Data protection information ClariLab GmbH & Co. KG
(according to Article 13 GDPR)

1. Principles

Data protection and data security for our contractual partners and consumers have always been a high priority for our company. Therefore, the protection of your personal data throughout all our business processes is very important to us and a matter of particular concern. Respecting this right to privacy is a matter of course for us. Generally, it is not necessary for you to provide personal data to use our website. However, in order for us to provide our services, we may require your personal data. We collect, process, and use personal data to the extent permitted by law, necessary for processing, or with your consent.

2. Name and contact details of the controller and the company data protection officer

As the responsible entity, we, ClariLab GmbH & Co. KG, Platz der Einheit 2, 20327 Frankfurt am Main, take all legally required measures to protect your personal data. Our company data protection officer can be reached at the above address, c/o Data Protection Department, or by email at Datenschutz@schufa.de.

3. Purposes of data processing, legal bases and legitimate interests pursued by ClariLab GmbH & Co. KG, as well as categories of personal data and categories of recipients

3.1. Accessing our website

When you access our website, your browser automatically sends information to our website's server, where it is temporarily stored in a log file. We have no control over this process. The following information is collected automatically and stored until it is automatically deleted:

• the IP address of the requesting internet-enabled device
• the date and time of access
• the name and URL of the retrieved file
• the website/application from which the access was made (referrer URL)
• the browser you are using and, if applicable, the operating system of your internet-enabled computer, as well as the name of your access provider.

We use your device's IP address and the other data listed above for the following purposes:

• Ensuring a smooth connection setup,
• Ensuring comfortable use of our website,
• Evaluation of system security and stability.

The data is stored for a period of 31 days and then automatically deleted. Furthermore, we use cookies, tracking tools, and social media plugins on our website. Chapter 7 explains in more detail which methods are used and how your data is processed.

3.1.1 KYCnow bits&insights

If you have consented, we will inform you monthly in our journal about ClariLab, updates to the KYCnow platform, industry events, and fraud prevention. We only require your email address to send you the newsletter. The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR. You can withdraw your consent at any time.

Mailchimp

Our newsletter is sent using the software. Mailchimp, The Rocket Science Group, LLC 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA. The email addresses are stored there for sending and analyzing the newsletters.

Consent to receive
If you would like to receive our newsletter, we require your consent as part of the registration process. Upon registration, you will receive an email to confirm your subscription (opt-in). You can then unsubscribe at any time via a link in each newsletter (opt-out). Once you have given your consent, your personal data will be processed until you withdraw it.
We use your personal data solely for sending our newsletter. Your data will be stored in an electronic newsletter system for the duration of your subscription. If you withdraw your consent, we will immediately remove you from our newsletter mailing list to comply with your request.

Right to cancel


You can object to the use of your personal data for advertising purposes at any time, either entirely or for specific measures. If you object, the affected contact address will be blocked from further advertising data processing. Please note that in exceptional cases, you may still receive advertising material temporarily even after we receive your objection. This is due to the necessary lead time for advertising campaigns and does not mean that we are not implementing your objection. Thank you for your understanding.

3.2 Data processing for online inquiries from data subjects

We collect, process and use personal data to the extent necessary to process your request.

3.3 Data processing when using contact forms for interested companies and in connection with onboarding as a business partner

We collect, process and use personal data to the extent necessary for processing your request or for onboarding as a business partner, as well as for transferring it to our CRM system.

3.4 Data processing of media contacts

We collect, process, and use your personal data to the extent necessary to provide you with the information published by our company or to facilitate contact as requested. We also use your data to inform you about company news via email or telephone, for example, by sending press releases. When contacting you, we consider the relevance of our message and the thematic focus of your journalistic work.

3.5 Data processing of applicant data (e.g. when using our application form or at career fairs etc.)

We collect, process and use personal data to the extent necessary for processing your application and for contacting you as requested.

4. Legal bases

ClariLab processes personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) (also with the help of service providers). Processing is based on consent as well as on Article 6(1)(b) and (f) GDPR, insofar as processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract, or insofar as processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Processing operations that ClariLab carries out in the context of a legal obligation to which it is subject are based on Article 6(1)(c) GDPR. Based on Article 6(1)(f) GDPR, we process your address data and advertising selection criteria in order to send you information and offers from us and other companies. If you do not wish to receive such communications, you can object to the use of your data for advertising purposes at any time. Consent can be withdrawn at any time by contacting ClariLab. This also applies to consent given before the GDPR came into effect. The withdrawal of consent does not affect the lawfulness of the processing of personal data carried out before the withdrawal.

5. Categories of personal data

5.1 When processing data for the use of contact forms for interested companies, as well as in connection with onboarding as a business partner, registration forms for ClariLab events, and contact forms within the framework of marketing campaigns, we process the necessary data. This includes the following categories:

• Personal data (title, first name, last name, address, functionary status in the company, company data)
• Communication data
• usage data
• Processing data
• Marketing data (e.g. consents)

5.2 As part of applicant management, we process the following data:

• Personal data (surname, first name, address)
• Communication data
• other data from the application documents (e.g. enrollment certificates, certificates, information on marital status, etc.)

5.3 In the context of media contacts, we process the following data:

• Personal data (surname, first name)
• Company data (medium, address)
• Communication data (email address, telephone, department, position)

6. Categories of recipients of personal data

All information that you provide to us by entering it on these websites will be stored on a server located in a country in the European Union (“EU”) and forwarded to the relevant departments within the company to process your requests and wishes.
Service providers we use may also receive data from us to fulfill the prescribed purposes.

7. Online presence and website optimization

7.1 Cookies – General Information

Cookies are small files that your browser automatically creates and stores on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not harm your device, nor do they contain viruses, Trojans, or other malware. The information stored in the cookie relates to the specific device used.
The use of cookies can be either consent-free or subject to consent. Cookies that do not require consent are those necessary for using our online services or that serve IT security (necessary cookies). The legal basis for this data processing is Article 6(1)(f) of the GDPR. Cookies that require consent, on the other hand, serve to make your use of our services more convenient (preference cookies). For example, we use cookies to recognize that you have already visited certain pages of our website or that you are already logged into your customer account. Furthermore, we also use temporary cookies for user-friendliness purposes, which are stored on your device for a specific, predetermined period. When you revisit our site to use our services, it is automatically recognized that you have already been here and what entries and settings you have made, so you don't have to enter them again.
On the other hand, we use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our services for you, as well as to display information specifically tailored to you (marketing and statistics cookies). The legal basis for data processing for cookies requiring consent is Article 6 Paragraph 1 Letter a GDPR. This data includes, among other things, page views, time spent on the site, origin, country, etc. We analyze this statistical information to improve our services and to check the acceptance of individual web pages. Invisible GIFs are used solely for the positioning of elements on the website. No other functions are associated with the invisible GIFs used. These cookies are stored by your browser and are usually deleted when you close the browser. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a notification always appears before a new cookie is created. Completely disabling cookies may prevent you from using all the functions of our website. The storage duration of cookies depends on their purpose and is not the same for all.
We recommend that you always log out completely after using shared computers that are set to accept cookies.
You can view which cookies we currently use at any time here:

Here you can quickly and easily manage any consents you may have given: Adjust settings

8. Duration of data storage

We generally only store your data for as long as is necessary for the respective purpose of data processing (e.g. processing your request or complying with legal retention periods).
We store the data collected for contract processing until the expiry of statutory or potential contractual warranty and guarantee rights. After this period, we retain the information relating to the contractual relationship required under commercial and tax law for the legally prescribed periods. During this period (generally ten years from the conclusion of the contract), the data is processed again only in the event of an audit by the tax authorities.
All data relating to the conduct of a conciliation procedure are generally stored for up to ten years.
The duration of data storage for advertising purposes is not subject to any rigid rules and depends on whether the storage is necessary for advertising purposes. We also adhere to the principle of deleting data used for advertising purposes four years after the end of the contract or four years after the end of marketing efforts. Objections to advertising will not be deleted.

The data we process as part of the recruitment process is stored for up to 6 months after the application process has been completed.
In particularly justified cases, we also store data for longer periods, for example if an authority requires this or if the data is needed for legal reasons, e.g. for evidence in a court case.

9. Recipients outside the EU

We transfer your data to contractual and business partners located in other third countries (provided that a corresponding adequacy decision by the European Commission exists for these countries). No personal data collected during the dispute resolution process will be transferred to third countries. ClariLab is also subject to the legal powers of intervention of government authorities.

10. Your rights

10.1 Overview

In addition to the right to revoke your consent given to us, you have the following further rights if the respective legal requirements are met:

• Right to information about your personal data stored by us pursuant to Art. 15 GDPR,
• Right to rectification of inaccurate data or to completion of inaccurate data pursuant to Art. 16 GDPR,
• Right to erasure of your data stored with us pursuant to Art. 17 GDPR,
• Right to restriction of the processing of your data pursuant to Art. 18 GDPR,
• Right to data portability pursuant to Art. 20 GDPR.

It is possible to contact a data protection supervisory authority. The supervisory authority responsible for ClariLab is the Hessian Data Protection Commissioner.

10.2 right of objection

Under the conditions of Article 21(1) GDPR, data processing can be objected to on grounds relating to the particular situation of the data subject.
The aforementioned general right to object applies to all processing purposes described in this privacy notice that are based on Article 6(1)(f) GDPR. Unlike the specific right to object to data processing for advertising purposes, we are only obligated under the GDPR to implement such a general objection if you provide us with overriding legitimate grounds (e.g., a potential risk to life or health). Furthermore, you have the option of contacting the supervisory authority responsible for ClariLab, the Hessian Data Protection Commissioner.

11. Data security

All personal data you submit is transmitted using the widely accepted and secure SSL (Secure Socket Layer) standard. SSL is a secure and proven standard also used, for example, in online banking. You can recognize a secure SSL connection by the "s" appended to "http" (i.e., https://…) in your browser's address bar or by the padlock icon in the lower part of your browser window.

12. Analysis tools and advertising

Matomo (formerly Piwik)

This website uses the open-source web analytics service Matomo. Matomo uses technologies that enable cross-site user recognition for analyzing user behavior (device fingerprinting). The information collected by Matomo about the use of this website is stored on our server. The IP address is anonymized before being stored.

With the help of Matomo, we are able to collect and analyze data on the use of our website by website visitors. This allows us to find out, among other things, when which page views were made and which region they come from. We also record various log files (e.g. IP address, referrer, browsers and operating systems used) and can measure whether our website visitors carry out certain actions (e.g. clicks, purchases, etc.).

The use of this analytics tool is based on Article 6(1)(f) GDPR. ClariLab has a legitimate interest in the anonymized analysis of user behavior in order to optimize its website.

IP anonymization

When analyzing with Matomo, we use IP anonymization. Your IP address is shortened before the analysis so that it can no longer be clearly assigned to you.

Hosting

We host Matomo exclusively on our own servers, so that all analysis data remain with us and are not passed on.

Opt-Out

You can disable website tracking using the following button:

Use of SalesViewer® technology

This website uses SalesViewer® technology from SalesViewer® GmbH to collect and store data for marketing, market research and optimization purposes based on the legitimate interests of the website operator (Art. 6 Para. 1 lit.f GDPR).

For this purpose, a JavaScript-based code is used, which is used to collect company-related data and the corresponding use. The data collected using this technology is encrypted using a non-recalculable one-way function (hashing). The data is immediately pseudonymized and is not used to personally identify the visitor to this website.

The data stored by Salesviewer® will be deleted as soon as they are no longer required for their intended purpose and there are no legal retention obligations to prevent deletion.

The collection and storage of data can be objected to at any time with future effect by using this link https://www.salesviewer.com/opt-out Click to prevent SalesViewer® from recording within this website in the future. An opt-out cookie for this website is stored on your device. If you delete your cookies in this browser, you must click this link again.

13. Use of the appointment booking tool “Cituro”

To arrange appointments, we use the booking tool “Cituro” from cituro GmbH, Peter-Dörfler-Straße 30, 86199 Augsburg on our website.

When you book an appointment, we collect the following personal data: first name, last name, company name, email address, telephone number, and any message you may have voluntarily included. Providing this information is necessary to schedule your appointment and send you a confirmation.

Purpose of data processing
The data will be used for planning, conducting, and following up on an initial consultation related to our services. Furthermore, we will use this data for further contact if the initial consultation is successful.

Joint responsibility
The data is processed by us, ClariLab GmbH & Co. KG, and by our parent company, SCHUFA Holding AG, as joint controllers within the meaning of Article 26 GDPR. SCHUFA Holding AG is involved in the appointment scheduling and sales process of our KYCnow product. The data is transferred manually.

Legal basis
The legal basis for the processing of your personal data is Art. 6 para. 1 lit. b GDPR (performance of a contract or implementation of pre-contractual measures).

Order processing by Cituro
The technical processing of appointment bookings is handled by cituro GmbH. A data processing agreement in accordance with Article 28 of the GDPR has been concluded with this provider. Processing takes place exclusively within the EU. cituro does not share data with third parties.

Further information on data processing by cituro GmbH can be found at: https://www.cituro.com/datenschutz

Revocation and rights of the data subject
You have the right to object to the processing of your personal data at any time with effect for the future. Further information about your rights can be found in our privacy policy.

As of: April 2025