Privacy Policy

The protection of your personal data is important to us.

Data Controller and General Information
Website Delivery, Security, and Consent Management
Optional Analytics, Chatbot, and External Content
Forms, Quote Requests, and Registration
SMS and Email Verification
Payment, CAPTCHA, CMS, and Email Hosting
Job Applications
Retention periods
Your Rights and Changes to This Statement

1. Data Controller and General Information

This Privacy Policy informs you about how focusnet GmbH processes personal data in connection with this website, our forms, online tools, registration processes, and business communications.

The data controller is focusnet GmbH, Bismarckstr. 82, 10627 Berlin.
Our Data Protection Officer can be reached at Datenschutz@focusnet.de.
We process personal data based on Art. 6(1)(a) of the GDPR if you have given your consent, Art. 6(1)(b) of the GDPR for contracts and pre-contractual measures, Article 6(1)(c) of the GDPR for legal obligations, and Article 6(1)(f) of the GDPR for legitimate interests such as security, prevention of misuse, communication, and improvement of our services.
When we engage service providers as data processors, we enter into agreements in accordance with Article 28 of the GDPR and require appropriate technical and organizational safeguards.

2. Website Delivery, Security, and Consent Management

2.1 Hosting and Technical Delivery

Our website is delivered via Cloudflare Workers, static Cloudflare assets, and CDN, routing, and security features. In doing so, technical access data may be processed, in particular IP address, date and time of access, URL accessed, referrer, browser and device information, amount of data transferred, status codes, and security-related events. This processing is necessary to provide the website securely and reliably and is based on Article 6(1)(f) of the GDPR.

Individual backend functions are forwarded to internal service providers for billing, registration, provisioning, chat, CMS, and media delivery. We use these services solely for the requested function in each case.

2.2 Server and Security Logs

We process technical logs to ensure operation, analyze errors, prevent misuse, and protect our systems. Log data is stored only as long as necessary for these purposes, typically 7 to 30 days; security-related logs may be stored for up to 90 days if necessary.

2.3 Consent Management

We use our own consent management system to document your cookie and service selections. Technically necessary consent information is stored in your browser, including your consent status and selected preferences. The configured validity period is 180 days. You can change or revoke optional consents at any time with future effect.

3. Optional Analytics, Chatbot, and External Content

3.1 Matomo

We use Matomo (self-hosted on a server in Germany) for the statistical analysis of visitor traffic. No cookies or similar storage technologies are used. Your IP address is truncated by the last two octets before processing and can therefore no longer be traced back to you. The data is not transferred to third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in statistical reach measurement).

3.2 Leadfeeder / Dealfront

If you consent to analytics and marketing cookies, we may use Leadfeeder/Dealfront to understand which companies interact with our website and to improve our B2B communications. In doing so, technical usage data, company information derived from the IP address, referrer and campaign parameters, as well as browser information may be processed. Processing is based on your consent pursuant to Art. 6(1)(a) of the GDPR.

3.3 Chatbot

If you consent to functional services and use the chatbot, we process chat messages, timestamps, technical metadata, and contact information you voluntarily provide. This processing is carried out to provide the requested chat functionality and to respond to your inquiry.

3.4 Fonts, Media, and External Links

We use web fonts and media content to display the website. This currently includes Google Fonts and partner media loaded from external sources on individual product pages. If content is loaded from external providers, your browser may transmit technical retrieval data to these providers. Some pages may link to external websites; this Privacy Policy does not apply to these third-party sites.

4. Forms, Requests for Quotes, and Registration

4.1 Contact and Partner Forms

When you contact us via a form or by email, we process the information you provide, specifically your name, email address, company, phone number, subject line, message, confirmation of consent, and any voluntary information regarding your location. In addition, we process, where available, lead attribution data such as source URL, UTM parameters, and referrer. Processing is based on Article 6(1)(b) of the GDPR for pre-contractual communication and Article 6(1)(f) of the GDPR for internal lead classification and improving our communication.

4.2 ROI Calculator and NIS2 Compliance Checker

When you use our ROI Calculator or the NIS2 Compliance Checker, your input and calculated results are initially processed in part locally in your browser. If you request a report via email or wish to be contacted, we process your contact information, company information, entered values, calculated results, consent information, and lead attribution data to provide the requested report and facilitate a follow-up consultation.

4.3 Registration, Quotes, and Orders

During the registration and checkout processes, we process data necessary for product configuration, quote generation, order fulfillment, phone and email verification, billing, provisioning, and customer support. This may include contact information, company information, billing address, VAT ID number, product configuration, partner code, selected term, technical configuration, and payment status. Processing is based on Article 6(1)(b) of the GDPR and, where necessary, Article 6(1)(c) of the GDPR.

5. SMS and Email Verification

We use SMSAPI (LINK Mobility Poland sp. z o.o.) to verify phone numbers and send one-time codes. In doing so, we transmit the phone number, the message text containing the verification code, delivery metadata, and technical status information required for sending and verifying the SMS. SMS messages contain only the verification code and no sensitive contract or product details.

This processing is carried out to secure registrations and prevent misuse, based on Article 6(1)(b) and Article 6(1)(f) of the GDPR. Verification codes are short-lived. Internal delivery and abuse prevention logs are stored for a limited time, typically 30 to 90 days, unless longer storage is required to assert, exercise, or defend legal claims or due to legal obligations.

For email verification and business email communication, we use Host Europe’s email infrastructure. Provider-side POP3, IMAP, and SMTP connection logs are stored by Host Europe for 7 days; we retain the content of business emails depending on the communication category and applicable commercial or tax law retention requirements.

6. Payment, CAPTCHA, CMS, and Email Hosting

6.1 Stripe Checkout

For orders that incur a charge, we may redirect you to Stripe Checkout. To do so, we transmit order and checkout data required to establish the payment session. You enter your payment information directly with Stripe. Stripe processes payment data, to the extent required by payment regulations, under its own responsibility and, in all other respects, as a service provider for payment processing.

6.2 Friendly Captcha

We use Friendly Captcha to prevent abuse in selected processes. The service provides a technical task and a verification solution to distinguish legitimate use from automated abuse. Processing is based on our legitimate interest in protecting forms and registration processes in accordance with Article 6(1)(f) of the GDPR.

6.3 CMS and Media Delivery

Blog and media content can be retrieved via our website infrastructure from our CMS and object storage. In doing so, technical retrieval data is processed to deliver the content and protect the service.

7. Job Applications

For the sake of better readability, the following explanations will omit the simultaneous use of masculine, feminine, and diverse gendered language forms. All references to persons apply to all genders: m/f/d.

7.1 Direct Applications

If you submit an application to us, we will process your associated personal data (e.g., contact and communication information, application documents, notes taken during job interviews, etc.) to the extent necessary to decide whether to establish an employment relationship. The legal basis for this is Article 6(1)(b) of the GDPR (pre-contractual measures) and—if you have provided consent—Article 6(1)(a) of the GDPR. You may withdraw your consent at any time. Your personal data will be shared within our company exclusively with individuals involved in processing your application.

If your application is successful, the data you submitted will be stored in our data processing systems pursuant to Article 6(1)(b) of the GDPR for the purpose of carrying out the employment relationship.

If we are unable to offer you a position, you decline a job offer, or you withdraw your application, we reserve the right to retain the data you submitted on the basis of our legitimate interests (Article 6(1)(f) of the GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). Afterward, the data will be deleted and the physical application documents will be destroyed. Retention serves, in particular, as evidence in the event of a legal dispute. If it becomes apparent that the data will be required after the 6-month period has expired (e.g., due to an impending or pending legal dispute), the data will not be deleted until the purpose for continued retention no longer applies.

Data may also be retained for a longer period if you have provided the necessary consent (Art. 6(1)(a) GDPR) or if statutory retention requirements prevent deletion.

7.2 Inclusion in the Candidate Pool

If we do not offer you a position, there may be the option to add you to our applicant pool. If you are added to the applicant pool, all documents and information from your application will be transferred to the applicant pool so that we can contact you in the event of suitable vacancies.

Inclusion in the applicant pool is based exclusively on your express consent (Art. 6(1)(a) GDPR). Providing consent is voluntary and is unrelated to the ongoing application process. The data subject may withdraw their consent at any time. In this case, the data will be permanently deleted from the applicant pool, provided there are no legal grounds for retention.

Data from the applicant pool will be irrevocably deleted no later than two years after consent is granted.

8. Retention Periods

We delete personal data when the purpose of processing no longer applies, provided that no legal retention obligations, evidentiary purposes, or legitimate interests require longer storage. The following criteria apply in particular:

Website and security logs: generally 7 to 30 days; security-related logs up to 90 days if necessary.
Contact and partner inquiries without a contract: generally 6 to 24 months after the last communication.
Verification codes: minutes to hours; dispatch and abuse prevention logs generally 30 to 90 days.
Sent business offers and commercial correspondence: generally 6 years from the end of the calendar year.
Contract, order, and customer support data: for the duration of the contract and thereafter in accordance with statutes of limitations or statutory retention requirements.
Invoices, payment and accounting records: generally 8 years; documents relevant to annual financial statements and accounting may be retained for 10 years.
Backups: rolling retention, typically 30 to 90 days; deletion occurs through backup rotation.

9. Your Rights and Changes to This Statement

You are entitled to the following rights in accordance with the statutory requirements:

Right of access under Article 15 of the GDPR
Right to rectification under Article 16 of the GDPR
Right to erasure under Article 17 of the GDPR
Right to restriction of processing under Article 18 of the GDPR
Right to data portability under Article 20 of the GDPR
Right to object under Article 21 of the GDPR
Right to withdraw consent at any time with future effect
Right to lodge a complaint with a competent data protection supervisory authority

We may update this Privacy Policy to reflect changes in legal requirements or changes to our services. The most recent version will apply to future visits.

Data Controller: focusnet GmbH, Bismarckstr. 82, 10627 Berlin
Data Protection Officer: Datenschutz@focusnet.de
Stand: August 21, 2026