Privacy notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Clearo Systems GmbH
Bonner Straße 484–486
50968 Köln
Germany

Represented by: Nils Röpke (managing director)

E-mail: info@clearosystems.com
Telephone: +49(0)221 99967800 - 0

2. Overview: which data do we process?

This website, including the needs analysis atquickcheck.clearosystems.com, is an information and analysis service on the EPR and environmental compliance obligations of companies selling products in the Netherlands. When you visit the website, we process the technical access data generated when it is called up (server log files, section 4), as well as data you provide when contacting us directly by e-mail or telephone (section 5), via the contact form, or in the needs analysis and a subsequent quotation process (section 6). This includes in particular your e-mail address, where applicable your name and your company, your information on EPR-relevant matters and the EPR obligations determined from it. We measure website use with Google Analytics 4 and the HubSpot tracking code when you consent. Rybbit loads independently of that decision (section 7.3). Vercel Web Analytics provides aggregated reach measurement (section 7.4).

3. Cookies and consent

Cookies are small files stored on your device; the same rules apply to comparable techniques such as your browser's local storage. Storing information on your device, or accessing information already stored there, requires your prior consent unless it is strictly necessary to provide the service you requested (§ 25 Abs. 1 and Abs. 2 Nr. 2 TDDDG; for visitors in the Netherlands, art. 11.7a Telecommunicatiewet).

The cookie banner lets you accept or decline Google Analytics 4 and HubSpot tracking separately. Neither tracking service loads before you agree. Rybbit and Vercel Web Analytics operate independently of these choices. The website remains usable if you decline the optional services.

Strictly necessary and therefore not subject to consent: we store the choice you make in the banner in a cookie namedclearo-cookie-consent, set for clearosystems.comand all of its subdomains — including the needs analysis atquickcheck.clearosystems.com — so that you decide once for the whole site and are not asked again on every page. A copy is kept in your browser's local storage. Both contain only your decision and its date: no identifier and nothing about you. Like every cookie it accompanies your requests to our web server, which neither reads nor stores it, and it is never passed to a third party. It expires after 180 days, after which you will be asked again; you can delete it at any time through your browser settings, with the same effect. It is exempt under § 25 Abs. 2 Nr. 2 TDDDG.

Consent-based: Google Tag Manager and Google Analytics 4 (section 7.1), and HubSpot tracking (section 7.2). Each has its own choice in the banner. Rybbit (section 7.3) is not controlled by these choices.

Withdrawal: you can change or withdraw your decision at any time with effect for the future, using the "Cookie settings" link in the footer of every page. Withdrawing takes effect immediately; the lawfulness of the processing carried out up to that point remains unaffected (Art. 7(3) GDPR).

4. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA ("Vercel"). When the website is called up, Vercel automatically processes information on our behalf in so-called server log files, which your browser transmits:

• IP address of the requesting device,
• date and time of access,
• page called up / name of the file retrieved,
• volume of data transferred and HTTP status code,
• browser type and version, operating system,
• referrer URL (previously visited page).

The processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision, the stability and the security of the website (including the defence against attacks). The log data is not merged with other data sources and is automatically deleted after a short time.

Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the EU Commission (Art. 45 GDPR). In addition, EU standard contractual clauses (Art. 46(2)(c) GDPR) are used. We serve fonts, images and other static resources from our own servers; no fonts from third-party providers (e.g. Google Fonts) are loaded. The only third-party scripts on this website are the spam protection on the contact form (section 6) and the services described in section 7. Google Analytics 4 and the HubSpot tracking code require your consent; Rybbit and Vercel Web Analytics load independently of that choice.

5. Contact by e-mail or telephone

When you contact us by e-mail, we store your e-mail address, your name and — if you provide it — your telephone number. The sole purpose of this storage is the contact itself, in order to answer your questions. The legal basis is our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR).

When you reach us by telephone via a number stated on the website, your telephone number — provided caller ID is activated — is displayed in full on our end devices and stored in our telephone system as an incoming call together with the respective call duration. The stored data is accessible only to a small, defined group of people working for us and is deleted regularly. The storage is based on our legitimate interest in reviewing the cost efficiency of our communication structure (Art. 6(1)(f) GDPR).

6. Contact form, needs analysis and spam protection

Our contact page provides a contact form. If you use it, we process the data you enter there: first name, surname, e-mail address, your message and — if you provide them — company and telephone number. We use this data solely to handle your enquiry and to contact you about it. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a possible contract, and otherwise our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR). Before you send the form, we point you to this privacy notice. Your enquiry is transmitted for handling to the HubSpot instance set up for Clearo Systems (see also section 7.2).

To protect the form against automated abuse we use the verification serviceCloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"). When you use the form, Turnstile processes technical information about your device and browser (including the IP address) to distinguish human visitors from automated programs. Turnstile does not set cookies and is used exclusively for this protection purpose. The legal basis is our legitimate interest in protecting the form against abuse and in the security of the website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the EU Commission (Art. 45 GDPR).

Needs analysis and handling of quotations

At quickcheck.clearosystems.com you can carry out a needs analysis of your EPR obligations. In doing so, we process the information you enter about your company and the matters relevant to the assessment, as well as the EPR obligations and analysis results determined on that basis. We record your e-mail address and, where you provide them, your name and the name of your company. In the subsequent quotation process you can provide further information that we need to handle your enquiry.

This information and the analysis results are stored in a HubSpot instance set up specifically for Clearo Systems. We use them to present your individual needs, handle your enquiry, prepare quotations and contact you about them. This includes the sales handling of your specific enquiry. Your information is not used beyond this for product improvement without contacting you separately.

To handle enquiries and quotations, authorised employees of DR Deutsche Recycling Service GmbH have access to the data required for this in our HubSpot instance. They handle the enquiries and prepare quotations for Clearo Systems. Responsibility for this processing lies with Clearo Systems.

The legal basis for processing in connection with a requested service or a possible contract is Art. 6(1)(b) GDPR. Where other enquiries are concerned, the legal basis is our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR). You can use the needs analysis and have an enquiry handled regardless of whether you consent to the optional HubSpot tracking under section 7.2.

7. Web analytics

We want to know which pages of this website are read and which links are followed, so that we can improve the content. We use four services for this. They differ fundamentally, and so does what we need from you.

7.1 Google Tag Manager and Google Analytics 4 — only with your consent

Subject to your consent we use Google Tag Manager and, loaded through it, Google Analytics 4, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Tag Manager is an administrative tool that loads the analytics tags; it performs no analysis of its own and sets no cookies of its own. Google Analytics 4 is the analytics service.

Neither service is loaded before you have agreed in the cookie banner. If you decline, or simply do not agree, no connection to Google is established at all — not even to load the program code.

Once you have consented, the following data is processed:

• the pages you call up, and when,
• how you reached the website (referrer URL, search terms where transmitted),
• interactions with buttons and links — specifically which of our calls to action you use and at which position on the page they were shown, and whether the contact form was successfully sent (never its content),
• approximate location (country/region level, derived from a shortened IP address), browser, operating system and device type,
• a randomly generated identifier in the cookies below, by which your browser is recognised on a return visit.

Google Analytics 4 stores this information using the following cookies on your device:

What we have switched off. We transmit to Google the signal that only measurement is permitted ("Consent Mode"). The signals for advertising, advertising personalisation, sharing user data for advertising purposes and content personalisation remain deactivated. We do not run advertising, remarketing or conversion tags, we have not linked Google Analytics to a Google Ads account, and we do not use Google Signals or cross-device tracking. Google Analytics 4 does not log or store IP addresses: the IP address is used only to derive the approximate location and is then discarded. We do not merge the analytics data with other data sources, and we never transmit your name, e-mail address, telephone number or the content of your message to Google.

Legal basis for storing and reading the cookies is your consent under § 25 Abs. 1 TDDDG (in the Netherlands: art. 11.7a Telecommunicatiewet), and for the subsequent processing of the personal data your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via "Cookie settings" in the footer; this does not affect the lawfulness of processing carried out beforehand.

Transfer to third countries. Processing is carried out via Google Ireland Limited in the EU. It may nevertheless also take place on servers of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under theEU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision of the EU Commission (Art. 45 GDPR); in addition, EU standard contractual clauses (Art. 46(2)(c) GDPR) are used. You should be aware that US authorities may, under certain conditions, be able to access such data.

Storage period. The cookies expire after the periods stated in the table. The event and user data collected in Google Analytics is deleted automatically after 14 months at the latest.

Further information on Google's handling of data is available in Google's privacy policy atpolicies.google.com/privacy. Independently of our banner, you can prevent collection by Google Analytics with the browser add-on available attools.google.com/dlpage/gaoptout.

7.2 HubSpot tracking — only with your consent

Subject to your consent we use the tracking code of HubSpot. HubSpot is also the customer relationship management (CRM) system in which we handle contact requests, needs analyses and quotations (section 6). The service is provided by HubSpot Ireland Limited, Dublin, Ireland, a subsidiary of HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA ("HubSpot"). The account used for this website is hosted in HubSpot's EU data region (Frankfurt am Main, Germany).

The tracking code is not loaded before you have agreed to it in the cookie banner. It is a separate choice from the one about Google in section 7.1: you may allow one service and refuse the other. If you decline, the HubSpot tracking code is not loaded and none of the tracking cookies below is set. This does not affect the processing, in our HubSpot CRM, of the contact and analysis data you actively submit (section 6).

Once you have consented, the following data is processed:

• the pages you call up on this website, and when,
• how you reached the website (referrer URL) and which website you go to next,
• technical information about the request (IP address, browser, operating system, device type),
• a randomly generated identifier in the cookies below, by which your browser is recognised on a return visit.

What this is for, in plain terms. Besides counting visits, the identifier allows us to see which pages someone read beforethey contacted us — so that we can tell which content actually helps businesses with their EPR questions. It only ever becomes connected to a person if you contact us yourself and thereby give us your data.

HubSpot stores this information using the following cookies on your device:

What we do not do with it. We do not use the HubSpot tracking code on this website for advertising, remarketing or the building of advertising audiences. Data from the contact form and the needs analysis is processed in our HubSpot CRM independently of the tracking (section 6). Declining HubSpot tracking therefore has no effect whatsoever on your ability to contact us or to use the needs analysis.

Legal basis for storing and reading the cookies is your consent under § 25 Abs. 1 TDDDG (in the Netherlands: art. 11.7a Telecommunicatiewet), and for the subsequent processing of the personal data your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via "Cookie settings" in the footer; this does not affect the lawfulness of processing carried out beforehand.When you withdraw, we delete the four cookies named above from your device and the tracking code is not loaded again.

Transfer to third countries. The data is held in the EU data region. Processing may nevertheless also take place at HubSpot, Inc. in the USA, for instance for support and maintenance. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision of the EU Commission (Art. 45 GDPR); in addition, EU standard contractual clauses (Art. 46(2)(c) GDPR) are used. You should be aware that US authorities may, under certain conditions, be able to access such data.

Storage period. The cookies expire after the periods stated in the table.

Further information on HubSpot's handling of data is available in HubSpot's privacy policy atlegal.hubspot.com/privacy-policy.

7.3 Rybbit: self-hosted website analytics

We use Rybbit at client-analytics.scaile.to to measure page visits and selected navigation actions. The software loads automatically, without waiting for a choice in the cookie banner. Declining Google Analytics 4 or HubSpot does not stop Rybbit.

The measurement includes visited page paths and titles, referring pages, browser language, screen dimensions and device information. IP addresses are processed to derive approximate location and a pseudonymous visit identifier. Raw IP storage in Rybbit is disabled, and daily user-ID salting is enabled. This does not describe the separate hosting logs mentioned in section 4.

Rybbit sets no analytics cookie and stores no identifier on your device. When it starts, the delivered software tries to write a random identifier, rybbit-visitor-id, to local storage. Our website blocks this write before the software loads and deletes such an entry left by an earlier visit. The software then uses a random identifier that exists only in the memory of the open page and is discarded when you leave or reload the page. The software still reads local storage to check for its opt-out entry and a user identifier; this website sets neither.

In the site configuration, automatic query-string collection, outbound-link capture, button and form autocapture, copied-text capture, session replay, error tracking, web vitals and feature flags are disabled. Selected calls to action are recorded with structural action and placement labels. Our explicit action events contain no questionnaire answers, contact fields or named user identities. The software also sends the referring URL; its query parameters are not removed by the page-query setting.

For questions about this processing or to exercise your data-protection rights, contact the controller in section 1. The choices for optional services in the cookie banner do not constitute a Rybbit opt-out.

Technical documentation: Rybbit site settings.

7.4 Aggregated reach measurement without cookies

Independently of your consent decision we use Vercel Web Analytics, a service of our hosting provider Vercel Inc. (address in section 4), to count page views. This service is deliberately built without cookies: it stores no information on your device and reads none from it, sets no identifier, and creates no profile. From the request it derives an aggregated, anonymous statistic (page, referrer, country, device class) from which no conclusion about your person can be drawn, and it is used for no purpose other than this statistic.

Because no information is stored on or read from your device, § 25 Abs. 1 TDDDG does not apply and there is nothing here for you to consent to — which is why the service is declared in the banner rather than offered as a choice. The legal basis for processing the technical request data is our legitimate interest in a statistically sound assessment of the website's reach and in its needs-based development (Art. 6(1)(f) GDPR). You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR, section 10).

8. Recipients and transfers to third countries

Recipients of personal data are the service providers named in sections 4, 6 and 7 and, for handling enquiries and quotations, authorised employees of DR Deutsche Recycling Service GmbH (section 6). During technical maintenance, correspondingly authorised service providers may be given access to the extent necessary. Insofar as a processor processes data in the USA, the transfer is based on the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and/or on EU standard contractual clauses (Art. 46(2)(c) GDPR).

9. Retention period

We store personal data only for as long as is necessary for the purposes stated or as long as statutory retention obligations (in particular §§ 147 AO, 257 HGB) exist. After that, the data is deleted.

10. Your rights

You have the following rights against us with regard to the personal data concerning you:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent given (Art. 7(3) GDPR) with effect for the future.

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

An informal message to info@clearosystems.com is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). A list of the data protection supervisory authorities and their contact details is available via the following link:www.bfdi.bund.de.

11. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

12. Obligation to provide data

The provision of personal data is neither required by law nor by contract. You can visit our website without actively providing data; without the technical data named in section 4, however, delivery of the website is not possible. To contact you, send you analysis results or handle a quotation request, we need your e-mail address and the information required for the respective enquiry.

13. Changes to this privacy notice

We adapt this privacy notice when the legal situation or our processing activities change. The version published on this page at the time applies.