Privacy Policy

1. Controller

Justin Tückmantel
Am Stationsgarten 43
42327 Wuppertal
Tel.: +49 176 84704318
E-Mail: kontakt@netbaseos.de

2. Data collected

When using NetBaseOS, the following personal data is processed:

• Name and email address (on registration)
• Requested new sign-in address: if you change your account's email address, we store the address you requested temporarily until you have confirmed it via the confirmation link. It then replaces the previous address and the interim record is deleted; if you do not confirm, the previous address remains the operative one (details in section 24)
• Google profile data (when signing in via Google OAuth)
• Usage data (onboarding progress, journey status, gamification points and the status of the setup guidance emails – all that is stored is which stage of that series was last sent to you and whether the one-off reminder about an unfinished setup wizard has already been sent, see section 24)
• The time of your last activity in the signed-in area – only the most recent time is stored and it is overwritten as you continue to use the service; no history is created (details in section 12)
• The date of your last sign-in – maintained by our authentication service (section 5) and overwritten with every sign-in; no history of earlier sign-ins is created (details in section 12)
• Which areas of the application you opened on which day – only the area, the date, your plan status and the number of visits; no addresses, times of day or content (details in section 29)
• Contact and partner data you enter (incl. optional date of birth for birthday reminders), as well as reminders you note about a partner in your network – a time and a title you assign yourself (details in section 16)
• Contact/interaction history you keep about your contacts and customers (time of contact, type of contact – e.g. call, meeting, message – and free-text notes you record)
• Additional details about your customers that you define yourself (“additional profiles”, e.g. details about a customer’s pets) – you alone decide which fields exist and what goes into them; they are not intended for health data or other special categories under Art. 9 GDPR (DPA clause 13)
• Names of people from your circle that you record in the name list (“contact game”) – solely the name and the category of the question that brought it to mind; no contact details, no notes and no assessment (details in section 25)
• Where two-factor sign-in is enabled: the secret key generated for your authenticator app during setup (TOTP) and the status and time of setup – stored with our authentication provider Supabase (servers in the EU); the factor is removed when you turn it off
• Telegram chat ID (on voluntary bot linking)
• For assistant accesses (Enterprise plan only): name and email address of the invited person, their login credentials, the times of invitation and acceptance, the status of the access, the reminder settings and any unsubscription, where applicable their Telegram chat ID, the marking of entries they create and the log of their actions in the account (“team activity”; details in section 27)
• Phone PIN for phone support (Enterprise plan only): a six-digit random number that identifies you as the caller – stored separately from your profile, it is not a password and does not grant access to your account (details in section 21)
• IP address and technical connection data
• Customer type (consumer or business) – only for paid subscriptions, for the lawful handling of withdrawal and tax obligations (§ 13/§ 14 BGB)
• When using the separately enabled add-on module NetBaseChat: the credentials of the channel you connect and the messages of your contacts exchanged via that channel; where an Instagram business account is connected, additionally the comments others make under your posts (the content of the comment, the identifiers Instagram assigns to the comment and to the post, and the identifier and username of its author); if you add such a contact to your contact management, a prospect entry is additionally created (details in section 23)
• Proof of consent on registration and on each renewed confirmation of amended Terms: time and version of the accepted Terms (incl. DPA) and Privacy Policy, as well as the IP address and browser identifier (user agent) at the time of consent – to comply with the accountability obligation under Art. 5(2) GDPR
• Proof of your confirmation of a paid change to your subscription in the app (switch to a higher plan or to annual billing, booking of a further year): time, type of change, billing interval, the amount or price shown to you, the confirmation of the Terms and the cancellation policy, as well as IP address and browser identifier (user agent) – as proof of the contract change (Art. 6(1)(b) and (f) GDPR); deleted together with your account unless a statutory retention obligation applies
• Proof of consent given or withdrawn for promotional emails: the time, whether given or withdrawn, the consent text shown to you including its version, where it was declared (e.g. registration, settings, the prompt inside the application or the unsubscribe link in an email), and the IP address and browser identifier (user agent) – as proof under Art. 7(1) GDPR and § 7(2) UWG (details in section 24)
• If you use your own short privacy notice below a contact form on your public pages: a log of every change to this text (page or form, the wording set or the return to the default text, time, and the account through which the change was made) – details in section 15
• If you use the advertising settings: the pixel IDs stored for your account (Meta, TikTok, Google); from the Team plan additionally the ID of your Meta pixel for the Conversions API, the access token you generated at Meta (stored server-side only, never output to a browser), an optional Meta test code and the status of the last transmission to Meta (time, success or error message); the campaign links you name with their daily view totals; and – if you have connected your own domain – the code for domain verification with Meta (details in section 20)

3. Purpose of processing

The data is used solely to provide the NetBaseOS platform: authentication, management of your team and onboarding journeys, and improvement of the service.

4. Legal basis

Processing is based on Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in the secure and functional provision of the service). The logging of your consent to the Terms, DPA and Privacy Policy (time, version, IP, user agent) is based on Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR (fulfilment of our documentation and accountability obligations) and on our legitimate interest in tamper-evident documentation of the conclusion of the contract (Art. 6(1)(f) GDPR).

5. Third-party providers

6. Storage period

Your data is generally stored for as long as your account exists – for accounts without a paid plan that you do not sign in to over a long period, the 24-month limit described below applies in addition. After account deletion, all personal data is deleted within 30 days. Excepted from this are data that we are required to retain due to statutory retention obligations (in particular § 147 AO, § 257 HGB) or for the establishment, exercise or defence of legal claims (Art. 17(3)(b) and (e) GDPR) – such as billing and tax-relevant records of the affiliate programme (see section 13). Additional, shorter and automatically enforced deletion periods apply to the NetBaseChat add-on module (see section 23).

Shorter period for funnel pages: if your account moves to a plan without a funnel – for example after a free trial period expires or after a paid subscription ends – your funnel pages are first switched off and, if you do not return to a plan that includes a funnel within seven days, they are permanently deleted together with all content and images stored on them. We notify you of this period separately in advance by email and by in-app notification. Leads already captured are not affected. Your landing pages, presentations and additional profile pages are not deleted immediately in this case; at first they are merely no longer served publicly – the twelve-month period described in the following paragraph applies to them. Your main profile page remains online unchanged. A custom domain that has been set up is disconnected from the page concerned and removed at our hosting provider.

Shorter period when the NetBaseChat add-on ends: If the add-on module ends – because you end it, because your account moves to a plan below Team, or because your subscription ends – the channels you connected are disconnected without delay and the associated access credentials are deleted; from that moment no further messages are received. The conversations, messages and contacts already stored are automatically and permanently deleted seven days later. If you book the module again within those seven days, the deletion does not take place. Contacts you previously transferred to your contact management as a lead or customer remain there; the consent record is likewise retained because of the statutory duty of proof (§ 7a UWG). Purpose and basis of the period: personal data – here also messages of third parties – may not be stored longer than is necessary for the purpose (Art. 5(1)(e) GDPR).

Upper limit for switched-off landing pages, presentations and additional profile pages: we do not store switched-off pages indefinitely. A presentation (“business presentation”) is a landing page in a different display form; everything stated in this privacy policy about landing pages applies equally to presentations. If your account remains on the free plan, your switched-off landing pages, presentations and additional profile pages are automatically and permanently deleted twelve months after they were switched off, together with all texts and images stored on them. We notify you of this separately 14 days before the deletion, by email and by in-app notification. If you move back to a paid plan before the twelve months have elapsed, this deletion period no longer applies; the pages then remain stored – they do, however, stay switched off until you put them back online yourself. Your first (main) profile page is never affected by this period; leads already captured are likewise unaffected. Purpose and basis of the period: personal content must not be stored for longer than is necessary for the purpose (Art. 5(1)(e) GDPR).

Upper limit for unused accounts without a paid plan: we do not keep an account itself indefinitely either. If you do not sign in to NetBaseOS for 24 months and there is no paid subscription for your account during that time, your account is deleted automatically and permanently, together with all data stored in it – including the data you have recorded about other people (contacts, prospects, partners, name list), your notes, your funnel, landing and profile pages and any custom domain you have set up. What counts is the time of your last sign-in; for accounts that have never been signed in to, the time of registration. This does not happen without warning: after 22 months without a sign-in you receive a first announcement and, 14 days before the deletion, a final one – each by email to your account address and by in-app notification. A single sign-in is enough to avert the deletion; the period then starts over. As long as the final announcement has not demonstrably been sent and is not at least 14 days old, an account is technically not deleted. Not covered are accounts on a paid plan (Premium, Team, Enterprise) – including those whose premium access is provided through an enterprise partner –, accounts for which an active subscription still exists with our payment provider, and accounts with an outstanding commission claim under the affiliate programme; these remain regardless of when you last signed in. The deletion itself follows the same rules as a deletion initiated by you, including the exceptions for statutory retention obligations and for evidentiary purposes mentioned above and below. Purpose and basis of the period: personal data must not be stored for longer than is necessary for the purpose (Art. 5(1)(e) GDPR) – which matters here in particular because an account that is no longer used also holds data of people who are unaware of it.

Unconfirmed registrations: if you do not confirm your email address after registering, we delete the not-yet-activated account automatically and in full seven days after registration; after five days we send you the confirmation email once again beforehand. We inform you about the deletion by email – also because an address that was never confirmed may belong to a third party who knows nothing about the registration. Basis: a registration that is not confirmed does not justify any further storage (Art. 5(1)(e) GDPR).

Notifications in the application: we do not keep the notices shown to you in NetBaseOS via the bell icon indefinitely. A notice you have read is deleted automatically 90 days after it was created, an unread one after 365 days – longer when unread, because such a message has not yet reached you. You can delete individual notices, or all of them at once, yourself at any time. These periods are upper limits, not minimum retention periods. This does not affect messages we additionally send you by email; records we keep separately – for example of your consent to the contractual texts, of orders and payments, or of the dispatch of announced deletion deadlines – do not depend on these notices. Purpose and basis of the period: personal data must not be stored for longer than is necessary for the purpose (Art. 5(1)(e) GDPR).

Also excepted from the 30-day deletion is the proof of consent to the Terms (incl. DPA) and Privacy Policy (time, version, IP address and browser identifier – see section 2). We retain this even after account deletion for evidentiary purposes, in order to be able to prove, in the event of a dispute, which version of the contract you consented to and when. The legal basis is our legitimate interest in tamper-evident documentation of the conclusion of the contract and the establishment, exercise and defence of legal claims (Art. 6(1)(f), Art. 17(3)(e) GDPR). Retention only takes place for as long as corresponding claims can exist, as a rule up to 3 years after the end of the contractual relationship (expiry of the standard limitation period, §§ 195, 199 BGB).

7. Your rights

You have the right at any time to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

Right to object in detail (Art. 21 GDPR). Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to that processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If your objection concerns direct marketing, it applies unconditionally: we stop the processing for that purpose without any balancing (Art. 21(2) and (3) GDPR). An objection is possible informally and free of charge; a message to kontakt@netbaseos.de is sufficient. For the weekly summary and the setup guidance by email (section 24, number 2), the unsubscribe link in the message concerned or the switch in your account settings is also sufficient. The legal basis on which a processing operation is based is stated in this policy at the respective processing operation.

To exercise your rights, contact: kontakt@netbaseos.de

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information NRW (ldi.nrw.de).

9. Cookies

NetBaseOS itself mainly uses strictly necessary or functional cookies. On our own platform pages we do not use behavioural advertising or analytics cookies and no cookies from ad networks. Our reach and conversion measurement (Vercel Web Analytics, see section 5) is cookieless. On the platform itself we do not set any cookies or use any technologies that would require consent under § 25(1) TDDDG; therefore no cookie consent banner is used here. In addition, we set a functional first-party cookie for affiliate attribution (nb_aff, together with a similar companion cookie nb_aff_src for purely internal source/success statistics, details below) when you arrive via an affiliate referral link; it serves solely to fairly attribute your referral to the referring person, contains only the referral code and is not used for advertising or cross-site tracking (details below). Necessary cookies (login, language, security) are used regardless. Note: on the (paid) funnel pages and landing pages of individual users – including under their own domain – marketing pixels (Meta, TikTok, Google) activated by the respective page owner may – only after separate consent via the banner there – set cookies or comparable technologies; the page owner is responsible for this (details in section 20).

Since NetBaseOS does not set any consent-requiring cookies or use such technologies on the platform itself, no cookie consent banner is necessary. You can remove the functional affiliate cookies (nb_aff and nb_aff_src) yourself at any time by deleting the cookies stored for netbaseos.de in your browser; you also have the right to object under Art. 21 GDPR (see section 7).

10. Cooperations and partner offers

In the “Recommendations” area, NetBaseOS shows curated offers from cooperation partners (e.g. coaching, courses, tools). This content is clearly marked as “Cooperation”.

11. Telegram bot

NetBaseOS offers an optional Telegram bot. Use is voluntary. When linking your Telegram account, the following data is processed:

• Telegram chat ID (for unique identification)
• Text messages sent via the bot (for forwarding to your sponsor)
• Journey progress (steps you complete via the bot)
• Birth dates of your partners and customers (if entered), to send automatic birthday reminders – likewise anniversaries from date fields of your additional profiles for which you have switched on the reminder (the message then contains the entry's label, e.g. a pet's name, the customer's name and the field label)

This data is used solely to provide the bot functions (journey step delivery, daily summaries, mindset impulses, weekly reports, birthday reminders, follow-up reminders). Messages you send via the bot are forwarded to your sponsor and stored in your NetBaseOS database.

Personal messages from your upline: If your Telegram account is linked, your direct upline (your sponsor) can send you personal text messages via the bot for support within the network. The legal basis is our legitimate interest in cooperation within the existing network relationship (Art. 6(1)(f) GDPR). You can disable these personal messages at any time via the "Free messages from your upline" switch in the Telegram settings; you will then no longer receive such messages.

The link to Telegram can be removed at any time in the settings at netbaseos.de/settings. Your chat ID is then deleted from our database.

Assistant access. A person with assistant access to an account (section 27) can connect the bot to their own Telegram account via their “My access” page. Their chat ID is then stored with the assistant access – not in the account holder’s profile – and used exclusively for the reminders the account holder has switched on for them; they do not receive journey steps, summaries or other bot functions. How they can end these reminders and have their chat ID deleted is described in section 27.

Note: Telegram is a service of Telegram FZ-LLC. Telegram's own privacy policy applies to its data processing (telegram.org/privacy).

12. Admin access and data separation

As the platform operator, the controller has limited technical access to user accounts. The admin can view the following account metadata: name, email address, plan status, registration date, sponsor code, account status, the date of your last sign-in and the time of your last activity in the signed-in area (following paragraphs).

Who works in the admin area. In addition to the owner (section 1), employees and other persons working for him whom he has engaged may work in the admin area – for example in support, in moderating public content or in looking after the affiliate programme. Each of these persons receives only the rights their task requires, for example only for support requests (section 21), only for the account data listed here or only for the data of the affiliate programme (section 13). Depending on the rights granted, the detail view of an account also shows, in addition to the information listed above: the contract and payment history (plan changes, payment notices, acceptance of the terms and marketing consents), the titles of your support requests, requests to change your upline, the name and email address of assistant accesses you have set up, and the number of your contacts – not their names or content. These persons are bound to confidentiality and may process the data only on the owner's instructions (Art. 29, Art. 32(4) GDPR); they are not third parties to whom we disclose your data. The same limits apply to them as to the owner: they too have no access to the user content data listed below. Changing plans and terms, deleting accounts, resetting security features and payouts remain reserved to the owner. Access to the admin area requires two-factor sign-in for every person. The purposes and legal bases are the same as for the respective processing (sections 4, 13 and 21).

Last-activity indicator in the admin area: The user overview in the admin area shows whether an account was active in the signed-in area within the last 24 hours. It is not a presence or online indicator: it does not show whether you are using the application right now. For this purpose we store only the time of your last activity in your profile. That value is overwritten as you continue to use the service – so only the most recent time is ever stored. No history is created: we store neither earlier times nor sign-in or session durations, nor which pages you visited (the day-by-day statistics of used areas under section 29 are separate from this); in addition, the time is updated at most every 30 minutes and is therefore deliberately no more precise than half an hour. The user overview itself shows no time, only a marker; the approximate interval in hours is shown there merely as a short hint on that marker. The indicator is visible only within the admin area, and there only to the controller and to persons holding an admin role that has been granted the user panel – not to other users and in particular not to your sponsor, your upline or your team. Its sole purpose is support (assessing, in relation to an ongoing request, whether and when a reply will reach you in the application) and technical troubleshooting. No assessment of your working or usage behaviour, no performance or attendance monitoring, no evaluation, no ranking and no automated decision within the meaning of Art. 22 GDPR takes place, nor is any of that possible on the basis of this value. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in effective support and in the trouble-free operation of the platform). You may object to this processing at any time under Art. 21 GDPR (see section 7). The value is deleted together with your account (section 6).

Date of your last sign-in: When the controller opens an individual account in the admin area, the date of your last sign-in is also shown there – without a time of day. The moment itself is maintained by our authentication service in any case (section 5); it is overwritten with every sign-in, and no history of earlier sign-ins is created. The time of day is already truncated in the database and never reaches the display; working hours, session durations or pages visited cannot be derived from it. The value does not appear in the user list, only in the detail view of a single account, and it is visible solely within the admin area – and there only to the controller and to persons holding an admin role that has been granted the user panel, not to other users and in particular not to your sponsor, your upline or your team. Its purposes are support, handling enquiries about plan and billing, and the retention period for unused accounts (section 6), which is tied to your last sign-in anyway. No assessment of your working or usage behaviour, no performance or attendance monitoring, no evaluation and no ranking takes place. The only automated consequence tied to your last sign-in is the deletion of unused accounts after 24 months described in section 6; it is governed conclusively there and is never triggered without two prior announcements. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in effective support and in the trouble-free operation of the platform); for the retention period additionally Art. 5(1)(e) GDPR. You may object to this processing at any time under Art. 21 GDPR (see section 7). The value is deleted together with your account (section 6).

For the moderation of public content, the admin can additionally view an overview of the public pages operated by users: the type of page (public profile page, funnel page or landing page), its address, its internal name, its publication status, any custom domain and the creation date, as well as the associated account. This is necessary in order to assign and handle reports about illegal content and, where required, to block a page (Art. 16 of Regulation (EU) 2022/2065 – DSA). Legal basis: Art. 6(1)(c) GDPR (compliance with this legal obligation) and Art. 6(1)(f) GDPR (legitimate interest in operating the platform lawfully).

The admin has no access to user content data: contacts, partners, leads, the name list from the contact game (section 25), notes, conversation histories, events, onboarding journeys, Telegram messages, direct messages and received comments from NetBaseChat (section 23) or AI analyses. These tables are technically protected from admin queries by Row-Level Security (RLS). Uploaded image files – for example the image of a public page or an image in an onboarding step – are not held in these tables: they are stored in our file storage and can be retrieved via their randomly generated, unpublished address; RLS does not cover them (see sections 15 and 16).

All admin actions are logged automatically. It is also recorded who opened the detail view of your account or an area of the admin area containing personal data, and when (time, acting person, account or area concerned). This serves to control access and to demonstrate data security (Art. 5(2), Art. 32 GDPR; legal basis: Art. 6(1)(c) and (f) GDPR). The entries generally also store the IP address and a short description of the device used by the acting person. Storage period: the IP address and device information are removed after 90 days; entries on views of and sign-ins to the admin area are deleted automatically after 12 months, all other entries (changes) after 24 months. Details on data separation and the data processing agreement (DPA) under Art. 28 GDPR are available at netbaseos.de/trust and netbaseos.de/avv.

13. Affiliate program (participation as a referrer)

If you take part in the affiliate program to refer other users and receive commissions, additional personal data is processed for contract handling and to meet tax obligations:

• Legal name or company name and address
• Tax status (small business or standard-rated) and tax number or VAT ID
• Payout details (e.g. PayPal address or IBAN)
• Commission and referral data (attributed referrals, amounts, reversals)
• Information on your commission tier (tier reached, number of active customers, monthly determination)
• Record of your acceptances of the participation terms (time and version)
• Credit notes issued (billing documents under the credit-note procedure)

Purpose: handling your affiliate participation and paying out commissions, as well as meeting commercial and tax-law obligations (billing under the credit-note procedure pursuant to § 14(2) UStG). Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation).

Storage period: billing and tax-relevant documents (in particular credit notes) are stored for up to 10 years due to statutory retention obligations (§ 147 AO, § 257 HGB). Notwithstanding the 30-day deletion rule in section 6, these documents are retained even after account deletion for the duration of the statutory retention period.

Commission tiers and second level: Your commission tier depends on the number of your active customers (section 3 of the participation terms). To determine it, at the beginning of each calendar month we store a count for your affiliate account: the number of your active customers, the tier before and after the determination, and the number of months below the threshold. These monthly figures serve solely the traceable determination of your tier and are at the same time your evidence vis-à-vis us; they contain no information on individual customers. If a person you referred takes part in the affiliate programme themselves, an additional second-level remuneration may arise for you (section 3a). For this, you are shown exclusively the key data of the respective commission (date, plan tier, amount, marked as "second level") – without names or contact details of that person's customers and without any further information about their business activity. Legal basis: Art. 6(1)(b) GDPR (performance of the affiliate contract).

Performance measurement of your referral links (click and registration statistics): To show you – and internally the operator – the success of your referral links, we count server-side and purely in aggregate how often a referral link with your referral code was opened and how many registrations resulted from it – in each case as a total value incremented per referral code and calendar day. This counting takes place without any personal reference: no IP address, no visitor identifier and no other personal data of the clicking persons are stored; no cross-site or cross-device tracking and no profiling take place. Only anonymous totals (clicks, registrations and the conversion rate derived from them) are displayed – to you in the affiliate area and to the operator in the admin area; they are not shared with third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a data-minimising, anonymous performance measurement of the referral programme).

Display of your name to your referrer (only with your consent): If you register via an affiliate's personal referral link, you may voluntarily and separately consent, during registration, to your first and last name being shown to the person who referred you (your referrer) in their affiliate/referral area, so that they can attribute their successful referral to you. This consent is not a precondition for registering or using NetBaseOS; the corresponding checkbox is not pre-ticked. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future – via the corresponding toggle in your settings; the lawfulness of processing carried out up to the withdrawal remains unaffected. After a withdrawal, your name is no longer shown to the referrer. If you do not give the consent or withdraw it, the referrer receives only anonymised information about your referral (a running identifier such as "Customer #N", the date, the plan tier and the resulting commission) – without your name or any other information identifying you.

Trial extension by your referrer ("trial boost"): If you register via an affiliate's referral link, during your first 14 days after registration (free trial) they may grant you, once, an additional free extension of your Premium trial by seven days. For this purpose, throughout these first 14 days, the person who referred you sees in their affiliate area – in addition to the information mentioned above – your trial status: the days remaining of your first 14 days, the expiry date of an active Premium phase, and an indication of whether an extension has already been granted or whether you have already taken out a paid subscription. As described above, this information is shown without your name (only as "Customer #N") unless you have consented to your name being displayed. If the referrer triggers the extension, NetBaseOS extends your Premium trial accordingly; the cost is borne by NetBaseOS. This does not create a paid subscription and no automatically renewing subscription – once the trial ends, your account automatically reverts to the free version with no payment obligation. To administer this feature (including compliance with the limit of once per person and no more than three persons per calendar month and affiliate), we store which referred user was granted such an extension, when and by which affiliate. Legal basis: Art. 6(1)(b) GDPR (provision of the free trial you use) and Art. 6(1)(f) GDPR (legitimate interest of the operator and the affiliate in acquiring new users for the referral programme).

14. External links to third-party services

In some places in the application you can open contact details you entered yourself directly – for example by clicking on a stored WhatsApp, Facebook, Instagram or LinkedIn address. These are simple outbound links that open the respective service in a new browser tab.

NetBaseOS does not embed any content, scripts, pixels or SDKs of the respective providers for this and does not transmit any data to these services on its own. Only when you click such a link does your browser establish a direct connection to the target provider; for technical reasons your IP address is transmitted to it in the process. WhatsApp, Facebook and Instagram are services of Meta Platforms Ireland Ltd.; LinkedIn is a service of LinkedIn Ireland Unlimited Company (part of Microsoft Corporation). From the moment you leave our application, the respective provider's privacy policy applies; we have no influence over its processing.

15. Contact form on public profiles, funnel pages and landing pages (lead capture)

NetBaseOS users can provide a public profile page (digital business card) at netbaseos.de/p/… – and, depending on their plan, several such pages, each at its own address. Each of these pages can be designed independently and can contain its own contact form; the controller is always the same person, whose legal notice (imprint) – provided they have completed it in full – is linked on each of their pages. If the legal notice is missing or incomplete, no such link is shown on the page; the legal notice of NetBaseOS does not take its place, because it identifies us as the operator of the platform and not the owner of the page. In that case you can report such a page to us via the reporting option in the page footer or at kontakt@netbaseos.de. The name under which such a page appears may differ from page to page (for example a stage name or a username); the details in the linked legal notice are unaffected by this and identify the controller. The following information therefore applies equally to each individual profile page. On a profile page, a contact form (lead capture) can additionally be embedded. If the profile owner uses the free plan, the form only accepts a limited number of contact requests; once that number is reached, the form is hidden, and a request still submitted at that moment is not stored – you will then see a notice that your request could not be received. If, as a visitor, you enter your details there and submit the form, this data is made available to the respective profile owner as a contact request ("lead"), so that they can get back to you as you requested.

The same applies to a contact form that a user embeds in a landing page they have designed (multi-section marketing page at netbaseos.de/l/…, displayed either as a continuous page or as a presentation with page breaks): there, too, only the details you enter are processed and made available to the respective page owner as a contact request. The following information on data categories, spam prevention, controllership, legal basis and storage period applies equally to all of these forms.

A user can also embed one of their own funnel pages in one of their landing pages. The funnel is then displayed within the landing page in an embedded frame (iframe) and works there exactly as at its own address. Everything you enter in such an embedded funnel is subject, unchanged, to the information on funnel pages in this section and to the funnel page's own privacy notice, which is linked in the embedded funnel; the controller is the same page owner. Views of the embedded funnel are counted as views “via an embedded widget” (section 17); marketing pixels are not loaded in the embedded funnel itself. If the page owner has set up marketing pixels for the landing page, the choice you make in the consent banner on the landing page applies; if you have consented, a contact request submitted in the embedded funnel may additionally be reported to Meta from the server (section 20).

If the landing page was opened via a link with an origin marker (“?via=…”), this marker is passed on to a funnel embedded in it and treated there as if you had opened the funnel page via that link (note on the contact request, count per distribution channel; sections 15 and 17). The page owner can also embed a survey funnel so that only the first question appears on the landing page (“entry only”). With your first answer, your browser then switches to the funnel page at its own address, where you answer the remaining questions; from there on, the information on the funnel page applies, including any marketing pixels, which are loaded only with your consent (section 20). So that your previous answers are not lost during the switch, they are stored briefly and exclusively locally in your browser (so-called sessionStorage, current tab only) and are read and deleted by the funnel page immediately after loading; they are neither transmitted to us nor logged in the process and – as with any survey – only reach us when you submit the contact form. This local storage is strictly necessary to continue the survey you started, as you requested; no consent is required for it (§ 25(2) no. 2 TDDDG). For the switch, the address of the funnel page contains only the version of the funnel shown and the numbers of the questions already shown, not your answers themselves (if the survey branches depending on the answer, these numbers do, however, show which path you took); if the page owner tests several versions (section 17), you thus stay with the version already shown. The switch is counted for the landing page as a click on a button and not as a further view of the funnel page (section 17).

Funnel page without a contact form (redirect). Instead of the contact form, the owner of a funnel page may display a single button that takes you to an external address they have chosen themselves (opening in a new browser tab). In that case no personal data is collected on the funnel page: there is no input field, no contact request ("lead") is created, and neither your name nor your email address, phone number or a message is processed; the thank-you page is also omitted, because there is nothing to submit. If you click the button you leave our service: your browser then establishes a direct connection to the linked destination, and for technical reasons your IP address is transmitted to its provider. From that moment on, the privacy policy and the controllership of that provider apply; we have no influence over their processing (see also section 14). The respective page owner alone is responsible for the choice, content and lawfulness of the destination; unlawful destinations can be reported via the reporting option on the page or to kontakt@netbaseos.de. The click itself is merely counted as an anonymous daily total (section 17); if the page owner has activated marketing pixels, it is additionally reported to those providers as an event – only after your consent (section 20).

We collect the details you enter: your name (depending on the form in a single field, split into first and last name, or first name only), one means of contact (email address or phone number), your postal address (street and house number, postcode, town) where the contact form of a landing page or funnel page asks for it, and an optional message. If the page owner has switched on notifications about new contact requests and linked their account to our Telegram bot (section 11), your name, the email address and phone number you provided and – on a landing page – any postal address requested are additionally delivered to them as a Telegram message; your message and any survey answers are not transmitted. In addition, the page owner is notified by email that your request has arrived, unless they have switched this notification off. This email states your name, the page through which you got in touch and whether you provided an email address and/or phone number – it does not contain your email address, phone number, postal address or message themselves, nor any survey answers. It is delivered via our sending provider Resend (section 5); your name is transmitted to Resend for this purpose. To prevent misuse and spam we use automated technical safeguards: your IP address is processed for a short time (counting requests per hour), and the form checks technical characteristics of the submission (including the time taken to submit and automatically detectable spam patterns) in order to filter out automated submissions by bots. As part of these safeguards, no cookies are set and no information is stored on or read from your device; there is no cross-device tracking and no profiling.

Origin marker (tagged links). The page owner can share the link to their public profile or funnel page separately per distribution channel by appending an origin marker – recognisable by the addition “?via=…” in the address bar. If you reach the page via such a tagged link and submit the contact form, a note of which channel you came from is additionally stored with your contact request. Only one of six fixed values is possible (Instagram, WhatsApp, Facebook, TikTok, Telegram or QR code); there is no free-text field for this, and any other value is discarded and not stored. This note describes the channel, not you: it contains no identifier, no IP address and no information about your behaviour; it is combined neither with the visitor checksum from section 17 nor with data from other sources, and it is not included in notifications sent to external services (such as Telegram). Its sole purpose is to let the page owner see which of their distribution channels lead to requests. The legal basis is their legitimate interest in that evaluation (Art. 6(1)(f) GDPR) – it is not necessary for handling your request itself; you may object at any time (Art. 21 GDPR) without this affecting your request. If you open the page without this addition, nothing is noted. The note is part of the contact request and is deleted together with it. No automated decision-making and no profiling within the meaning of Art. 22 GDPR takes place. For landing pages (netbaseos.de/l/…), it is noted only via a funnel embedded there (see above); this note does not exist for a contact form of the landing page itself.

Campaign links. Page owners on the Team and Enterprise plans can create campaign links for a funnel page or landing page, for example to see separately which ad leads to requests. Such a link carries the addition “?k=…” with an eight-character code randomly assigned by us; the page owner chooses the campaign name, which does not appear in the address. If you reach the page via such a link and submit the contact form, your contact request records which campaign the link belonged to – only if the code belongs to a campaign of this page owner; any other value is discarded. The code is passed on to a funnel embedded in the landing page. The note describes the campaign, not you: it contains no identifier of your person, no IP address and no information about your behaviour, and it is not combined with the visitor checksum from section 17 or with data from other sources. The legal basis is the page owner's legitimate interest in measuring the success of their advertising (Art. 6(1)(f) GDPR); the note is not necessary for handling your request, and you can object to it at any time (Art. 21 GDPR). If you open the page without this addition, nothing is recorded. The note is deleted together with the contact request; if the page owner deletes the campaign, the note is removed.

If the page owner operates their funnel page in survey mode (a paid additional feature of the Enterprise plan), up to 19 questions are shown to you before the contact form, which you can answer one after the other (single or multiple choice, or a short free-text answer). Which questions you are asked is determined solely by the respective page owner as controller: they formulate the questions and the answer options themselves. NetBaseOS neither specifies these questions nor reviews their content in advance; the templates we supply are non-binding samples that the page owner can change.

Your answers initially remain in your browser only and are transmitted only when you submit the contact form at the end of the survey. If you abandon the survey beforehand or close the page, nothing is transmitted to us and nothing is stored. Upon submission, your answers are stored together with the respective question text as a snapshot with the page owner's contact request ("lead") and displayed to them there, so that they already know your request before contacting you for the first time. No automated decision-making and no profiling within the meaning of Art. 22 GDPR takes place; we neither evaluate the answers nor use them for our own purposes, and we do not pass them on to third parties (in particular, they are not included in notifications sent to external services such as Telegram).

Answering the questions is voluntary; you decide yourself what information you provide. The page owner is obliged towards us not to collect, by means of these questions, any special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. health data) and no data on criminal convictions (Art. 10 GDPR), unless they have previously obtained your explicit consent for this themselves (Art. 9(2)(a) GDPR). The page owner, as controller, is responsible for compliance with this requirement and for the content and lawfulness of their questions. In free-text fields, please enter only information that is necessary for your request, and no sensitive information that you do not wish to disclose to the page owner.

After submitting, you are redirected to a thank-you page. So that this page can address you by your first name, only your first name is stored locally in your browser for the duration of the current browser session (in what is known as sessionStorage). This information is not transmitted to us, not stored on the server and not logged; it is automatically deleted when the browser tab is closed. Because this local storage is strictly necessary to show you the personalized thank-you page you requested by submitting the form, no consent is required for it (§ 25(2) no. 2 TDDDG).

After submitting, the respective page owner may additionally display an image they have uploaded as well as a button with a target they have chosen themselves (typically to download a file). The image is delivered from our own servers; no data is transmitted to third parties in the process. If you click the button, you leave our service: your browser then establishes a direct connection to the linked target, and for technical reasons your IP address is transmitted to its provider. From that point on, the privacy policy of the respective provider applies; we have no influence over their processing (see also section 14). The respective page owner is responsible for the choice and content of the linked target.

The controller for the further processing of this data (contacting you, storage as a lead) is the respective profile owner, not NetBaseOS. NetBaseOS merely provides the technical platform and processes the data on behalf of the profile owner (processing under Art. 28 GDPR, see our DPA at /avv).

The legal basis for processing is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR: since you fill in and submit the form yourself in order to be contacted, processing takes place to carry out the (pre-contractual) contact you requested, or on the basis of the legitimate interest of both sides in answering your request. The short-term processing of your IP address and the aforementioned automated safeguards for spam prevention are based on Art. 6(1)(f) GDPR (legitimate interest in the security of the service and its protection from misuse).

Short notice at the form – who is responsible for what. A short privacy notice appears below every contact form. The page owner may replace our default text with their own text or omit it; the page owner alone, as controller, is responsible for such a text, and we do not review its content. The page owner cannot remove the “Privacy notice” link to the privacy information generated for the page. There and in this policy we also inform you about what the page owner does not determine: we carry out the brief processing of your IP address and the automated spam-protection measures on submission under our own responsibility (legal basis see above); the storage of your enquiry and the reach measurement of the page (section 17) take place on behalf of the page owner. If a page owner’s own short notice deviates from this, the information in the linked privacy notice and in this policy applies to our processing. With your enquiry we record which version of the short notice was displayed on submission (default text, link only, or the wording of the owner’s own text); this record is part of your enquiry and is deleted together with it.

For page owners: log of your own short notices. If, as a user, you use your own short notice below one of your contact forms, change it or return to the default text, we automatically record every change in a log: the page or form concerned, the wording set (or the return to the default text), the time, and the account through which the change was made. The purpose is to document who used which wording and when – for you towards visitors and supervisory authorities, and for us to resolve complaints and defend against claims. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a traceable attribution of responsibility for these texts). You cannot change or delete the log; you will receive an extract on request (Art. 15 GDPR). It is deleted together with your account.

Passing on to a partner from the team. For each funnel page, each profile page and each contact form of a landing page, the page owner can specify that enquiries may be passed on to an independent sales partner from their own team – a NetBaseOS user from their downline. Only then does the privacy notice of the respective page, linked at the form, inform you of this; enquiries from forms without this setting and manually created entries cannot be passed on. If the page owner passes on your enquiry, the partner receives your name, your contact details (email address, phone number, postal address if applicable), the message you sent when submitting, any answers from survey mode together with the question text, a confirmation checkbox you ticked together with its text, and the name of the page through which you got in touch; the origin marker (“?via=…”) and the page owner's own notes are not transmitted. Enquiries containing information about your health or complaints may not be passed on; the page owner must expressly confirm this before each handover. The legal basis for passing on is the page owner's legitimate interest in entrusting the handling of your enquiry to a partner from their team who will contact you as requested (Art. 6(1)(f) GDPR); you can object to the passing on at any time vis-à-vis the page owner (Art. 21 GDPR). We carry out the passing on technically on behalf of the page owner (Art. 28 GDPR, DPA clause 3).

From the moment it is passed on, the partner is an independent controller for the copy of your data created in their account; we then process it on their behalf. They have undertaken towards us to tell you, at the latest when they first contact you – and in any event within one month – who they are, from whom they received your enquiry and where you can find their privacy notice (Art. 14 GDPR), to use your data only to handle your enquiry, not to pass it on and to delete it as soon as it is no longer required for that purpose (Terms, clause 7). Passing it on again is technically impossible. Only users who have accepted these obligations – as part of our Terms – have not switched off receiving and have stored a complete legal notice (imprint) and a public profile page can receive enquiries. The partner is notified of the handover in the application, by email (unless they have switched this notification off; sent via Resend, section 5) and – if they have enabled this – via our Telegram bot; these messages contain only your name and that of the page owner, the email additionally whether you provided an email address and/or phone number – not these themselves. What stays with the page owner. The page owner keeps your enquiry even after the handover – with your contact details, your message, your answers and their own notes – as an archived entry with a record of when and to which partner they passed it on; open follow-ups are deleted from their account. Under our Terms (clause 7) they may use this data only to accompany the partner in handling your enquiry and as evidence of to whom your enquiry was passed. For this copy they are themselves the controller: they determine purpose and storage period, ensure a legal basis (as a rule their legitimate interest in working together in the team, Art. 6(1)(f) GDPR), delete the data as soon as they no longer need it for that purpose and fulfil your rights, such as an objection (Art. 21 GDPR). We process the data held by the page owner and by the partner solely on their behalf (Art. 28 GDPR) and do not access its content; what the two of them do with your data is for them to decide. You exercise your rights regarding the data held by the page owner vis-à-vis the page owner and regarding the data held by the partner vis-à-vis the partner. At the latest, the data is deleted together with the respective account in accordance with section 6. Taking back. If the partner does not handle your enquiry, the page owner can take it back, provided their entry has been kept in full (i.e. not for enquiries received before the time stated below). They then handle it themselves again or pass it on – under the same conditions as above – to another partner from their team. No data held by the partner is transferred to the page owner in the process. The partner is notified of this in the application, with your name and that of the page owner. We do not delete the partner’s copy, because the partner is responsible for it; under our Terms (clause 7), the partner must delete it as soon as they no longer handle your enquiry and the data is not otherwise required. Until then, your rights vis-à-vis the partner remain unaffected. Enquiries received before 14 October 2026, 7:51 p.m. (German time): For these, what the notice said at the time continues to apply – when passed on, the page owner's entry is reduced to a record without your contact details (your name, the date of the handover, the partner's name, the page through which you got in touch and the classification of the enquiry); your contact details, your message, your answers, their notes and open follow-ups are deleted from their account. This record serves to enable them to tell you to whom your enquiry was passed (Art. 5(2), Art. 15(1)(c), Art. 6(1)(f) GDPR).

Other sources of leads. A prospect entry („lead“) may also arise without you having filled in a form: if a user uses the NetBaseChat add-on module and you write to them via a channel they have connected (their own Telegram bot, their own Instagram business account or their own email address), they can add you to their contact management – by hand or automatically as a step of a flow. Which details are carried over and on what legal basis this happens is described in section 23; the following statements on controllership, data subject rights and retention apply accordingly to such entries.

Objection to being contacted (suppression note). If you object to the page owner to advertising or to further contact (Art. 21 GDPR), they can record this on your entry – as a prospect or as a customer. An entry marked in this way is shown to them as an objection and cannot be handed over to a partner from their team. If the page owner deletes such an entry, a suppression note remains stored in their account so that your objection is still respected if your data reaches them again later – for example because you submit a form again or they add you again manually or by import. Other entries in their account with the same email address or phone number are marked as well. The suppression note does not contain your name, email address or phone number in plain text, but only, for each item, a check value calculated from it (hash value of the standardised email address or phone number together with an identifier of the account), the type of item and the time. Such a check value is pseudonymised but still personal data, because it can be used to check whether a particular address or number is affected. If data with a matching check value reaches this account again, the new entry is automatically marked as an objection; it is nevertheless stored and the page owner merely receives this notice – no automated decision within the meaning of Art. 22 GDPR takes place. The comparison is made only within the respective account; the suppression notes of different accounts are not compared with each other. The legal basis is the page owner’s obligation to respect your objection permanently (Art. 6(1)(c) in conjunction with Art. 21(3) GDPR) and their legitimate interest in implementing this reliably and being able to prove it (Art. 6(1)(f) GDPR). The suppression note is stored until the page owner lifts the objection – which they should only do if you have agreed to be contacted again – or until their account is deleted. The page owner is the controller; we process the suppression note on their behalf (Art. 28 GDPR, DPA clause 3).

The data stored as a lead is managed by the respective profile owner. The profile owner, as controller, is responsible for the storage period, the exercise of your data subject rights (access, erasure, etc.) and further information obligations. If you wish to request erasure or access, please contact the profile owner; we support them technically. Within NetBaseOS, leads are deleted according to the periods set out in section 6. Any answers from the survey mode are part of the respective lead and are deleted together with it. If you later become a customer of the profile owner and they transfer your request into their customer management, your answers – together with the question text and the name of the funnel page – are copied as a snapshot into your customer record and displayed to them there, so that they can look after you appropriately as a customer; in addition, they may expressly copy individual answers into their own additional details about you (e.g. your pet's name). They then treat these copied details like their other customer data – they are the controller for them as well, and they are no longer deleted together with the lead but together with your customer record (at the latest when their account is deleted, section 6).

16. Onboarding support and templates from your team

If you joined at the invitation of your sponsor (your direct upline) and are part of a team, your direct upline supports your onboarding ("onboarding journey"). For this purpose, your direct upline can send you onboarding steps and support messages.

For this support, your direct upline can view and use the contact data you provided (your name and – where available – your email address and phone number). Your email address is made technically accessible only to your direct upline (not public, not prominently displayed) and serves solely for onboarding communication. If your direct upline uses the Enterprise plan and has set up assistant access to their account for persons who support them in their own business, these persons can also see the details about you described in this section and the reminders your upline notes about you; they act on behalf of your upline and on its instructions, and your upline remains responsible for this (section 27).

Three channels are available to your upline for sending: Telegram (automated delivery via the bot – only with a linked account, see section 11, which also contains the opt-out switch), WhatsApp and email. For WhatsApp and email, your upline merely opens the respective app on their own device via a link (WhatsApp link via api.whatsapp.com or mailto) with pre-filled text. NetBaseOS does not send anything automatically over these two channels and does not itself establish a connection to WhatsApp or your email provider.

You can view the onboarding journey created for you at any time yourself at netbaseos.de/journey and mark steps as done; you only ever see your own journey.

Image attached to a step. Your upline can attach one image to an onboarding step – intended for screenshots of instructions. It is displayed exclusively inside the application and is not sent via Telegram, WhatsApp or email. The image is uploaded to our storage provider (Supabase, servers in the EU, see section 5) and stored there under a randomly generated address; an image held on an external server cannot be used here and is not displayed. That address is not published and cannot be found via search engines; however, anyone who knows it can retrieve the file without signing in – it is therefore not technically protected in the same way as the other content behind your sign-in. Which image is used is determined solely by your upline; we do not review it in advance. They are obliged towards us not to include any personal data of third parties in such an image – for example customer or contact data visible in a screenshot (Terms, clause 7); if they nevertheless do so, they are the controller for that. An image you store in a template of your own is deleted from storage as soon as you remove or replace it in the step, delete the step or the template – and at the latest together with your account (section 6).

Reminders about a partner. Your direct upline can note reminders about you: a time and a title they type themselves as the reason (for example “call back after the first conversation”). The note is intended for them alone – it is neither shown nor delivered to you, and other users do not see it (for assistant access of your upline, see above). Once the time is reached, your upline receives a notification inside the application, additionally via the Telegram bot if their account is linked and – if they have switched on the daily reminder by email (section 24, number 2, point (b)) – also in that email. It then contains your name, the label “Partner” and the title assigned by your upline; it contains no further details about you, in particular not your postal address, your phone number or your email address. In order to send it, these details are transmitted to our sending provider Resend (section 5). Which title your upline assigns is determined by them alone; we do not review it in advance, and they are obliged towards us to enter personal data of third parties only where they have a legal basis for doing so under Art. 6 GDPR (Terms, clause 7). The legal basis for processing your data is our legitimate interest in cooperation and onboarding within the existing team/network relationship (Art. 6(1)(f) GDPR); you can object to it under Art. 21 GDPR (section 7). In relation to your upline, delivering the reminder is at the same time the service they ordered (Art. 6(1)(b) GDPR, section 24). If your upline ticks the reminder off or deletes it, no further reminder is sent; and in any case the email no longer reminds about a time more than 30 days in the past. If the cooperation ends – because your upline removes the link or because one of the two accounts is deleted – these reminders are deleted along with it (section 6).

The legal basis is our legitimate interest in cooperation and onboarding within the existing team/network relationship (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR, see section 7); for the Telegram channel the opt-out switch described in section 11 is additionally available.

Onboarding templates within the team. If a user releases an onboarding template they created for their network and an entitled partner takes it over, an independent copy of the steps is created in that partner's account – including their own copies of the attached image files; the copy therefore does not point to the sharing user's files. It is independent of that user's template: if they withdraw the release or delete the template, the image or their account, the copy remains in the receiving user's account and is only deleted together with that account. The receiving user is independently responsible for the content of the copy and its further use. The legal basis is performance of the user agreement with the sharing user, who triggers the release themselves, and our legitimate interest in cooperation within the existing team/network relationship (Art. 6(1)(b) and (f) GDPR).

Templates within the team. If a user releases a funnel page they designed as a template for their network, the partners entitled to it see their name as well as the name, headline and preview image of that page. If a partner takes the template over, their account receives its own copy of the texts, colours and images. Not transferred are testimonials (including names and photos of the people quoted), advertising pixels, the stored redirect, button and booking addresses, and the sharing user's privacy note. The legal basis is performance of the user agreement with the sharing user, who triggers the release themselves and can withdraw it at any time, and our legitimate interest in cooperation within the existing team/network relationship (Art. 6(1)(b) and (f) GDPR). For the copy taken over and its publication, the receiving user is a separate controller (see section 15).

Design of a profile page. If a user releases the design of their own public profile page as a template for their network, the partners entitled to it see their name and the internal label of that page. Only design values are taken over – colours, fonts, shapes, gradient direction, opacity and the order of the sections. No content of any kind is transferred: no text, no profile picture and no other image, no headline, no testimonials, no social media, button or redirect addresses, and not the address of the page. The design taken over therefore contains no personal data of the sharing user. The legal basis is performance of the user agreement with the sharing user, who triggers the release themselves and can withdraw it at any time, and our legitimate interest in cooperation within the existing team/network relationship (Art. 6(1)(b) and (f) GDPR). In addition, we provide all users with ready-made designs from NetBaseOS; these contain no data of other users.

Handover of enquiries within the team. You can receive enquiries from prospects that someone from your upline passes on to you. This is switched on by default; the obligations of a recipient follow from our Terms (clause 7). Until 13 October 2026 they had to be accepted once in the settings instead; such an earlier acceptance remains valid. Whether you can receive is therefore determined from the record of your consent to a version of the Terms containing these obligations (section 2) or from an earlier acceptance. In the settings (“Network” area) you can switch receiving off and on again at any time; while it is switched off, nobody can hand an enquiry over to you. We store the time you switched it off with your account. If you had ended receiving before 13 October 2026, we have left it switched off for you. We record every switching off and on, as well as every earlier acceptance and ending, in a log: time, action and the version of the obligations applicable at that time. The purpose is to be able to prove that the obligations applied when enquiries were taken over (accountability, Art. 5(2) GDPR) and to establish, exercise or defend legal claims; the legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). The log is kept even after switching off, because the obligations continue to apply to enquiries already taken over; you cannot change or delete it. We store it for as long as your account exists. If your account is deleted, the log is also deleted – even if your profile remains as an anonymous placeholder in the team structure. If a user from your upline wants to hand over an enquiry, we show them the users in their downline with name and level and – if someone currently cannot receive – the reason: receiving switched off, current Terms not yet confirmed, legal notice incomplete, no public profile page or – without stating the cause – a notice that you cannot receive enquiries right now. Your plan is not shown. After a handover, the person handing over sees your name as the recipient, and you see their name and the date on the enquiry you received. The legal basis for these displays is the performance of the user agreement, insofar as you use the function, and our legitimate interest in cooperation within the existing team/network relationship (Art. 6(1)(b) and (f) GDPR). Section 15 applies to the prospects' data.

17. Reach measurement of public pages (profile, funnel and landing pages, aggregated and cookieless)

If a NetBaseOS user provides a public page – one or more public profile pages (digital business card at netbaseos.de/p/…), a funnel page (the paid action page at netbaseos.de/f/…, see section 15) or a landing page (multi-section marketing page at netbaseos.de/l/…) –, we record a purely statistical reach measurement for the respective page owner: we count only how often the page was opened on a given calendar day – separated by source (public profile, funnel page directly or via an embedded widget, landing page). If someone operates several public profile pages, their views are combined into a single figure per owner and calendar day; no evaluation of this view count per individual page takes place. The only exception is the origin of tagged links described below.

This measurement is cookieless: no cookies are set and no information requiring consent under § 25 TDDDG (formerly § 25 TTDSG) is stored in or read from the visitor's device. Your IP address is not stored; for the view count, only a running total per profile owner, calendar day and source is kept. There is no cross-site or cross-device tracking, no recognition beyond the individual calendar day and no profiling; individual, non-converting visitors are not identifiable, neither by us nor by the page owner.

Unique visitors. For public profile pages and funnel pages we additionally show the page owner how many different visitors opened the page on a given calendar day. So that repeated visits by the same person on the same day are counted only once, when the page is opened we generate a checksum (hash) on our server from your IP address, the browser identifier (user agent) transmitted by your browser and an additional value that changes daily and is stored nowhere. Only this checksum is stored – neither your IP address nor the user agent. The checksum cannot be converted back into the IP address, is only compared with the checksums of the same calendar day and the same page owner, and – because the additional value changes daily – does not permit recognition beyond that day, across different page owners or across several devices. The checksums are deleted automatically after 3 days at the latest; only the daily total ("unique visitors") is retained permanently. The page owner never sees the checksums themselves, only this total.

Because the checksum makes you distinguishable from other visitors within a calendar day, we treat it as a matter of precaution as pseudonymous personal data and not as anonymous information. Generating it does not store or read any information on your device; it is based exclusively on information that your browser has to transmit anyway for technical reasons when a page is requested – consent under § 25(1) TDDDG is therefore not required. The legal basis for the processing is Art. 6(1)(f) GDPR (legitimate interest in a data-minimising measurement of actual reach without cookies, without storing the IP address and without involving an external analytics service). You may object to this processing at any time (Art. 21 GDPR, see section 7).

From these totals, the respective profile owner sees only aggregated metrics in their analytics area (number of views per source, such as the reach of the public profile, and – for funnel pages – the conversion rate = contact requests per view and the bounce rate). For funnel pages, two further downstream conversion stages are counted – likewise as running totals per calendar day without personal reference: reaching the thank-you page after the form is submitted, and any click on the button (call-to-action) optionally shown there. For landing pages, three totals are counted per calendar day in the same way: page views, submitted forms and clicks on a button (call-to-action) of the page. For such a button click, your browser merely reports an anonymous counting event (identifier of the page and type of event) to our own database (Supabase, servers in the EU, see section 5); as is technically unavoidable with any page request, your IP address is transmitted in the process, but it is not stored for statistical purposes. Throughout, this is an internal count without the involvement of any third party or external analytics service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly, anonymous statistics to measure the reach and effectiveness of one's own public pages – profile, funnel and landing page). If a funnel page is operated without a contact form as a pure redirect (section 15), a total for the clicks on the redirect button takes the place of these stages – there it is the only measurable effect of the page, because no form can be submitted. Such a click, too, is reported by your browser merely as an anonymous counting event; neither the destination nor your subsequent behaviour there is recorded, so the page owner learns from this count only how often the button was clicked on a given day.

Survey steps and times. If a funnel page is operated in survey mode (see section 15), we additionally count per calendar day how often the respective step (question) was displayed and record – in each case only as a sum and a count, from which an average is calculated – the time spent on a step and the time until the form is submitted. These figures, too, are pure daily totals per funnel and step without any personal reference: they contain no IP address and no visitor identifier and are not linked to any subsequent contact request. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly, anonymous statistics to improve one's own public page).

How far a landing page is viewed (sections). For landing pages, we additionally count per calendar day how often the individual parts (sections) of the page were actually within the visible area of your browser. A section counts as reached as soon as at least half of it was visible – for very tall sections: at least half the height of the screen; each section is counted at most once per page view. For this purpose, a script embedded in the page merely determines in your browser which sections became visible and, when you leave the page or switch to another tab, transmits only the identifiers of these sections – together with the identifier of the page and a technical check value proving that the page was delivered by us – to our server. All that is stored is a total incremented per page, section and calendar day – without time of day, without IP address, without a visitor identifier and without any link to the visitor checksum mentioned above or to a contact request; these totals do not reveal who viewed the page and how far. To prevent abuse (mass submission of falsified reports), your IP address is processed briefly to limit the number of reports per hour; this entry is not linked to the count and is automatically deleted after 24 hours at the latest. Views by the page owner themselves are not counted; for this we merely check whether the page owner is signed in to NetBaseOS in the same browser. No cookies are set and no information is stored permanently on your device; the script keeps track of which sections have already been reported only in the browser's memory for the duration of the page view. In their editor, the page owner sees only these totals per section. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising, anonymous statistics to improve one's own public page); you may object at any time (Art. 21 GDPR, see section 7).

Origin of the views (tagged links). The owner of a public profile or funnel page can share their link separately per distribution channel by appending an origin marker (“?via=…” in the address bar, see section 15). If the page is opened via such a tagged link, we additionally count the view separately for that channel. Only one of six fixed values is possible (Instagram, WhatsApp, Facebook, TikTok, Telegram, QR code); any other value is discarded and not stored. Here, too, only a running total per page owner, page, calendar day and channel is kept – without a time of day, without an IP address, without a visitor identifier and without any further characteristic; it is not linked to the visitor checksum described above, and it is not possible to infer from such a total who opened the page. If an owner operates several public profile pages, this total is kept per individual profile page – unlike the overall view count above – so that they can tell which channel led to which of their pages; if a page is deleted, its totals are deleted with it. No cookies are set for this and no information is stored in or read from your device – the marker is merely part of the address you opened – so consent under § 25(1) TDDDG is not required. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a data-minimising measurement of the success of one’s own distribution channels); you may object at any time (Art. 21 GDPR, see section 7). If the page is opened without this addition, no such entry is created; the total number of views is unaffected. This count does not exist for landing pages themselves; an origin marker in their address is only passed on to a funnel embedded in them (section 15).

Views via campaign links. If a funnel page or landing page is opened via a campaign link of the page owner (“?k=…”, section 15), we additionally count the view as a total per campaign and calendar day – only if the code belongs to a campaign of exactly this page. Neither time of day nor IP address, visitor identifier or visitor checksum is recorded; views by the page owner themselves are not counted. No cookies are set for this and no information is stored on or read from your device; consent under § 25(1) TDDDG is therefore not required. Legal basis: Art. 6(1)(f) GDPR (the page owner's legitimate interest in data-minimising measurement of the success of their advertising); you can object at any time (Art. 21 GDPR). The totals are deleted together with the campaign.

Testing different versions of a funnel page (A/B test). The owner of a funnel page (Enterprise plan) can store several versions of their page at the same address in order to find out which version works better. Which version is shown to you is decided at random, and anew for every page view. No cookies are set for this, no information is stored in or read from your device and no visitor identifier is assigned; deliberately, you are not permanently assigned to a particular version (if you open the page again, a different version may be shown). Only the totals described above are counted – separately per version. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving one's own public page).

Who informs you about this. We carry out the reach measurement on behalf of the respective page owner (see our DPA at /avv, clause 3). We provide the information about it ourselves – in this policy and in the page’s privacy notice, which is linked at every contact form and which the page owner cannot remove. A short notice at the form worded by the page owner themselves (section 15) changes nothing about this measurement or the information in this section.

18. Embedded content on public pages and in the app (videos and external appointment booking, two-click solution)

On a funnel page (netbaseos.de/f/…), on the thank-you page shown to a visitor after submitting the contact form (section 15), in a video block of a landing page (netbaseos.de/l/…) and in a video block of a public profile page (netbaseos.de/p/…), the respective page owner may optionally embed a video. A welcome video of the respective partner may additionally be embedded on the sign-up page of a referral partner (netbaseos.de/r/…). Only videos from the platforms YouTube (operated by Google Ireland Ltd., Ireland, or Google LLC, USA), Vimeo (operated by Vimeo.com, Inc., USA) and Loom (operated by Loom, Inc., USA, an Atlassian group company) can be embedded.

In addition, we ourselves provide explanatory videos on individual features within the app (in the logged-in area), which are likewise embedded from YouTube, Vimeo or Loom. For these explanatory videos, the controller is not a page owner but we ourselves as the provider of NetBaseOS; the two-click solution and legal basis described below apply to them in the same way.

To protect your data, we use a two-click solution (known as click-to-load): when the page is opened, the video is not yet loaded. Only a neutral placeholder with a play button is shown, which is displayed without any connection to YouTube/Google, Vimeo or Loom – not even the preview image is loaded from their servers. Up to this point, no cookies are set, no information is stored in or read from your device, and no data is transmitted to the video provider.

Only when you actively click the play button does your browser establish a direct connection to the respective video provider in order to load and play the video. For technical reasons, your IP address is transmitted to the provider; the transfer may also go to servers in the USA. In this context, the provider may set cookies or use comparable technologies and process your use of the video; we have no influence over this. We inform you about this process separately, right at the placeholder, before you load the video.

The legal basis for loading the video is your consent (Art. 6(1)(a) GDPR and – where information is stored in or read from your device – Section 25(1) TDDDG), which you give by actively clicking the play button. If you do not play the video, no transfer to the video provider takes place. For more information on the data processing by the providers, see Google/YouTube, Vimeo and Loom (Atlassian).

When a video link is saved – by a page owner or by us for an explanatory video – our server merely queries the aspect ratio of the video (e.g. landscape or portrait) from the respective video provider via its public oEmbed interface, so that the placeholder can be displayed appropriately. Only the video link is transmitted in this process; no data of page visitors is transferred to the provider.

On the thank-you page and in an appointment block of a landing page (netbaseos.de/l/…), the respective page owner may optionally embed an external appointment booking through which you can – if you wish – arrange an appointment directly with them. Only the following appointment-booking services can be embedded: Calendly, Cal.com, TidyCal, SavvyCal, Koalendar and Zcal. These services are operated independently by the respective providers; they are established in the USA and/or their servers may be located outside the European Union, in particular in the USA.

Here too we use a two-click solution (click-to-load): when the page is opened, the appointment-booking service is not yet loaded; only a button ("Book appointment") is shown, displayed without any connection to the provider. Only when you actively click this button does your browser establish a direct connection to the respective provider and load its booking form; for technical reasons your IP address is transmitted to the provider, and this transfer may also go to servers in the USA. If you enter further details in the booking form (such as name, email address or preferred date), these are processed directly by the respective provider. We point this out to you separately right at the button – naming the respective provider – before you open the appointment booking. If you open the appointment booking on a landing page, this is additionally counted, like any other button click, as a mere counting event without any personal reference (section 17); we do not learn whether you actually go on to book an appointment.

The legal basis for loading the booking form is your consent (Art. 6(1)(a) GDPR and – where information is stored in or read from your device – Section 25(1) TDDDG), which you give by actively clicking the button. If you do not open the appointment booking, no transfer to the provider takes place. The controller for the actual appointment scheduling and the data you enter there (name, email address, any message and the selected time) is the respective page owner (legal notice of the respective page), who uses the service as their tool; the legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR) or the legitimate interest of both sides in arranging the appointment you requested (Art. 6(1)(f) GDPR). NetBaseOS merely provides the technical means of embedding: the details from the booking form flow directly from your browser to the provider, are not transmitted to NetBaseOS and are not stored there. NetBaseOS is not a party to the relationship between the page owner and the appointment-booking provider and is, in relation to that provider, neither controller nor processor. Whether the provider processes the data you enter as a processor of the page owner (Art. 28 GDPR) and/or for its own purposes as its own controller depends on the agreement between the page owner and the provider and on the provider's privacy policy. To exercise your data subject rights regarding the appointment booking, please contact the respective page owner and the respective provider.

Transfers to the USA (both embeds). Where the respective provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Where it is not, the transfer is based solely on your consent (Art. 49(1)(a) GDPR). For that case we inform you of the possible risks: the USA does not offer a level of data protection equivalent to European law, US authorities may under certain circumstances access the data, and your data subject rights may not be enforceable there, or only to a limited extent. If you do not load the video or the appointment booking, no such transfer takes place.

19. Cancellation form (cancellation button under Section 312k BGB)

You can cancel your paid subscription via the cancellation page (netbaseos.de/kuendigen), which is publicly accessible without logging in. When you submit the form, we process the details you enter – your name, the email address of your account, the description of the contract, the type of cancellation (ordinary/extraordinary) and, in the case of an extraordinary cancellation, the reason you give and any desired termination date – in order to receive your cancellation declaration, confirm its receipt in text form and carry out the cancellation.

To prevent abuse and spam, your IP address is processed for a short time (counting requests per hour per IP and per email address); the form also contains a technical bot-detection field. No cookies are set and no information is stored in or read from your device; no tracking or profiling takes place.

The legal basis is the performance or termination of the contract existing with you (Art. 6(1)(b) GDPR) and compliance with our legal obligation to provide a cancellation button and to confirm receipt of the cancellation (Section 312k BGB, Art. 6(1)(c) GDPR). The short-term processing of the IP address for spam prevention is based on our legitimate interest in the security and abuse-free operation of the service (Art. 6(1)(f) GDPR). We retain proof of the time and content of the cancellation for evidentiary purposes within the statutory limitation periods.

20. Marketing and conversion pixels on funnel pages and landing pages, and the Meta Conversions API (activated by the page owner)

On a funnel page (the paid action page at netbaseos.de/f/…, see section 15) including its thank-you page and on a landing page (netbaseos.de/l/…) – in each case also under the page owner's own domain – the respective page owner (Premium, Team or Enterprise user) may optionally embed external marketing and conversion pixels in order to measure the performance of their own advertising campaigns. They can set pixels for an individual funnel page or once for their entire account; the account pixels then apply to all of their funnel pages without their own pixel and to all of their landing pages. Only the following providers can be activated: Meta Pixel (Meta Platforms Ireland Ltd., Ireland, and Meta Platforms Inc., USA), TikTok Pixel (TikTok Technology Ltd., Ireland, and TikTok Inc./ByteDance, USA) and Google Ads or Google Analytics 4 (Google Ireland Ltd., Ireland, and Google LLC, USA).

The controller for these pixels is the respective page owner, not NetBaseOS: they decide independently whether and which pixels to activate and thereby determine the purposes and means of this processing (Art. 4(7) GDPR). NetBaseOS merely provides a technical tool for this (entry of the pixel IDs) and is not a processor for the pixels – the data triggered on loading flows directly from your browser to the respective provider, without passing through NetBaseOS (for the transmission from our server via the Meta Conversions API, see below). For joint processing between the page owner and the respective provider (e.g. Meta), joint controllership under Art. 26 GDPR may exist; the page owner is responsible for this.

These pixels are not loaded automatically. When the page is opened, a consent banner with equivalent buttons (“Accept” / “Decline”) appears first. Only when you actively click “Accept” are the pixels loaded and data – in particular your IP address, device and usage information and the respective event – transmitted to the aforementioned providers. Your decision is stored only locally in your browser (localStorage, entry “nb_fx_consent”) so that the banner does not reappear on every visit. This transfer may also go to servers in the USA; for transfers to the USA the providers regularly rely on the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses. If you decline or make no choice, nothing is loaded and no data is transmitted to these providers. In the embedded widget (iframe on a third-party page or in a landing page of the page owner, section 15) these pixels are generally not loaded; on the landing page itself the account pixels apply.

Events reported. After your consent, the following events may be reported, depending on the page and provider: the page view; the submission of a contact form (“Lead”, together with a randomly generated event ID, see below); a click on a button of a landing page (“Contact”); opening an embedded appointment booking on the thank-you page or the landing page (“Schedule”); in the survey mode of a funnel page, reaching a step – only the number of the step is transmitted, never the question or your answer; and, on a funnel page without a contact form (redirect, section 15), your click on the redirect button. These events only contain the information that the action took place; the pixels do not transmit form contents or contact details. The click on the redirect button is deliberately not reported as a “lead” but as a separate event.

Transmission from the server (Meta Conversions API, Team and Enterprise plans). The page owner can additionally set up Meta's Conversions API; to do so, they store with us an access token generated by them at Meta for their Meta pixel. If you then submit a contact form, our server additionally reports the request directly to Meta (Meta Platforms Ireland Ltd.). This happens only if you clicked “Accept” in the banner, only for the Meta pixel to which the access token applies, only when a contact form is submitted on a funnel page or landing page of the page owner (including from a funnel embedded there) – not from a widget on a third-party page – and not for test submissions by the page owner themselves. The following is transmitted: the event “Lead” with time, event ID and the address of the page on which you submitted the form; your e-mail address, telephone number and first and last name, insofar as you provided them, exclusively as a SHA-256 hash value and never in plain text; your IP address and your browser identifier (user agent); and – if the Meta pixel has set them after your consent – the values of the Meta cookies “_fbp” and “_fbc”. Your message, survey answers, a postal address and other form details are not transmitted. Important: a hash value is not anonymisation. Meta matches it against the data available to Meta in order to attribute the request to a Meta account and thus to an ad; it therefore remains personal data. The event ID is the same for pixel and server so that Meta counts a request only once. The purpose is to measure and optimise the page owner's advertising campaigns. The transmission to Meta may also go to the USA; Meta Platforms Inc. is certified under the EU-US Data Privacy Framework. We do not store the transmitted data separately – it is part of your contact request (section 15) or is processed only for the duration of the transmission; we only record whether the page owner's last transmission succeeded (time and, where applicable, Meta's error message), without reference to your person. We carry out this server-side transmission on behalf of and on the instructions of the page owner (Art. 28 GDPR, DPA clause 3); the page owner remains the controller, where applicable jointly with Meta (Art. 26 GDPR). What Meta does with the data received is governed by the terms between the page owner and Meta and by Meta's privacy policy.

The legal basis is your consent (Art. 6(1)(a) GDPR and – for the storage of and access to information on your device – § 25(1) TDDDG), which you give by actively clicking “Accept”; it covers the pixels and the server-side transmission described above. Your consent is voluntary and can be withdrawn at any time with effect for the future: via the “Marketing settings” link permanently shown on the page you can recall and withdraw your decision; pixels already set are not reloaded, and later contact requests are no longer reported to Meta from the server. Data already transmitted can only be deleted by the page owner or the provider. To further exercise your data subject rights (access, erasure, etc.) regarding the data processed via the pixels or the Conversions API, please contact the respective page owner as controller (imprint of the page) and the respective provider.

Domain verification with Meta. If the page owner has connected their own domain, they can have a verification code issued by Meta output there as a meta tag (“facebook-domain-verification”) in the source code of their pages in order to prove to Meta that they own the domain. Only this code is displayed; opening the page does not transmit any of your data to Meta as a result.

More information on the data processing by the providers can be found at Meta, TikTok and Google.

21. Support and contact requests (ticket system, email and phone support)

When you contact us via our support or feedback form or create a ticket, we process the information you submit in order to handle your request and communicate with you. This includes the subject, the message text and the type of request as well as the subsequent message history (thread). To assign and process your request, we additionally store technical accompanying data: your name, your plan tier, the browser identifier (user agent) and the page/URL from which you sent the request. If a person with assistant access to your account creates the request (section 27), we additionally record the identifier of their access so that it is clear who is writing; the request belongs to your account and is also visible to you there.

Reports about publicly accessible content (such as reporting a public profile page – including an individual one out of several pages belonging to the same owner – or a funnel page) also go through this system. Such reports can be made without a user account and without disclosing your identity; in that case we only process the information you provide about the report and the technical accompanying data mentioned above.

The legal basis is Art. 6(1)(b) GDPR insofar as your request serves the performance or initiation of a contract (e.g. questions about your subscription), and otherwise Art. 6(1)(f) GDPR (legitimate interest in handling support matters, improving the service and ensuring the security and abuse-free operation of the offering).

Requests by email. If you send us an email – for example to kontakt@netbaseos.de or via an email link on our website, such as “Arrange a call” in the section for team leaders –, we process your email address, your name if you provide it, the content of your message and any information you choose to give (such as the size of your team or the company you work with) in order to answer your request and, if you wish, to arrange a call. Incoming emails to our addresses are technically received and stored via our service provider Resend (section 5). No user account is required. Any text pre-filled by such a link is only a suggestion; you decide what you send. The legal basis is as set out in the preceding paragraph. We do not use your address for advertising without your consent. We delete your message as soon as it is no longer needed to handle your request, unless statutory retention obligations (in particular for commercial and business letters, § 257 HGB, § 147 AO) apply.

Phone support (Enterprise plan only). If you call the number stated in the legal notice, we process the information you give us during the call – in particular your name, the phone PIN you quote and your request – as well as the number your line transmits when connecting, unless you withhold it. If the caller is a person who uses your account as an assistant under clause 3 of the Terms, the same applies to their information and their number; the legal basis in that respect is Art. 6(1)(f) GDPR (legitimate interest in providing the support agreed for your account). We do not record calls and do not keep a transcript. If we record the outcome of a call for further processing, we do so in a ticket; the statements above in this section then apply. The caller’s number remains stored in the call list of the phone line used; it is not evaluated there, not added to your profile and not combined with your other data. Legal basis: Art. 6(1)(b) GDPR – phone support forms part of the Enterprise plan (Terms, clause 4) – and otherwise Art. 6(1)(f) GDPR (legitimate interest in handling support matters).

Phone PIN. So that we can tell who is calling, a personal six-digit phone PIN is displayed to you as an Enterprise customer in the “My requests” area. It is only generated when you first open that area, consists solely of a random number and allows no conclusions to be drawn about you. It is stored separately from your profile and can be viewed only by you and by the controller – in particular not by your sponsor, your upline or your team, nor by persons with assistant access to your account (section 27); whether you tell them the PIN is up to you (Terms, clause 4). Its sole purpose is to assign a call to your account and to check whether your plan includes phone support; it does not grant access to your account, and we do not make changes to your account or contract by this route. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in not giving information to unauthorised persons on the phone). Retention period: the PIN exists for as long as your account exists and is deleted together with the account (section 6). If it has become known to third parties, you can invalidate it yourself at any time in the “My requests” area; we will also do so upon your notification, and on our own initiative where there are indications of misuse. A new PIN then takes its place and the old one is deleted.

Retention period: A ticket marked as "Done" is automatically closed after 7 days without further activity. Closed tickets, including the associated message history, are automatically and permanently deleted around 12 months after they were closed, unless statutory retention obligations or the establishment, exercise or defence of legal claims (Art. 17(3) GDPR) preclude deletion. If you delete your account, the tickets assigned to you are already deleted in the course of the account deletion (see section 6).

22. Applications to the partner programme

Via the public partner programme page (netbaseos.de/partnerprogramm) you can apply as an affiliate partner without having a user account. We process the data you provide: name, e-mail address, your statement about where you reach people, and your free-text application. We additionally store the time of the application, an internal processing status and, where applicable, an internal note.

The sole purpose is to review your application and to communicate with you about it. Legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). The data is not passed on to third parties and is processed exclusively on our infrastructure in the EU (see section 5). We send you an e-mail confirming receipt (dispatch via Resend, see section 5).

To protect against automated bulk submissions we limit the number of applications per IP address. For this, the time of submission is stored briefly together with your IP address; these entries are deleted automatically after 24 hours at the latest and are not combined with your application. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against misuse).

Retention: applications that do not lead to admission are deleted automatically and permanently after 6 months at the latest – including where we have rejected them. If your application leads to admission to the programme, the details become part of the contractual relationship; the retention rules in section 9 and the statutory retention obligations then apply. You may object to the storage at any time and request deletion (section 7); we will then delete your application without undue delay.

23. NetBaseChat – messages from Telegram, Instagram and email, and comments under Instagram posts (add-on module)

As a separately enabled add-on module („NetBaseChat“), NetBaseOS allows users to receive and answer messages that contacts send to their own Telegram bot, to their own Instagram business account or to an email address of their own connected via their own domain. Where an Instagram business account is connected, the comments under the posts of that account are received as well. The module is not part of the standard plans; it is enabled individually per account. As long as a user has not connected a channel, no data is processed for this purpose.

The controller for these conversations is the respective user who connected the channel with their own Telegram or Instagram account – not NetBaseOS. We process the messages exclusively on their behalf and on their instructions (processing on behalf under Art. 28 GDPR, see our DPA at /avv). If you, as a contact, wish to request access, rectification or erasure, please contact the user you wrote to; we support them technically.

The following are processed: the contact’s identifier at the respective provider (Telegram chat ID, the Instagram identifier issued for the respective account or – for the email channel – your sender address), the display name and username used there, the content of the messages exchanged including attachments (e.g. images, voice messages, documents) and – for email – the subject line, for a comment under an Instagram post its content and the identifiers Instagram assigns to the comment and to the post, the time, direction and delivery status of each message, the processing state of the conversation (unread, taken over by the user, done) and – if the user obtains marketing consent – a consent record (time, source, the wording from which the consent follows – in the case of a comment under an Instagram post, the text of that comment, truncated to 500 characters – and technical evidence). Message and comment content is not transmitted to AI services and is not evaluated for the operator’s own purposes.

The credentials of the connected channel (Telegram bot token or Instagram access token) are stored separately from the other data and exclusively server-side; once entered they can no longer be viewed, not even by the user.

Legal basis. Vis-à-vis the user, we base the provision of the module on Art. 6(1)(b) GDPR (performance of the user contract). For the processing of their contacts’ messages the user is the controller; this is regularly based on Art. 6(1)(b) GDPR (replying to the conversation initiated by the contact themselves) or on Art. 6(1)(f) GDPR. Advertising by direct message additionally requires the recipient’s prior express consent (§ 7(2) UWG); for this the module provides an append-only consent record (§ 7a UWG) in which consents and withdrawals are documented immutably. Obtaining the consent, documenting it and retaining it for the statutory five years is the responsibility of the user as the advertising party.

Automated replies („flows“). Users can specify that an incoming message is answered automatically – either on a contact’s first message or when the message contains a keyword they defined. A separate setting covers the case where a comment under an Instagram post contains such a word (see the following paragraph). A flow may contain several messages with pauses of no more than 24 hours in between. It starts exclusively in response to a message or a comment from the contact; there is deliberately no way to message contacts on a schedule of one’s own accord. If the contact replies, or if the user takes over the conversation themselves, the flow ends immediately. For this purpose a run state is additionally stored (which flow is running for which contact, the step last sent and the time of the next step); it is deleted together with the conversation. For their own evaluation, the user sees two aggregate figures per flow – how often the flow was triggered and in how many of those cases the contact wrote afterwards; these are calculated from data already present and are not stored separately.

Comments under Instagram posts. Where a user has connected their Instagram business account, we also receive the comments made under their posts. A comment is stored as the beginning of a conversation with you and is treated in the same way as a message; the account holder’s own comments are not stored. Instagram permits exactly one private reply by direct message per comment, and only within seven days; once it has been sent, the stored comment identifier is deleted and a second private reply to the same comment is not possible. The user can write that reply by hand or have it triggered by a flow set up specifically for this, which responds to comments only, triggers only on a complete word they defined and can be limited to a single post.

Such a private reply reaches you although you have not written to the user. If it contains advertising, it requires your prior express consent (§ 7(2) no. 2 UWG). Such consent may lie in the user having called for a specific keyword in the post itself, making clear who will get in touch and what will be sent, and in you commenting exactly that keyword. Whether that call was clear enough and whether the reply stays within its scope is the sole responsibility of the user as the advertising party; NetBaseOS neither knows the wording of the post nor reviews the content of the reply. If you do not wish to receive (further) automated messages, a corresponding statement in the chat is sufficient (e.g. „stop“); the block then applies permanently (Art. 21(2) GDPR). People who have neither written nor commented are not contacted through the module. If your comment triggers such an automated reply, we additionally record its wording in the user's consent record – as their legally required proof of consent (§ 7a UWG); the entry also names the keyword announced by the user and the identifier of the post. It is retained for five years and thus longer than the conversation itself (see “Retention period” at the end of this section).

Buttons underneath a message. On Telegram, the user can place buttons underneath an automated message. If you press one of them, Telegram transmits that click to us together with the keyword stored behind it. The click is treated as if you had written that keyword yourself: it is stored as your message in the conversation history and may trigger the flow listening for it. In addition we store the identifier Telegram assigns to that click, so that the same click is not processed twice. Nothing beyond the stored keyword is collected – in particular no information about your device.

The content, the trigger and the timing of these messages are determined solely by the user as controller; NetBaseOS sends them technically on their behalf and does not review their content. For the user, the legal basis is regularly the consent contained in the contact’s own enquiry, or Art. 6(1)(b) GDPR; for advertising content § 7(2) UWG applies in addition. Objection. If you, as a contact, no longer wish to receive automated messages, a corresponding message in the same chat is sufficient (e.g. „stop“ or „no advertising“). The module recognises such statements, records them in the consent log and then permanently blocks any further automated message to you (Art. 21(2) GDPR). A personal reply written by the user by hand remains possible, so that you can still receive a response.

Adding you to the user’s contact management. The user can add a contact from their inbox to their own contact management – either by hand or, if they have configured this in a flow, automatically as a step of that flow. This creates an entry as a prospect („lead“) in their account containing the display name or username used on the respective channel, the channel you reached them through, and – depending on the channel – your Instagram username, your email address or your Telegram username as a note. Message content is not carried over. The sole purpose is to be able to follow up with you as a prospect; the controller here, too, is the respective user. The legal basis is Art. 6(1)(b) GDPR (taking the steps you requested by sending your message) or Art. 6(1)(f) GDPR (legitimate interest of both sides in responding to your enquiry). Section 15 applies accordingly to the further processing of such entries.

Where this happens automatically, it does not constitute an automated decision in an individual case within the meaning of Art. 22 GDPR: an entry is merely created; no assessment, selection or profiling takes place and the entry has no legal effect on you. NetBaseOS sends no automated emails to an email address added in this way; whether and how the user contacts you is their own decision and their own responsibility (for advertising in particular § 7(2) UWG). The entry remains even if the associated conversation history is deleted later (see „Retention period“); you can request access, rectification and erasure from the respective user at any time.

Withdrawn and edited messages. If a contact withdraws an already delivered message on Instagram („unsend“), Meta notifies us; we then irreversibly delete its content – text and attachments. Only the empty entry with the note „message withdrawn“ remains, so that the conversation history does not develop unnoticed gaps for the user who has already read the message. If a contact subsequently edits a message on Telegram, we replace the stored text with the new version and mark the message as edited; the previous version is overwritten and not additionally retained.

Limits of the platforms. Telegram does not report withdrawals. If a contact deletes an already delivered message there, neither the user’s bot nor NetBaseOS receives any notification – the copy received earlier remains in the user’s inbox and we do not learn of the withdrawal. The same applies to the email channel: an email that has been delivered cannot technically be recalled. Likewise, none of the platforms reports when a conversation is archived there. A message that has already been received can therefore only be removed at the request of the user as controller. If you, as a contact, want a message you sent to a user to be deleted in NetBaseOS as well, please contact that user directly; we delete the conversations and messages concerned on their instruction without undue delay.

Disconnecting a channel. If the user disconnects a channel, we delete the credentials and unsubscribe from message delivery at the respective provider; new messages then no longer arrive. The contacts, conversations and histories received up to that point, as well as the consent record, remain in the user’s account – the latter deliberately, as it is their evidence under § 7a UWG.

Retention period. Within NetBaseOS the user, as controller, determines the retention period; they can delete individual messages, conversations and contacts at any time. In addition, fixed upper limits apply which a daily automated run enforces: conversations in which no message has been sent or received for 24 months are permanently deleted together with all messages and attachments; a contact that is then left without any conversation is deleted as well. If the user has previously added the contact to their contact management as a prospect or customer, that entry remains there – the associated conversation history is nevertheless deleted. The consent record is deleted five years after it was created; a declared objection to advertising is excluded from this and remains stored so that no further automated message reaches you (Art. 21(3) GDPR). Logs of completed automated flows are deleted after 90 days. These periods are upper limits, not minimum retention periods. Upon deletion of their account at the latest, all NetBaseChat data – channels, credentials, contacts, conversations, messages, flow logs and consent records – is deleted in full (see section 6). If the add-on module ends – because you end it, because your account moves to a plan below Team, or because your subscription ends – the channels you connected are disconnected without delay; from that moment no further messages are received. The conversations, messages and contacts already stored are permanently deleted seven days later. If you book the module again within those seven days, the deletion does not take place. The consent record is unaffected (§ 7a UWG).

Providers. The messages are technically exchanged via the platform of the respective provider: Telegram FZ-LLC (telegram.org/privacy) or Meta Platforms Ireland Ltd. for Instagram (privacycenter.instagram.com/policy). These providers are themselves responsible for their own processing; we have no influence over it. The user connects their own account in each case and maintains their own contractual relationship with the provider. For the email channel, receipt and dispatch via the user’s domain are handled by Resend Inc. (USA) (resend.com/legal/privacy-policy); in this respect Resend acts as a sub-processor on the basis of standard contractual clauses (see section 5 and our DPA at /avv).

24. Email notifications to you as a user

We send messages to the email address of your account in four clearly separated groups. A note at the end of each message tells you which group it belongs to.

1. Contract and account notifications (cannot be unsubscribed from). These include the confirmation of your registration, password resets, the confirmation of a change of your sign-in address that you have requested – sent to your previous and to your new address so that an unauthorised change is noticed –, confirmations regarding orders, payments, invoices, cancellation and the end of the contract, a one-off message immediately after you take out a paid plan with guidance on using the plan you booked (first steps with links into the application, without advertising further services), notices of failed payments, replies to your support requests, notices about security-relevant changes to your account (in particular when two-factor sign-in is enabled, disabled or removed by our support at your request), notices about the upcoming end of a free trial period or of a cancelled subscription and the resulting changes to your account, notices about the upcoming end of the year of a subscription billed annually (stating the date, the monthly price that applies afterwards or the start and price of a further year you have booked, and how to cancel), advance warnings before your account itself or content in your account is deleted at the end of a retention period, and the final notice about such a deletion, as well as – if you have a paid subscription – the announcement of a change to our Terms before it takes effect (with the essential changes, the date it takes effect and your right to terminate for cause; Terms, clause 13). To ensure that a notice about the end of a trial period or subscription or about a renewal does not reach you more than once, we store for your account which of these notices has already been sent for which end or renewal date; likewise, we store for which version of the Terms we have sent you an announcement. This information is deleted together with your account. These messages are necessary for the performance of the user agreement or are required by law; without them we could not inform you about the status of your contract and your data. Legal basis: Art. 6(1)(b) GDPR, in part Art. 6(1)(c) GDPR; for the security notices additionally Art. 6(1)(f) GDPR (legitimate interest in the security of your account and in detecting unauthorised access, Art. 32 GDPR). They cannot be unsubscribed from as long as your account exists; there is no exception within this group. If you take part in the affiliate programme, the notifications from that programme are added – they rest on a separate agreement, have their own way of switching them off and a different group of recipients, and are therefore described separately under number 4.

2. Recurring service emails about your own account (can be unsubscribed from at any time). This covers (a) the weekly summary, which contains only your own key figures from NetBaseOS (e.g. due follow-ups, open leads, upcoming appointments), and (b) a daily reminder about due appointments you scheduled yourself – follow-ups for your prospects and customers as well as reminders you noted about a partner in your network (section 16). This reminder is switched off by default: you only receive it if you expressly switch it on in your account settings. Once it is switched on, we send it only on days on which such an appointment or an anniversary (below) is actually due, and only if you are not already receiving the same information through a connected Telegram bot; we no longer remind you about an appointment that is more than 30 days in the past – this applies to all of these appointments alike, and the appointment remains in your account unchanged. Reminders about a partner are additionally reported to you inside the application and – if you have connected a Telegram bot – there as well, independently of this email; they may therefore reach you by more than one route. It lists up to five of the names concerned together with the reason you recorded: names from your own contact and customer management and – for a partner reminder – the name of the partner, the label “Partner” and the title you gave the reminder yourself. It contains no further details about these people, such as postal address, phone number or email address. Anniversaries. Reminder (b) also covers the anniversaries from the date fields of your additional customer profiles for which you selected “remind yearly” (for example the birthday of a customer’s pet). If such an anniversary falls on the current day, the message lists up to five of them with the name of the entry (for example the pet’s name), the customer’s name and the field label, and beyond that only their number; it does not contain the date itself, the values of other fields or any other details about the customer. In that case it is also sent on days on which no other appointment is due – at most once a day, only on the anniversary itself and without catching up later. Archived customers are excluded. It is delivered via our sending provider Resend (section 5); those names, reasons and anniversary details are transmitted to Resend for that purpose. Reminder at the scheduled time. If you have given a follow-up for a prospect or customer a time of day, we additionally remind you at the moment you have chosen – at the time of the appointment or up to one week before (default: 30 minutes before; changeable in your settings and per appointment). This reminder always appears as a notification inside the application and, if you have connected a Telegram bot, there as well; you receive it by email only if you have switched on reminder (b) – in that case even if it also reaches you via Telegram. It is part of reminder (b): same switch, same unsubscribe link, same legal basis. We remind you at most once per appointment; if you move the appointment or change the lead time so that the new reminder time is still in the future, we remind you at that new time. If the reminder time is already more than two hours in the past when you enter the appointment, or has been exceeded by more than three hours – for example after a technical fault – we do not send the reminder retrospectively. It states the time, the names and the reason you recorded (shortened) for the follow-ups due at that moment – without the limit of five names, but likewise without any further details about these people; it too is delivered via Resend. For this purpose we store, for each such appointment, the lead time chosen, the reminder time calculated from it and whether the reminder has already been sent, and, for your account, the default lead time. If you unsubscribe via the link in the weekly summary (a), we also treat this as a withdrawal of any consent to promotional emails under number 3 and log it. In addition, there is (c) a series of no more than four guidance emails limited to the setup phase, sent within the first weeks after your registration. Three of them explain how to use the functions you have set up (your public profile page, adding your first contact and scheduling a follow-up); on top of that there is a one-off reminder in case you started the setup wizard but did not finish it. We send each of these messages at most once and only for as long as the respective step is still open for you; for this we check solely whether an address has already been assigned to your profile page and whether that page has already been made public, whether any contact at all has been created in your account, whether a follow-up has been scheduled there and whether the setup wizard is recorded as completed for you – the names or content of your contacts are neither evaluated nor included in the message. The series ends by itself no later than 21 days after your registration. So that the same message does not reach you more than once, we record for your account which stage was last sent and whether the one-off reminder about the setup wizard has already been sent. None of these messages contains advertising for paid offers. The legal bases and your right to object are set out in the paragraph below. Every such message contains an unsubscribe link. The three types (a), (b) and (c) can be unsubscribed from separately: unsubscribing from the weekly summary takes away neither the reminder about your own appointments nor the setup guidance – and vice versa. The one-off reminder about the setup wizard is part of the setup guidance and is covered by unsubscribing from it. Which messages an unsubscription covers is stated on the confirmation page of the link you clicked. All three types can additionally be switched on and off individually at any time in your account settings; the daily reminder (b) has to be switched on there in the first place.

Legal bases for number 2 and your right to object. We send the weekly summary (a) and the setup guidance (c) on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Both are useful, but they are not necessary for providing your account; we therefore deliberately do not rely on performance of the contract (point (b)). Our balancing: our interest is that a tool which has been set up can actually be used – the setup guidance explains precisely the steps that are still open for you, and the weekly summary puts your own open items in front of you. Against this stands your interest in not receiving unsolicited mail. To balance the two, both are kept narrow: at most four setup guidance emails, which end by themselves after 21 days, and at most one summary per week; they contain no advertising, use only data that is in your account anyway, are not evaluated for any further purpose and are not passed on to third parties; every message carries an unsubscribe link, and you can additionally switch them off in your settings at any time. Since after registering you must expect messages about your own account, in our assessment your interests or fundamental rights do not override this processing; in your individual case this may be different – that is what the right to object is for.

Your right to object (Art. 21 GDPR). You may object at any time to processing based on Art. 6(1)(f) GDPR – on grounds relating to your particular situation, without any formality and without any disadvantage for you. The unsubscribe link in the message concerned and the corresponding switch in your account settings are the easiest way to do so; an informal message to kontakt@netbaseos.de is equally sufficient. We will then stop sending. We additionally point out this right explicitly and separately in every message concerned (Art. 21(4) GDPR). See also section 7.

Exception within number 2: the daily reminder (b). For it, Art. 6(1)(b) GDPR continues to apply. You set the appointment yourself and you switch the reminder on yourself – it is therefore the service you ordered and not merely useful (clause 3 of the Terms). There is no right to object under Art. 21 GDPR on this legal basis; instead you can switch the reminder off again yourself at any time – via the unsubscribe link or in your settings – with the same result. Where the name of a partner appears in it: the foregoing concerns you as the recipient of the message. If it names a partner because you set yourself a reminder about them, that partner is themselves a user of NetBaseOS and therefore a data subject in their own right. In relation to them, this processing is not based on your contract but on our legitimate interest in cooperation within the existing team/network relationship (Art. 6(1)(f) GDPR); they may object to it under Art. 21 GDPR. What is processed in this context, and what a partner learns about it, is set out in section 16. If you receive the weekly summary (a) through a Telegram bot you have linked rather than by email, this is based on your voluntary linking; you can end it at any time in your settings (section 11).

Also part of number 2 is (d): the notification of new contact requests. If someone gets in touch through the contact form of your funnel, your landing page or your profile page (section 15), we notify you by email. The message states the person’s name, the page through which they got in touch (for funnels and landing pages with the name you gave the page) and whether they left an email address and/or phone number; it deliberately does not contain their contact details themselves, a postal address, a message or any survey answers – you will find these only in NetBaseOS under “Leads”. The notification is switched on by default; you can switch it off at any time via the unsubscribe link in each message or in your account settings, and switch it back on there. Unsubscribing covers this notification only; the other messages under number 2 are not affected, and your enquiries are not lost – they remain in the application. So that a form filled in on a massive scale does not flood your inbox, we send at most 20 such emails per hour; further enquiries in that hour appear only in the application (and on Telegram, if connected). For this we briefly count the emails sent to your account (deleted after 24 hours). If you use the free plan, from the eighth lead onwards the message additionally states how many of the 10 possible leads are in use, what happens when the limit is reached and that this limit applies to the free plan only; for this purpose the number of your leads is determined when the message is sent. The message contains no advertising. It is delivered via our sending provider Resend (section 5). The legal basis is Art. 6(1)(b) GDPR: the contact form is a function you have set up whose purpose is that enquiries reach you; notifying you that an enquiry addressed to you has arrived is part of that service. There is no right to object under Art. 21 GDPR on this legal basis; instead you can switch the notification off yourself at any time, with the same result. For the person who got in touch, their name in this message is part of their contact request, which we process on your behalf (section 15, DPA clause 3). Handed-over enquiries: If a user from your upline hands an enquiry over to you (section 15), we likewise notify you by email. The message then names the person who handed it over instead of the page, likewise contains no contact details and points out your obligations as recipient (Terms, clause 7); it counts towards the same maximum and is switched off with the same unsubscribe link or setting. The legal basis here, too, is Art. 6(1)(b) GDPR (part of the function for receiving handed-over enquiries); for the name of the person handing it over, section 16 applies (Art. 6(1)(b) and (f) GDPR).

3. Promotional emails (only with your express consent). Emails intended to persuade you to book or continue using paid features, to win you back after a longer absence, or advertising offers, news and campaigns are sent only if you have previously given us separate consent for this (§ 7(2) no. 2 UWG, Art. 6(1)(a) GDPR). This consent is voluntary: it is neither a prerequisite for registration nor for using the service, and it must be given separately from your acceptance of the Terms and the Privacy Policy. You can withdraw it at any time with effect for the future – via the unsubscribe link in every such email or in your account settings; withdrawal is as easy as giving consent. The lawfulness of processing carried out until withdrawal remains unaffected (Art. 7(3) GDPR).

4. Notifications from the affiliate programme (separate agreement, separate way to switch them off). If you take part in the affiliate programme (section 13), we inform you about the events that concern the credit arising for you there: a person registering via your referral link, a commission being credited (including from the second level), reduced pro rata, reversed or reinstated, the payout, and reaching or adjusting your commission tier or being warned about an upcoming adjustment. These messages contain no advertising: they state the status of your credit and the rule by which it is calculated – including where that rule ties in with your own subscription – but they do not call on you to book or continue a paid plan and do not state any prices. Legal basis: Art. 6(1)(b) GDPR (performance of the separate affiliate participation agreement); for the billing-related notifications additionally Art. 6(1)(c) GDPR. They are not part of the user agreement and only reach participants of the programme; if your participation ends, they end too. We do not send notifications that mean no change for you: if a tier change alters neither the commission rate to be settled nor access to the second level, the email about it is omitted; a warning about a downgrade that is inconsequential in this sense is omitted entirely. Switching them off: you can switch off their delivery by email – separately for referral notices and for commission notices – in your affiliate area at any time; the notifications about your commission tier count as commission notices here. The corresponding notice inside the application remains regardless of any unsubscribe, so that no information about credit that has arisen or been withdrawn is lost to you.

Proof of your consent. If you give or withdraw consent under no. 3, we log this in append-only form (existing entries are not overwritten): the time, whether given or withdrawn, the consent text shown to you including its version, where you declared it (e.g. registration, settings, the prompt inside the application or the unsubscribe link in an email), and the IP address and browser identifier (user agent). The sole purpose is the proof incumbent on us (Art. 7(1) GDPR; under § 7(2) UWG the burden of proving consent to advertising lies with the advertiser). Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR, and Art. 6(1)(f) GDPR (legitimate interest in tamper-evident documentation). We keep the record until three years after the end of the calendar year in which the consent was withdrawn or last used (limitation period, §§ 195, 199 BGB), at the latest until your account is deleted.

No disclosure of your address for advertising purposes. Your email address is not passed on or sold to third parties for their advertising purposes. Resend is used for the technical dispatch (section 5). If you object to the use of your address for advertising, we block it for this purpose permanently; for this we retain only the information required to enforce the block (Art. 21(3) GDPR).

Not covered are messages that other users send to you via NetBaseOS (e.g. your upline as part of onboarding support, section 16) or that you send to your own contacts as controller (section 23). The sending user is responsible for those. What persons with assistant access to your account receive is described in section 27.

25. Name list (“contact game”): names of people from your circle

The name list is a memory aid for your own sales work: a guided “contact game” asks you around 45 recall questions one after the other (e.g. “Who was at the last family celebration?” or “Who cuts your hair?”), and you write down the names that come to mind. The list is a preliminary stage: a name on it is not yet a contact and not yet a prospect, and no outreach takes place through the list itself – neither by you nor by NetBaseOS.

Deliberately, only the bare minimum is stored: the name you enter (max. 80 characters), the category of the question that brought it to mind (e.g. “school”, “work”, “service providers”), the time it was recorded and – as soon as you convert the name into a prospect entry (lead) – the link to that entry. Not collected are telephone numbers, email or postal addresses, notes, assessments or ratings; there is deliberately no notes field here. The names are neither analysed nor combined with other data, they are not transmitted to third parties and are not passed to the platform’s AI features (section 5). No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Controller for this list is – as for your other contact, prospect and customer data – the respective user who enters the names, not NetBaseOS. NetBaseOS merely provides the technical platform and processes the names exclusively on that user’s behalf and on their instructions (processing on behalf under Art. 28 GDPR, see our DPA at /avv, clause 15 there). The list is visible only to the respective user; for the operator it is technically blocked – like contacts, leads and notes (section 12).

Legal basis. For you as user and controller this is regularly your legitimate interest in preparing your own business outreach (Art. 6(1)(f) GDPR): all that is recorded is a name from your own memory together with the category, in an area accessible only to you and without any assessment of the person. Whether your interest outweighs the interests of the person named must be assessed by you as controller in each individual case. A purely private name list would not fall under the GDPR (household exemption, Art. 2(2)(c) GDPR); since the list here serves to prepare a sales activity, that exemption regularly does not apply. NetBaseOS itself processes the names on your behalf in order to perform the user agreement (Art. 6(1)(b) in conjunction with Art. 28 GDPR).

Informing the people named (Art. 14 GDPR). The names do not come from the data subjects themselves; at first they know nothing about being recorded. The obligation to inform them therefore rests with you as controller and not with NetBaseOS. It must be fulfilled within the time limits of Art. 14(3) GDPR – in principle within one month (lit. a), but at the latest when you first approach the person (lit. b); whether an exception under Art. 14(5) GDPR applies in an individual case (e.g. disproportionate effort where you have no means of contact at all) must be assessed by you as controller. In practice this means: tell the person that you noted their name, where it came from and for what purpose. NetBaseOS has no contact details whatsoever for these people and therefore cannot notify them itself.

Rights of the people named. If you are a person named and wish to exercise access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) or objection (Art. 21 GDPR), please contact the user who noted your name; we support them technically. That user decides on an objection as controller – in the case of a mere note of a name without any further details, they will regularly have to comply with it by deleting the entry, as there will hardly be any compelling legitimate grounds on their side.

Storage period. You as controller decide on the duration: you can discard any name at any time. In addition, a fixed upper limit applies, enforced by a daily automatic run: an open name that has been neither converted into a prospect entry nor discarded twelve months after it was recorded is permanently deleted. There is no separate warning before this period expires; how long a name has been open is shown in the list at all times. This period is an upper limit and not a minimum storage period – names that are no longer needed must be deleted by you earlier as part of your own storage limitation obligation (Art. 5(1)(e) GDPR). The list is built as a queue and not as a second contact management system – names left untouched for more than 30 days are marked as pending for you, and a maximum of 100 open names per account is possible; after that you have to decide (convert or discard). If you convert a name into a prospect entry, section 15 applies to that entry; the row in the name list then remains solely as protection against duplicate entry, is no longer shown to you and is not covered by the twelve-month period. Names that are no longer needed must be deleted by you as part of your storage limitation obligation (Art. 5(1)(e) GDPR). When your account is deleted, the entire name list – including rows already converted – is deleted in full (section 6).

26. Cooperations with direct sales and network marketing companies (official content, unlock code and totals)

Cooperations. NetBaseOS may cooperate with individual direct sales or network marketing companies. Such a company can store its own links to its own content (e.g. product catalogue, price list, training portal), which is shown to you labelled “Official from …”. What such a cooperation covers – and above all what it expressly does not cover – is set out in the Terms, clause 2. The company receives no access to your account and to none of the content stored in it; in particular it does not see your contacts, prospects, customers, notes or messages.

Your company entry in the profile. In your settings you can state which company you work for. You choose this entry yourself; we do not verify it. It only controls which official content is shown to you and has no effect on your plan, your price or your features. Legal basis: Art. 6(1)(b) GDPR. You can change or remove the entry at any time.

Unlock code. If your company gives you an unlock code and you enter it in your settings, we store the fact that you belong to that company and the time of entry. Only then is the official content intended solely for confirmed sales partners shown to you. Entering the code is voluntary: it is not a requirement for using NetBaseOS, for a plan or for a feature. Legal basis: Art. 6(1)(b) GDPR. If an entry is revoked, the row remains with the time of revocation so that it stays traceable who had access to which content and when; it is deleted at the latest together with your account (section 6).

What the company gets to see – totals only. A cooperating company receives its own access, separate from that of its sales partners. There it sees three figures relating to its own company: (1) how many people have entered its unlock code, (2) how many active accounts have selected this company in their profile and (3) how many of the unlocked people were active in the application within the last 30 days – what counts is the time of the last activity in the signed-in area (section 12), not a sign-in. It sees no names, no e-mail addresses, no lists and no information on individual persons, and it cannot withdraw anyone’s access. We show all three figures only from five people onwards; the third is only calculated at all from twenty unlocked people onwards – below that it is not computed, not merely not displayed – and above that threshold it is rounded down to steps of five, so that a single additional person cannot be read from it.

Legal basis and balancing for these totals. We base the compilation of these figures on Art. 6(1)(f) GDPR (legitimate interest of the company and our own interest in giving a cooperation a reliable basis without disclosing individuals). There is no disadvantage for you: no information relating to you is passed to the company, only an overall number; an assessment of your work, performance or attendance monitoring, a ranking, profiling and automated decision-making within the meaning of Art. 22 GDPR do not take place and are not possible with these figures. You may object to this processing at any time under Art. 21 GDPR (section 7); we will then exclude you from the count without any disadvantage for you.

Funnel templates of a cooperating company. A cooperating company can also provide ready-made funnel pages as templates. They are shown only to people who have entered that company’s unlock code, and only after we have approved them. If you adopt such a template, an independent copy of the texts and images is created in your account; the company learns nothing about it – we do not report to it who adopted a template or how often that happened. From that point the copy is yours: you can change, publish and delete it, and it remains in place if the cooperation ends or the company withdraws the template. Addresses, identifiers and contact details of the creator are not transferred. Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement). You are responsible for the page you publish – details in the Terms, section 7.

Origin of and responsibility for the official content. The title, description and target address of an entry labelled “official” come from the respective company and not from NetBaseOS. We approve such an entry before it is displayed; this approval only concerns whether it may appear as official and is no guarantee of the accuracy or lawfulness of the linked content. If you click such a link you leave our service; from that point the privacy policy and responsibility of the provider there apply, and your IP address is transmitted there for technical reasons (see also section 14). We do not report to the company who clicks its links and keep no personal click statistics for this purpose.

Enquiry from a company via our public page. On the page netbaseos.de/fuer-unternehmen a person acting for a company can enquire about a cooperation. We only collect the details entered there: company, company website, name, function within the company, e-mail address, optionally a telephone number and the text of the enquiry. No account is required. The purpose is solely to review the enquiry, answer it and, where appropriate, arrange a call. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at the request of the data subject) and, for warding off abusive and automated submissions, Art. 6(1)(f) GDPR. Recipients: the enquiry is reported to the operator’s contact address and an acknowledgement is sent to the address given; for this we use our e-mail service provider as a processor (section 5). There is no disclosure beyond that, in particular not to other companies. We do not send advertising e-mails in response to such an enquiry. Storage period: if no cooperation comes about, we delete the enquiry no later than twelve months after it was received; if a cooperation does come about, it becomes part of the cooperation records and is subject to the retention periods applicable to them. The details can be viewed in the admin area only (section 12) and are technically inaccessible to platform users.

Data of the people acting for the company. Before we list a company as verified, we speak with a person acting for that company. For this we store the time of the check, who carried it out on our side and a short note on who was spoken to, in what function they appeared and what they evidenced. If the company receives its own access, we additionally store the e-mail address of the account used for it as well as the time it was granted and of any later withdrawal. Where the name, function or contact details of the acting person do not come from the enquiry form but from the conversation, from an e-mail or from publicly available information of the company, we process them for the same purposes and on the same basis. Purpose is to document what the “official” label is based on. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. These details are visible in the admin area only (section 12) and are deleted once the cooperation has ended and their documentation is no longer needed as evidence, at the latest after the statutory retention and limitation periods have expired.

27. Assistant access (Enterprise plan)

Users with the Enterprise plan can set up separate access to their account for up to two persons (more by individual agreement with us) who support them in their own business (“assistant access”, Terms, clause 3). This section is addressed to both sides: the user who sets up the access (“account holder”) and the invited person (“assistant”). An assistant receives their own login credentials but no user account and no profile of their own; they work exclusively in the account holder’s account.

What data we process about an assistant. The name and email address provided by the account holder in the invitation; the login credentials – the password only as a hash – and the sign-in data kept technically by our authentication service, such as the time of the last sign-in (Supabase, section 5); the times of the invitation and its acceptance; whether the access is active or paused; the switches for reminders by email and by Telegram set by the account holder; whether and when the assistant has unsubscribed from reminder emails; their Telegram chat ID if they connect the bot (section 11); for entries they create in the account – customers, prospects, contact entries, appointments and partner notes – the identifier of their access as creator, displayed in the account with the word “by” and their name; the team activity entries on their actions (see below); for a support request they create, the identifier of their access (section 21); and IP address and technical connection data as with any use of the application (sections 2 and 5).

What the account holder sees about the assistant. Name, email address, whether the invitation has been accepted, whether the access is active, the reminder switches, whether Telegram is connected and whether the assistant has unsubscribed from reminder emails, as well as the creator marking on entries and the team activity (next paragraph). We do not show them the assistant’s sign-in times or chat ID. We do not log what an assistant merely views in the account in relation to the assistant as a person; technical server logs under section 5 and the area statistics under section 29, which attribute the assistant’s visits to the account without distinction, remain unaffected.

Team activity. As long as an account has at least one active (not paused) assistant access whose invitation has been accepted, and the account’s Enterprise plan is running, we automatically log certain actions in that account, both those of the assistant and those of the account holder: creating, deleting, archiving and restoring leads and customers, converting a lead into a customer, customer imports (as a number), status changes (previous and new status), changes of responsibility (with the name of the person now responsible), recording a contact (only its type, e.g. call, meeting or note), and creating a follow-up (with its due date) and completing it, as well as merging two leads or two customers into one entry (with a copy of the name of the entry deleted in the process; the individual changes triggered by the merge are not logged separately). For each entry we store the acting access, the type of action, the time, the lead or customer concerned together with a copy of their name at the time of the action, and the details of the action mentioned. Leads that come in without any person’s involvement (e.g. via a form) are recorded as an automatic receipt without an acting person. We do not store the text of notes and contact entries, the reason for a follow-up or any other content; what someone merely views is not logged. Accounts without such an access or without a running Enterprise plan log nothing; if all accesses are paused or the Enterprise plan ends, logging stops, while existing entries remain until their period expires (below). Who sees what: The account holder sees all entries of their account as well as an overview of how many contacts, leads and customers each person has recorded or created in the last seven days. An assistant sees only their own entries on their “My access” page, where they are also informed about the logging. Purpose, responsibility and legal basis: The log is intended to enable the account holder to trace who has worked on which leads and customers in their account – for example to coordinate the work and to fulfil their obligations towards the persons whose data they store (Art. 29, Art. 32(4) GDPR). The controller for the log is the account holder; we process it on their behalf (DPA, clause 16) and do not evaluate it for our own purposes. Towards the assistant, the account holder bases the processing on Art. 6(1)(b) or (f) GDPR, depending on their relationship with them; if the assistant is employed by them, they must additionally observe the rules on employee data protection (Art. 88 GDPR, Section 26 of the German Federal Data Protection Act – BDSG) and involve any existing works council. They are obliged to inform the assistant about the logging before the invitation (Terms, clause 3). The assistant can exercise their rights under section 7 against the account holder; if they contact us, we forward the request to the account holder and support them in responding. Storage period: Each entry is automatically deleted twelve months after it was created, and immediately when the account holder’s account is deleted. If a lead or customer is deleted, an entry with the copy of their name remains until this period expires; on the account holder’s instruction, for example following an erasure request by the data subject, we also delete entries earlier (DPA, clause 16). If the account holder removes an assistant access, the entries on that assistant’s actions also remain until the period expires; the acting person is then only shown as “Former assistant”, but a name recorded in a change of responsibility remains in that entry.

What the assistant sees of the account. The assistant works with the account holder’s business data – dashboard, customers, prospects, follow-ups, team and partners, onboarding journeys, events, resources, Relationship Guard, analytics and support requests – and sees the account’s in-app notifications except for messages from the affiliate programme; in addition, the account holder’s name, plan and points. Subscription and payment, the account holder’s settings and login credentials, the affiliate programme, the phone PIN, funnel pages, landing pages, profile pages and NetBaseChat are not accessible to them. The account holder remains the controller for the data of contacts, customers and partners; the assistant is a person acting under their authority who may process this data only on their instructions (Art. 29 GDPR), and we continue to process it on the account holder’s behalf (DPA, clause 16).

Purpose and legal basis. The purpose is to provide the assistant access: invitation, sign-in, assignment to the account, restriction to the released areas, marking of authorship and delivery of the reminders switched on by the account holder. Towards the account holder, this is part of the Enterprise plan they have booked (Art. 6(1)(b) GDPR; Terms, clauses 3 and 4). Towards the assistant, who is not our contractual partner, we base the processing on Art. 6(1)(f) GDPR: the account holder has a legitimate interest in being supported in their business by persons they trust, and we have a legitimate interest in providing this service securely – with separate login credentials per person instead of a shared password. This is weighed against the assistant’s interests; we therefore limit the processing to what is necessary for the access, do not use the data for advertising, do not evaluate their activity for our own purposes and do not send them advertising, summary or setup emails. An access only comes into existence once the assistant sets a password themselves. For the team activity, the paragraph “Team activity” applies.

Source of the data. The assistant’s name and email address come from the account holder who invited them (Art. 14 GDPR). We then send them an invitation email referring to this privacy policy; the link it contains for setting the password is valid for one hour. If the assistant did not expect the invitation, they can ignore the email – without a password, no access is created. The invitation counts as accepted as soon as the assistant opens the application with their access for the first time. If this does not happen within 30 days of the invitation, we automatically delete the access together with name and email address; if the account holder resends an invitation that has not yet been accepted, the 30 days start again. The data is deleted earlier if the account holder removes the access or their account is deleted; in addition, the assistant can request deletion from us at any time (kontakt@netbaseos.de).

Reminders to an assistant. The account holder can switch on, per assistant, that the assistant receives the reminders at the time of the account holder’s follow-ups (section 24, no. 2, letter b) by email and – if they have connected the bot – via Telegram. Both are switched off by default. They are only sent if the assistant has accepted the invitation, their access is active, the account has the Enterprise plan and – for emails – the assistant has not unsubscribed. The reminder contains the same details as the account holder’s: time, names and the stated reason of the upcoming follow-ups. These details are the account holder’s data about their contacts; delivery to the assistant takes place on the account holder’s instruction, given by switching it on (DPA, clause 16). For sending, the assistant’s email address and the content of the message are transmitted to Resend (section 5), or the chat ID and the content to Telegram (section 11). An assistant does not receive other messages to the account holder – such as the daily reminder, the weekly summary, setup tips, contractual notices or promotional emails.

Objection by the assistant to reminder emails (Art. 21 GDPR). As an assistant, you can unsubscribe from the reminder emails yourself at any time – via the unsubscribe link in each such email or on your “My access” page in the application; an informal message to kontakt@netbaseos.de is equally sufficient. The account holder cannot reverse this; only you can allow the emails again under “My access”. You end reminders via Telegram by disconnecting Telegram on your “My access” page – your chat ID is deleted immediately – or by stopping or blocking the bot in Telegram; you can also informally request the deletion of your chat ID from us at any time. In addition, you can object to the processing of your data under Art. 21 GDPR (section 7); since an assistant access cannot exist without this data, a justified objection may result in the access being removed. Your other rights under section 7 also apply to you.

Storage period. We store the data on an assistant access for as long as the access exists. A paused access remains stored. We automatically delete an invitation that has not been accepted after 30 days (see “Source of the data” above). If the account holder’s Enterprise plan ends, the assistant no longer has access to the account and no longer receives reminders; the data on the access remains stored until the account holder removes it or their account is deleted, so that the access can become effective again if the plan is booked again. If the account holder removes the access, we delete the assistant’s login with all details of the access including any Telegram chat ID, and the creator marking on the entries they created is removed; the entries themselves remain as the account holder’s data. Team activity entries are subject to the twelve-month period (paragraph “Team activity”). If the account holder’s account is deleted, all of their assistant accesses are deleted with it (section 6). The identifier in a support request is deleted together with the request (section 21). If, as an assistant, you no longer wish to take part, ask the account holder to remove your access or contact us; we will then remove it.

28. User testimonials on our homepage

On our homepage we show selected statements from people who use NetBaseOS ("testimonials"). We make the selection ourselves; it is not a complete or representative collection of reviews. We only publish a testimonial if the person quoted uses or has used NetBaseOS and has agreed to its publication in advance. Statements are reproduced word for word in their original language.

What data. The quote, the name in the form the person has agreed to (usually first name and abbreviated surname), optionally a description of their activity, optionally a photo they provided to us for this purpose, where applicable a note on a special relationship with us (such as participation in the affiliate programme, free or discounted access, or co-founder status), and the date of consent. We store this data with Supabase (section 5); photos are stored in reduced size and delivered for display from a publicly accessible storage location. Only the operator has access to the administration, not other users.

Purpose and legal basis. The purpose is to present experiences with NetBaseOS on our website (advertising our service). The legal basis is the consent of the person quoted (Art. 6(1)(a) GDPR), and for the photo also Section 22 of the German Art Copyright Act (KUG). If the person has a special relationship with us, we are legally required to disclose this (Section 5a(4) German Unfair Competition Act, UWG); in that case we only publish the testimonial together with this note.

Withdrawal and retention. Consent may be withdrawn at any time with effect for the future, informally, e.g. to kontakt@netbaseos.de. We then remove the testimonial from the website without undue delay and delete the quote, name, activity description, photo and note; the lawfulness of publication until withdrawal remains unaffected. We then keep the proof of consent (the confirmation by e-mail or message) only to the extent necessary to defend against possible claims, at most until the regular limitation period expires (Art. 6(1)(f), Art. 17(3)(e) GDPR). We have no control over copies already made by third parties, such as search engines or web archives. In all other respects, the person quoted has the rights set out in section 7.

29. Usage statistics for app areas

To improve NetBaseOS, we record which areas of the application are used – for example the dashboard, customers, leads, funnels or settings. This shows us which features are needed, where new users get stuck and what is used with and without a paid plan.

What data. When you open an area from a list fixed by us in the signed-in area, we store one entry per account, area and calendar day: your account ID, the area (only its name, not the address visited), the date without the time of day, your plan status on that day (free, trial, unlocked by your sponsor or by us, paying) and how often the area was opened on that day. We do not store content, times of day, the order of visits, time spent, IP addresses or device information with these entries; technical server logs under section 5 remain unaffected. If an assistant works in your account (section 27), their visits are attributed to your account without recording who opened the area.

Nothing on your device. For this recording we set no cookies and store nothing in your browser’s storage (such as local storage or session storage); no third parties are involved. When you switch to an area, the application merely tells our server which area was opened.

Who sees the evaluation. The entries are evaluated exclusively as totals across all accounts – for example, how many accounts opened an area in the last 30 days, broken down by plan status, and how many newly registered accounts used it in their first seven days. These totals are visible only to the controller and to the persons commissioned by the controller in the admin area to whom these figures have been released (section 12) – not to other users and in particular not to your sponsor, your upline or your team. There is no evaluation per person, no usage profile, no performance or attendance monitoring, no advertising based on this data and no automated decisions about you. If a group is very small – for example, when there are only a few paying accounts – a total may still allow conclusions about individual accounts; even then, we use it solely for decisions about the further development of the service.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest is to develop the service in line with actual needs and to see which features are used. The recording is limited to what is necessary (area and day instead of address and time), is evaluated only as totals and is deleted automatically; according to our balancing of interests, your interests therefore do not override ours.

Storage period. Each entry is deleted automatically twelve months after the day concerned, and otherwise together with your account (section 6).

Objection (Art. 21 GDPR). You can object to this recording at any time (section 7); no reason is required. An informal message to kontakt@netbaseos.de is sufficient. We will then exclude your account from the recording and delete the existing entries for your account.