiry.

Supplementary Information for Contractual Partners (incl. Creators)

In addition, the following information applies to you where we are in a contractual relationship with one another (incl. creators).

Information Processed & Duration of Processing

Which data is processed in detail depends on the tasks within the contractual relationship. We use the personal information exclusively for the purpose for which it was provided to us. This includes, for example, personal particulars (name, address and other contact details, date and place of birth). In addition, this may also include order data (e.g. payment order), data from the performance of our contractual obligations (e.g. turnover data in payment transactions), information about your financial situation (e.g. creditworthiness data), advertising and sales data, as well as other data comparable to the categories mentioned.

If you are a creator, we process your performance data on the booked services for the purpose of analysis and statistics.

The personal data is deleted as soon as the contractual relationship with you has ended and provided there is no other reason for the processing.

Purpose, Legal Basis and Duration of Processing

The processing is carried out predominantly for the purpose of establishing and performing the contractual relationship; the legal basis is Art. 6(1)(b) GDPR.

In addition, we also process your data in part on the basis of our overriding legitimate interest, namely for the purpose of contact and communication management, profitability controls, contract and project management, and to ensure the operation of information and telecommunications systems. The legal basis is Art. 6(1)(f) GDPR.

Furthermore, as a company we are bound by various legal obligations that must be complied with on the basis of applicable laws and regulations. The legal basis for processing to comply with legal requirements and obligations is Art. 6(1)(c) GDPR. These include, among other things, tax retention obligations.

Recipients

If you are active for us as a creator, we forward your data — including the analysis of performance data on the booked services — to the respective advertising client for the purpose of performing the contract.

Processors

If you are active for us as a creator, your performance data on the booked services is processed via the Vertex service of Google Ireland Ltd., Gordon House, Barrow Street, D04 Dublin E5W5, Ireland, with whom we have concluded a data processing agreement.

— End of the data protection information —