Newsletters, User Community and Similar Offers

User Community

If you register for our user community at https://community.21strategies.com/, we process the personal data required for this purpose (in particular email address and username) for the provision and management of your account on the basis of Art. 6(1)(1)(b) GDPR.

If you additionally wish to consent to the sending of our newsletter during registration, we obtain your separate consent by means of a double opt-in procedure. The legal basis in this respect is Art. 6(1)(1)(a) GDPR. You may withdraw this consent at any time with effect for the future without affecting the lawfulness of the processing carried out up to that point. You can declare the withdrawal via the account settings of the community or informally by email to hello@21strategies.com.

To permanently delete your community account, use the “Log out” function in your account or contact hello@21strategies.com.

Newsletter

To the extent that you are in an existing business relationship with 21strategies, we may send you newsletters under the conditions set out in § 7(3) UWG. The legal basis for the data processing is Art. 6(1)(1)(f) GDPR in conjunction with § 7(3) UWG. Our legitimate interest consists in informing our existing customers about product updates, new developments and general developments relevant to the service used.

If you no longer wish to receive the newsletter, you can unsubscribe at any time via the unsubscribe link at the end of each newsletter email or by email to hello@21strategies.com with the subject line “Unsubscribe newsletter”.

Contact forms

The websites of 21strategies offer contact and/or mailto fields through which you can get in touch with us. When you use this offer, you will be asked to enter personal data necessary for the processing of your request. We collect at least your email address (mandatory). Further, optional information may include: salutation, name, telephone number, company, postal address.

The legal basis for data processing is Art. 6(1)(1)(b) GDPR where your request is directed at the conclusion of a contract or the implementation of pre-contractual measures. For other requests, we base the processing on Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in the processing and responding to contact requests.

Ongoing Contact with Prospects, Partner Companies, Customers, Service Providers

In the context of initiating, executing and following up on business relationships, 21strategies collects and processes personal data from contact persons at prospects, customers, partner companies and service providers. This includes in particular data arising in connection with pre-contractual measures, the performance of contracts and subsequent support and quality assurance – for example contact details from business cards or emails that are recorded in our CRM system.

The following categories of data may be processed:

• First and last name
• Business contact details (e.g. email address, telephone number, business address)
• Company-related data (e.g. company name, industry, company size, function/position, department)
• Data on contractual transactions and enquiries (e.g. quote number, service interests, enquiry and transaction history)
• Communication and interaction data (e.g. appointments, meeting notes, event participations, communication history)

The legal basis for data processing is Art. 6(1)(1)(b) GDPR where the processing is necessary for the performance of a contract or the implementation of pre-contractual measures. Otherwise, we base the processing on Art. 6(1)(1)(f) GDPR. Our legitimate interest consists in the efficient organisation of our business relationships, targeted B2B communication and the maintenance and further development of our products and services.

Contacting Our Customer Support

When you contact our employees, we process your personal data to address your concerns. We also process your data to analyse the quality of our customer support after the contact.

You may contact us at any time with questions by email to individual employees known to you or generally via the email hello@21strategies.com.

We store your request in a ticket system to process it and to make our service comprehensible and improve it. Personal information is only used to process your request.

The legal basis for the processing of the data is Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to customer enquiries and improving our support offering. Where contact serves the conclusion or performance of a contract, Art. 6(1)(b) GDPR is the legal basis.

Social Media

21strategies maintains online presences on LinkedIn and Meta (Facebook/Instagram) to communicate with prospects and customers and to provide information about products and services. In the context of these presences, personal data is processed, including demographic information (e.g. age, gender), professional information (e.g. industry, professional experience), interaction data (e.g. likes, shares) as well as usage statistics and content preferences.

The legal basis for processing is Art. 6(1)(b) GDPR where the communication serves the performance of a contract or pre-contractual measures. Otherwise, Art. 6(1)(1)(f) GDPR is the legal basis. Our legitimate interest consists in the targeted communication with prospects and customers as well as the analysis and further development of our online presences.

With regard to the processing of usage data on our company pages (so-called Page Insights), we are joint controllers with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, within the meaning of Art. 26 GDPR. The joint controllership concerns the collection and evaluation of usage data to generate page statistics. LinkedIn and Meta assume primary responsibility for fulfilling data subject rights and providing information. The essential content of the respective agreements can be found in LinkedIn’s Joint Controller Addendum and Meta’s Page Controller Addendum. The relevant links are provided at the end of this section.

We note that we have no influence over the independent data processing carried out by the platform operators. When you visit our online presences, usage data may be transferred to the platform operators and used by them for their own purposes. Data subject rights can be asserted directly against the respective platform operators.

The storage duration is governed by the privacy policies of the respective platforms, over which we have no influence.

Further information: https://legal.linkedin.com/pages-joint-controller-addendum and https://www.linkedin.com/legal/privacy-policy.

Applications

When you apply to 21strategies, we process your personal data exclusively for the purpose of applicant selection and the possible establishment of an employment relationship. Application documents received directly by email are transferred for further processing to our applicant management software JOIN (JOIN Solutions GmbH, Schönhauser Allee 36, 10435 Berlin), which we use as a processor pursuant to Art. 28 GDPR.

In the course of the application process, we process the documents and information submitted by you, in particular name, email address, telephone number, curriculum vitae, cover letter and further documents provided by you. In addition, technical data such as IP address, browser type and version, operating system and date and time of access are recorded when the application portal is accessed.

The legal basis for processing is Art. 6(1)(1)(b) GDPR for the implementation of pre-contractual measures. We base the processing of technical access data on Art. 6(1)(1)(f) GDPR. Our legitimate interest consists in the secure and efficient provision of the application portal.

We store your personal data until the conclusion of the application process. In the event of rejection, your data will be stored for a further six months after notification of the decision. Further retention, e.g. in a talent pool, only takes place after rejection and only with express consent. In the event of legal proceedings, a longer retention until final resolution may take place. Upon hiring, your application documents will be stored in the personnel file for the duration of the employment relationship.

Recipients of the Data

Personal data collected by us is generally only passed on if:

• you have given us your express consent pursuant to Art. 6(1)(a) GDPR,
• the transfer is necessary to safeguard our legitimate interests or to assert, exercise or defend legal claims and there is no reason to assume that your overriding interests or fundamental rights and freedoms requiring the protection of personal data prevail (Art. 6(1)(f) GDPR),
• we are legally obliged to disclose the data (Art. 6(1)(c) GDPR), or
• it is legally permissible and necessary for the performance of a contract with you or the implementation of pre-contractual measures at your request (Art. 6(1)(b) GDPR).

Possible recipients include:

• Processors: Group companies or external service providers (e.g. in the area of technical infrastructure, maintenance and other services) who are carefully selected and monitored. Processors may only process the data in accordance with our instructions.
• Public authorities: Authorities and governmental institutions (e.g. tax authorities, public prosecutors, courts) to whom we must transmit personal data, for example to fulfil legal obligations or to protect legitimate interests.

Transfer to Third Countries

21strategies ensures that all data is processed in the EU or the European Economic Area (EEA) wherever possible. Transfers of data to third countries outside the EU or the EEA are carried out by 21strategies only on the basis of Art. 44 et seq. GDPR. As our preferred transfer basis, we use adequacy decisions of the EU Commission pursuant to Art. 45 GDPR, which establish that certain third countries offer a level of data protection comparable to the EU – including, for example, US-based companies certified under the EU-U.S. Data Privacy Framework. Where no adequacy decision exists for a destination country, we base the transfer on appropriate safeguards pursuant to Art. 46 GDPR, generally on the EU Commission’s standard contractual clauses. Only in exceptional cases, such as with your express consent following prior information about the associated risks, may a transfer take place on the basis of Art. 49 GDPR.

Automated Decision-Making

Your personal data will not be used for automated individual decision-making including profiling pursuant to Art. 22(1) and (4) GDPR.

Retention Period

Personal data is only retained for as long as is necessary to fulfil the purposes stated herein, or as provided for by the retention periods prescribed by the legislator. After the respective purpose ceases to apply or after expiry of the retention periods, the data is deleted in accordance with the statutory provisions. Emails with tax-relevant content (cf. § 147 Tax Code) are subject to a retention period of 10 years. Emails with contractually relevant content (cf. § 257 Commercial Code) are subject to a retention period of 6 years. Otherwise, the storage duration is generally based on the purpose of processing or on contractual or more specific statutory obligations. When the purpose ceases to apply (e.g. the final performance of a contractual obligation without the need for after-sales support relating to the product or associated products and without the prospect of follow-on contracts), the data is deleted – after expiry of any applicable tax or commercial retention periods or periods for asserting interests – unless the data subject has consented to retention.

Data Subject Rights

You have the option to exercise your “data subject rights” at any time:

Right of Access (Art. 15 GDPR):

You may request information on whether and which personal data we process, for what purposes the processing is carried out, to which recipients the data is disclosed and how long it is stored.

Right to Rectification (Art. 16 GDPR):

You may request the correction of inaccurate or the completion of incomplete personal data.

Right to Erasure (Art. 17 GDPR):

You may request the deletion of your personal data, in particular where it is no longer necessary for the purposes for which it was collected, you have withdrawn a consent given, or the data has been processed unlawfully.

Right to Restriction of Processing (Art. 18 GDPR):

You may request the restriction of the processing of your personal data, for example where the accuracy of the data is disputed.

Right to Data Portability (Art. 20 GDPR):

You have the right to receive personal data concerning you in a structured, commonly used and machine-readable format, or – where technically feasible – to request its transmission to another controller.

Right to Withdraw Consent (Art. 7(3) GDPR):

You may withdraw a consent given at any time with effect for the future. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

Right to Object (Art. 21 GDPR):

You have the right to object at any time to the processing of your personal data.

Where we process your personal data on the basis of Art. 6(1)(e) or (f) GDPR (performance of a task carried out in the public interest or legitimate interests), you may object to the processing on grounds relating to your particular situation. In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

Where your personal data is processed for the purposes of direct marketing, including related profiling, you have the right to object at any time, without giving reasons, to such processing. In that case, your personal data will no longer be processed for these purposes.

Automated Decision-Making (Art. 22 GDPR):

You have the right not to be subject to a decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you. As stated above, however, your personal data is not used for automated individual decision-making including profiling pursuant to Art. 22(1) and (4) GDPR.

Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR):

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data violates data protection legislation.

In Bavaria, the competent data protection supervisory authority is:

The Bavarian State Commissioner for Data Protection (BayLfD)
Wagmüllerstraße 18
80538 Munich
Germany
Website: https://www.datenschutz-bayern.de

Without prejudice to this, you may also contact the data protection supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

If you wish to exercise your rights, please direct your request by email to hello@21strategies.com or by post to the address stated at the beginning. When you exercise the rights set out here, we are obliged to verify your identity and will therefore request appropriate proof of identity. This serves in particular to protect your data from unauthorised access by third parties.

Version and Amendments to this Privacy Policy

This privacy policy is dated 25 June 2026.

Due to technical developments and/or changes in legal and/or regulatory requirements, our websites are continuously revised and further developed. Accordingly, we will regularly update this privacy policy. The current version can be accessed at any time from this privacy policy.