This Privacy Policy explains how GRIT Sports processes personal data when you visit our website, contact us, work with us or apply for a job. It applies under the EU General Data Protection Regulation (GDPR) and German data protection law.

1. Who we are

The controller responsible for processing your personal data is:

GRIT Sports UG (haftungsbeschränkt) Riehlstr. 3a, 85049 Ingolstadt, Germany Managing Directors: Jakob Baier, Tom Schrör Email: office@gritsports.de Phone: +49 155 60897826

For any privacy questions or requests, contact us at office@gritsports.de.

2. Our website

2.1 Hosting and server logs

Our website is built and hosted with Framer, provided by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands. When you visit the site, Framer automatically processes technical data that your browser sends, such as your IP address, date and time of access, pages visited, referring URL, browser type, operating system and device type.

This is necessary to deliver the website, keep it secure and prevent abuse. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Framer uses Amazon Web Services as its hosting provider, which means data may be processed in the United States (see section 6). We have a data processing agreement with Framer.

2.2 Website analytics (Framer Analytics)

We use Framer's built-in analytics to understand how our website is used, for example how many people visit, which pages they view, where they come from and which device types they use. Framer Analytics works without cookies and does not create user profiles. Location and device data are estimated from browser information.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving our website). You can object to this processing at any time (see section 8).

2.3 Contact form

If you use our contact form, we process the data you enter (such as name, email address, company and your message) to respond to your request. The form is processed by Framer and forwarded to us by email.

Legal basis: Art. 6(1)(b) GDPR if your request relates to a potential project or contract; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries).

2.4 Price estimate tool

When you submit a request through our price estimate tool, the data you enter (such as your contact details and project information) is sent via the service FormSubmit (formsubmit.co), operated by Devro LABS (devrolabs.com), and forwarded to us as an email. Devro LABS may process this data on servers outside the EU/EEA, including in countries without an adequate level of data protection.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request).

2.5 Cookies

We do not use cookies for analytics or marketing. Where technically necessary data is stored on your device to operate the website, this is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

2.6 Links to social media and third-party websites

Our website links to our profiles on Instagram, YouTube and LinkedIn. These are simple links: no data is sent to these platforms until you click on them. Once you visit another website, its operator's privacy policy applies.

3. Clients, prospects, freelancers and business partners

3.1 What we process and why

When you contact us by email or phone, or when we work together on a project, we process the data of you and your colleagues that is needed for this. This typically includes names, business contact details, job titles, communication content, project information and briefings, and billing and payment details.

We use this data to answer requests, prepare offers, plan and deliver projects, share files and invoice our services. Legal bases:

• Art. 6(1)(b) GDPR: preparing and performing a contract with you

• Art. 6(1)(f) GDPR: communicating with contact persons at our clients and partners, and managing business relationships

• Art. 6(1)(c) GDPR: legal obligations, especially commercial and tax record-keeping

3.2 Tools and service providers we use

We use the following service providers to run our business. They process personal data on our behalf under data processing agreements (Art. 28 GDPR).

We also share data with our tax advisor, who is bound by professional secrecy, and with freelancers we work with on a specific project where needed to deliver it.

3.3 Use of AI tools

We use AI tools to support our work, for example for drafting texts, structuring information and creative production. We only use business versions of these tools. Under these plans, the providers do not use our inputs to train their models.

We use Claude (Anthropic, Team plan) for work that may include client and project information. Artlist AI Studio is used for creative production; we do not enter personal data of clients there. We do not use AI tools to make automated decisions about you.

4. Job applications

If you send us an application, we process the data you provide (such as your CV, cover letter, references, portfolio and contact details) to assess your application and, if applicable, to prepare an employment or freelance contract. Applications are received and stored via Microsoft 365.

Legal basis: Art. 6(1)(b) GDPR and Section 26 of the German Federal Data Protection Act (BDSG). Only people involved in the hiring decision have access.

If we do not hire you, we delete your application documents six months after the end of the application process, unless you have agreed to a longer retention (for example to be considered for future positions). If you are hired, your data becomes part of your personnel file.

5. Our social media profiles

We maintain profiles on Instagram, YouTube and LinkedIn to present our work and communicate with our community. When you visit these profiles or interact with us there (e.g. comments, likes, direct messages), we process the data visible to us. The platforms also process your data for their own purposes, including statistics they provide to us about how our profiles are used (page insights).

For these page insights, we are jointly responsible with the platform operator (Art. 26 GDPR):

• Instagram: Meta Platforms Ireland Ltd., Dublin, Ireland (Privacy Policy)

• LinkedIn: LinkedIn Ireland Unlimited Company, Dublin, Ireland (Privacy Policy)

• YouTube: Google Ireland Limited, Dublin, Ireland (Privacy Policy)

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in presenting our company and communicating with users). You can exercise your rights with us or directly with the platform; the platforms are best placed to act on requests about their own processing.

6. Transfers outside the EU

Some of our service providers (e.g. Framer's hosting provider, Notion, Anthropic, FormSubmit) process data in the United States or other countries outside the EU/EEA. Where this happens, transfers are based on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies, and the adequacy decision for Israel) or on the EU Standard Contractual Clauses (Art. 46 GDPR).

7. How long we keep your data

We delete personal data as soon as it is no longer needed for the purpose it was collected for. In particular:

• Inquiries that do not lead to a project: deleted once the matter is concluded, usually within 12 months.

• Project and client data: kept for the duration of the business relationship and then deleted, unless legal retention periods apply.

• Invoices, accounting records and business correspondence: kept for up to 10 years, as required by German commercial and tax law (Section 257 HGB, Section 147 AO).

• Applications: see section 4.

8. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR)

• have incorrect data corrected (Art. 16 GDPR)

• have your data deleted (Art. 17 GDPR)

• restrict the processing of your data (Art. 18 GDPR)

• receive your data in a portable format (Art. 20 GDPR)

• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds, or the processing serves legal claims.

To exercise your rights, email office@gritsports.de.

Right to lodge a complaint: You can complain to a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

Providing your data is neither legally nor contractually required. However, without certain data we cannot answer your inquiry, carry out a project or consider your application. We do not use automated decision-making or profiling.

9. Security

Our website uses SSL/TLS encryption. We use technical and organisational measures to protect your data against loss, misuse and unauthorised access.

10. Changes to this Privacy Policy

We update this Privacy Policy when our services or the law change. The current version is always available on this page.