Thank you for your interest in Bridgly. Protecting your personal data is very important to us. With this privacy policy, we would like to inform you about how we collect, process, and use personal data when you visit our website www.bridgly.de and our learning environment lernumgebung.bridgly.de, as well as when you use our services, and what rights you have as a data subject.
This privacy policy fulfills the information obligations under Art. 13 and Art. 14 GDPR.
I. Controller and Data Protection Contact
1. Controller within the Meaning of the GDPR
The controller responsible for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR) is:
Bridgly GmbH
c/o LMU Innovation & Entrepreneurship Center
Giselastraße 10
80802 Munich
Germany
Email: team@bridgly.de
Phone: +49 894 1435983
2. Data Protection Contact
If you have questions about the processing of your personal data or about exercising your rights as a data subject, you can contact us at any time:
Email: datenschutz@bridgly.de
II. General Information on Data Processing
1. Scope of Processing
In principle, we collect and use personal data of our users only to the extent necessary to provide a functional website as well as our content and services. As a rule, personal data is collected and used only after the data subject has given consent or to the extent that another legal basis permits the processing.
2. Recipients of Personal Data
Within our company, only those persons who need your data to perform their tasks have access to it. External recipients of your data are exclusively:
- processors engaged by us (Art. 28 GDPR), in particular for IT hosting, CRM, learning platform, and communication;
- public bodies, to the extent that there is a legal obligation to transfer the data (e.g., tax authorities);
- payment service providers in connection with contract processing.
We have concluded contracts pursuant to Art. 28 GDPR with all processors.
3. Data Transfers to Third Countries
Where we use service providers whose registered office or processing locations are outside the European Union (EU) or the European Economic Area (EEA) – in particular in the USA – data is transferred only if an adequate level of data protection is ensured. This is ensured by:
- an adequacy decision of the EU Commission (in particular the EU-US Data Privacy Framework for certified US providers);
- standard contractual clauses pursuant to Art. 46(2)(c) GDPR;
- supplementary technical and organizational safeguards (e.g., encryption).
For each service, we specifically point out any transfer to a third country. You can request a copy of the respective safeguards at datenschutz@bridgly.de.
4. Obligation to Provide Personal Data
In principle, you are not legally or contractually obliged to provide us with your personal data. However, we cannot provide certain services (e.g., conclusion of a contract, sending the newsletter, handling contact requests) without the provision of the data required for them. For each processing operation, we point out any obligation to provide data and its consequences.
5. Automated Decision-Making and Profiling
We do not use fully automated decision-making within the meaning of Art. 22 GDPR. Automated processing in the form of profiling that produces legal effects concerning you or similarly significantly affects you does not take place.
III. Data Processing When You Visit Our Websites
1. Server Log Files
When you access our websites, the browser you use automatically transmits information to our server or the server of our hosting provider. This information is temporarily stored in so-called log files. The following data is collected:
- IP address of the accessing device
- Date and time of access
- Name and URL of the file accessed
- Website from which access is made (referrer URL)
- Browser used and, if applicable, operating system and name of your access provider
Purpose: Ensuring a smooth connection setup, convenience of use, and evaluation of system security and stability.
Data processed: See above.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website).
Obligation to provide: The collection of log file data is technically mandatory for the operation of the website.
Storage period: 30 days; longer storage takes place only in anonymized form.
2. Hosting
Our website www.bridgly.de is hosted via the Webflow platform (provider: Webflow Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA). Our domains are managed via IONOS SE (Elgendorfer Straße 57, 56410 Montabaur, Germany).
Purpose: Provision and delivery of our website.
Data processed: Log data (see above), content and usage data of the website, online identifiers (cookies, device and browser IDs).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable provision of the website).
Storage period: As long as necessary for the operation of the website.
Third-country transfer: Webflow is a US company. Webflow is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses apply.
Recipients: Webflow Inc. (USA), IONOS SE (Germany).
3. Cookies and Consent Management
We use cookies and similar technologies on our websites. Cookies are small text files that are stored on your device. We distinguish between:
- technically necessary cookies, without which the operation of the websites would not be possible (e.g., for storing your cookie settings);
- non-necessary cookies (in particular statistics and marketing cookies), which are only set with your express consent.
Your consent is managed via Cookiebot (provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark; part of the Usercentrics group following an acquisition). Cookiebot stores anonymized data about your cookie consent as proof pursuant to Art. 7(1) GDPR.
Purpose: Obtaining, managing, and documenting your consent to non-essential cookies and processing operations.
Data processed: Anonymized IP address, cookie settings, date and time of consent, technical browser data, unique consent ID.
Legal basis: Art. 6(1)(c) GDPR (legal obligation to document), Art. 6(1)(f) GDPR (legitimate interest in legally compliant consent management).
Storage period: Up to 12 months.
Recipients: Cybot A/S, Denmark.
You can change or withdraw your cookie settings at any time via the cookie banner at the bottom of the screen or via the corresponding icon on our website. A complete overview of all cookies used (with provider, purpose, and storage period) can be found directly in the cookie banner under the "Show details" button.
4. Webflow Analytics
We use the analytics function integrated into Webflow for privacy-friendly evaluation of website usage.
Purpose: Statistical analysis of website usage to optimize our offering.
Data processed: Anonymized IP address, page views, time spent on the site, referrer URL, browser and device information.
Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner) or Art. 6(1)(f) GDPR in the case of purely anonymous evaluation.
Storage period: Up to 14 months.
Third-country transfer: Webflow Inc. (USA); EU-US Data Privacy Framework + SCCs.
Recipients: Webflow Inc. (USA).
5. Google Analytics 4 and Google Tag Manager
We use Google Analytics 4 (GA4) and Google Tag Manager of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA). These services are loaded exclusively after you have given your consent via the cookie banner.
Purpose: Analysis of user behavior on our website to optimize content and marketing activities. Google Tag Manager serves exclusively for the technical management of other tags and does not set any cookies itself.
Data processed: Pseudonymized user ID, IP address (truncated), device and browser information, referrer URL, interactions with the website, location data (at city level).
Legal basis: Art. 6(1)(a) GDPR (consent).
Storage period: Up to 14 months; you can withdraw your consent at any time via the cookie banner.
Third-country transfer: Google LLC (USA); Google is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses.
Recipients: Google Ireland Ltd. (Ireland), Google LLC (USA).
IV. Data Processing for Contact Requests, Demo Bookings, and the Newsletter
1. Contacting Us by Email
Purpose: Processing your inquiry and, if applicable, preparing the conclusion of a contract.
Data processed: Name, email address, telephone number (if provided), content of the message, and, if applicable, company name and role.
Legal basis: Art. 6(1)(b) GDPR (initiation/performance of a contract), Art. 6(1)(f) GDPR (legitimate interest in efficient communication).
Obligation to provide: Providing your name and email address is required to process your inquiry. Without this data, we cannot respond to you.
Storage period: Until your inquiry has been fully processed; where statutory retention obligations exist (e.g., under the German Commercial Code (HGB) and the Fiscal Code (AO)), until the respective period expires.
2. Demo Booking via HubSpot Meetings
You can book demo appointments directly via our website. For this purpose, we use the HubSpot Meetings tool of HubSpot, Inc. (2 Canal Park, Cambridge, MA 02141, USA), as well as its European subsidiary HubSpot Ireland Ltd.
Purpose: Provision of online appointment booking and transfer of the appointments to our calendar.
Data processed: Name, email address, if applicable company, role, and request, date and time of the booking.
Legal basis: Art. 6(1)(b) GDPR (initiation of a contract at your request).
Obligation to provide: The mandatory fields in the booking form (name, email) are required for scheduling the appointment.
Storage period: Until the appointment has been handled; thereafter storage in the CRM in accordance with Section V.
Third-country transfer: HubSpot, Inc. (USA); HubSpot is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses.
Recipients: HubSpot Ireland Ltd. (Ireland), HubSpot, Inc. (USA).
3. Newsletter
You can subscribe to our newsletter "Die Lernkurve" on our website. It is published once a month and informs you about our services, training offerings, webinars, and compliance topics.
We refer to this privacy policy on the registration form. The newsletter is sent on our behalf by HubSpot Ireland Ltd. (2 Dublin Landings, North Dock, Dublin 1, Ireland) together with its parent company HubSpot, Inc. (2 Canal Park, Cambridge, MA 02141, USA) as processors pursuant to Art. 28 GDPR. Our HubSpot portal is operated in the EU data center in Frankfurt.
Purpose: Sending the newsletter "Die Lernkurve" with information about our services, training offerings, webinars, and compliance topics, as well as proof of the consent given.
Data processed: Email address, first name and last name; date, time, and IP address of the registration and of the confirmation (double opt-in); the consent text in the version displayed to you, together with its version status; the page on which you registered; date and time of a withdrawal.
Legal basis: Art. 6(1)(a) GDPR (consent). For retaining the proof of consent after a withdrawal: Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR, as well as Art. 6(1)(f) GDPR (legitimate interest: proof of consent).
Obligation to provide: Email address, first name, and last name are required; registration is not possible without this information. We use your name to address you personally.
Storage period: Until you withdraw your consent. We retain the proof of consent and the entry of your email address in our blocklist until the end of the third calendar year after you unsubscribe; they are then deleted.
Third-country transfer: HubSpot, Inc. (USA); HubSpot is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses.
Recipients: HubSpot Ireland Ltd. (Ireland), HubSpot, Inc. (USA).
Registration for the newsletter takes place using the so-called double opt-in procedure: after you register, you receive an email in which you must activate the registration by clicking a confirmation link. The registration is documented in order to be able to prove the registration process in accordance with the legal requirements.
Withdrawal and unsubscribing: You can withdraw your consent at any time with effect for the future and unsubscribe from the newsletter, via the unsubscribe link in every newsletter email or informally by email to datenschutz@bridgly.de.
4. Online Meetings and Webinars
For online meetings, webinars, and live demos, we use Microsoft Teams as part of Microsoft 365 (provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).
Purpose: Conducting online meetings, demos, webinars, and internal discussions.
Data processed: Name, email address, IP address, device/hardware information, audio/video data (if activated), chat content, session metadata.
Legal basis: Art. 6(1)(b) GDPR (initiation/performance of a contract), Art. 6(1)(f) GDPR (legitimate interest in efficient communication), and for recordings additionally Art. 6(1)(a) GDPR (consent).
Storage period: Session data is generally not stored permanently; recordings are made only if all participants have expressly consented, and they are deleted once the purpose has been fulfilled (max. 12 months).
Third-country transfer: Microsoft Ireland Operations Ltd. (Ireland), if applicable Microsoft Corporation (USA); EU Data Boundary, EU-US Data Privacy Framework + SCCs.
For webinars, you will be informed of any recording at the beginning of the session. In this case, you can object to the recording by leaving the webinar or deactivating your camera and microphone.
V. Customer Management and Business Partner Data
Processing of Customer Data (Art. 13 GDPR)
We use HubSpot's customer relationship management (CRM) system to manage relationships with prospects and customers and to maintain the contact and communication data of our business partners and their employees.
Purpose: Structured management of inquiries, prospect and customer data, maintenance of the business relationship, sales processes, and communication history. No lead scoring or automated decision-making takes place.
Data processed: Name, email address, telephone number, company, role, address, communication history, contract data, interactions with our website (if consent has been given).
Legal basis: Art. 6(1)(b) GDPR (initiation and performance of a contract), Art. 6(1)(f) GDPR (legitimate interest in efficient sales and customer management processes and in maintaining existing business relationships).
Storage period: For the duration of the business relationship and for the duration of statutory retention obligations (in particular 6 or 10 years under the HGB and AO). Prospect data not bound by contract is deleted or anonymized after no more than 3 years without interaction.
Third-country transfer: HubSpot, Inc. (USA); EU-US Data Privacy Framework + standard contractual clauses.
Recipients: HubSpot Ireland Ltd. (Ireland), HubSpot, Inc. (USA).
Processing of Data of Our Business Partners' Contact Persons (Art. 14 GDPR)
If you are our contact person as an employee of a business partner of Bridgly GmbH (customer, supplier, service provider, sales partner), we process your business contact data. We have received this data either directly from you, from your employer, or from publicly accessible sources (e.g., company website, LinkedIn).
Purpose: Initiation, performance, and maintenance of the business relationship between Bridgly GmbH and your employer.
Data processed: Name, business email address, telephone number, position/role, employer.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining business relationships).
Storage period: Until the end of the business relationship with your employer or until you object.
Recipients: See HubSpot above.
VI. Learning Environment (lernumgebung.bridgly.de)
Our learning environment is provided under the subdomain lernumgebung.bridgly.de. We use the LearnWorlds platform as the technical infrastructure (provider: LearnWorlds Ltd., 145 - 157 St John Street, London EC1V 4PW, United Kingdom).
1. Data Processing as Controller (Own Use Cases)
Where you register on the learning environment yourself as a private individual (e.g., for testing or information purposes), we are the controller within the meaning of Art. 4(7) GDPR.
Purpose: Provision of the learning environment, management of your user account, provision of the learning content, creation of confirmations of participation.
Data processed: First and last name, email address, login data (encrypted), learning progress, test results, certificates of completion, usage data of the platform.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Obligation to provide: Providing the mandatory fields is required to use the learning environment.
Storage period: For the duration of the contractual relationship and up to 3 years after the end of the course, to enable follow-up questions, follow-up courses, and records (Art. 6(1)(f) GDPR). Early deletion is possible at any time upon request.
Third-country transfer: LearnWorlds Ltd. (UK; covered by an EU adequacy decision). LearnWorlds uses sub-service providers in the USA (e.g., Amazon Web Services), safeguarded by the EU-US Data Privacy Framework and standard contractual clauses.
Recipients: LearnWorlds Ltd. (UK), subcontractors (including Amazon Web Services).
2. Data Processing as Processor (Training for Corporate Customers)
Where our learning environment is used under a contract with a corporate customer to train that customer's employees, the respective customer (i.e., your employer or your client) is the controller within the meaning of the GDPR. In these cases, we process the learners' data exclusively on behalf of and on the instructions of the respective customer on the basis of a data processing agreement (Art. 28 GDPR).
If you, as an employee of a customer of Bridgly GmbH, have questions about the processing of your data, please first contact the data protection officer or the data protection contact point of your employer.
VII. Use of AI Systems
Bridgly GmbH uses AI systems to support internal workflows and in the creation and updating of training content. We would like to inform you transparently about this – both with regard to the GDPR and with regard to the transparency obligations of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, "EU AI Act").
1. AI Tools Used
We currently use:
- OpenAI ChatGPT (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland; parent company: OpenAI, L.L.C., USA);
- Anthropic Claude (Anthropic, PBC, 548 Market St., PMB 90375, San Francisco, CA 94104, USA).
2. Purposes and Data Processing
We use these tools in particular for:
- creating first drafts of marketing and website content;
- preparing and structuring training content;
- internal research and translation tasks.
As a rule, we do not process any personal data of third parties when using these tools. Should personal data be contained in inputs ("prompts") in exceptional cases, this takes place on the basis of:
Purpose: Increasing the efficiency of internal workflows and optimizing our content.
Data processed: Data contained in inputs (as a rule, no personal data; in exceptional cases, business contact data).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient work processes).
Storage period: We use the business/enterprise versions of the providers. Inputs are not used for training purposes. Inputs and outputs are stored for a maximum of 30 days for abuse and security monitoring and then deleted.
Third-country transfer: OpenAI: processing via OpenAI Ireland Ltd. (Ireland) with transfer to OpenAI, L.L.C. (USA), safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. Anthropic: processing in the USA, safeguarded by standard contractual clauses.
Recipients: OpenAI Ireland Ltd. (Ireland), OpenAI, L.L.C. (USA), Anthropic, PBC (USA).
3. Editorial Control
All AI-generated content is editorially reviewed before publication by an employee who bears responsibility for the content. As a result, under Art. 50(4) EU AI Act, the labeling obligation for AI-generated texts does not apply. Where content (in particular images or illustrations) is used that is not obviously recognizable to viewers as AI-generated, we label it separately.
VIII. Payment Processing
Payment for our services is generally made by invoice via bank transfer. Optionally, we offer payment via payment service providers:
1. Stripe
Purpose: Processing of payments.
Data processed: Name, address, bank or credit card details, process and transaction data.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Storage period: In accordance with retention periods under tax and commercial law (usually 10 years).
Third-country transfer: Stripe Payments Europe Ltd. (Ireland) as the main controller; parent company Stripe Inc. (USA); safeguarded by the EU-US Data Privacy Framework + standard contractual clauses.
Recipients: Stripe Payments Europe Ltd. (Ireland), Stripe Inc. (USA).
2. PayPal
Purpose: Processing of payments.
Data processed: Name, address, email address, bank or credit card details, process and transaction data.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Storage period: In accordance with retention periods under tax and commercial law (usually 10 years).
Third-country transfer: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.
Recipients: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).
3. Bank Transfer
When you pay by invoice via bank transfer, we process the data necessary for issuing and settling the invoice (name, address, bank details, and booking data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR in conjunction with the retention obligations under tax and commercial law.
IX. Applications
1. Ways to apply: We accept applications via our application portal at https://bewerbung.bridgly.de or by email to karriere@bridgly.de. The former address team@bridgly.de is no longer intended for applications.
2. Data processed: In the application portal, we process mandatory information (first name, last name, email address, résumé as a single PDF file, and the position to which the application relates), voluntary information (telephone number and a message to us), and technical information (time of receipt, a shortened identifier of the browser, and a hash value of the IP address to detect misuse; the hash value is deleted after 30 days). Our server logs contain the IP address, the page accessed (without form content), and the time; they are deleted after 14 days. We do not need information on origin, religion, belief, health, sexual identity, age, or a photo for the application; we ask you not to submit such information. We make our selection decisions in accordance with the requirements of the General Act on Equal Treatment (AGG).
3. Purpose and legal basis: We process the data in order to decide on the establishment of an employment relationship. The legal basis is Section 26 (1) BDSG in conjunction with Art. 6(1)(b) GDPR (implementation of pre-contractual measures). We process the technical information for misuse detection and the server logs on the basis of Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of the portal and the defense against automated submissions. Storage beyond the application process (for example, for later positions) takes place only with express consent; we do not currently offer this.
4. Hosting and security: The application portal runs on a server of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, that is operated by us, in a data center in Germany. netcup processes the data on our behalf (processing on our behalf under Art. 28 GDPR). The transmission between browser and portal is encrypted via TLS. Only the persons at Bridgly GmbH who are involved in the application process have access to applications, via a password-protected login. Uploaded files are not passed on to third parties.
5. Email notifications: After submission, our team receives a notification at karriere@bridgly.de, and you receive a confirmation of receipt at the email address you provided. We send both emails via Microsoft 365 (provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The emails do not contain attachments; the résumé remains in the portal. With regard to Microsoft 365, the information in Section IV.4 of this privacy policy applies in addition. For applications by email to karriere@bridgly.de, the same mailbox at Microsoft 365 applies.
6. No third-party services, no tracking: The application portal does not set cookies, does not use analytics or tracking tools, and does not load content from third-party providers; fonts are delivered from our own server.
7. Storage period: After a rejection or a withdrawal of the application, we delete the application data six months after the conclusion of the process; this period serves to defend against possible claims under the AGG (Section 15 (4) AGG, Section 61b ArbGG). Backup copies of the portal are overwritten no later than 35 days after deletion. If an employment relationship is established, we transfer the required documents to the personnel file and then delete them in the portal. We review open applications regularly.
8. Your rights: You have the rights described in Section XI, in particular access, rectification, erasure, restriction of processing, objection to processing based on Art. 6(1)(f) GDPR, and lodging a complaint with a supervisory authority. You can withdraw an application at any time; a message to karriere@bridgly.de is sufficient.
X. Social Media Profiles
We maintain profiles on social networks in order to communicate with prospects, customers, and applicants and to provide information about our services.
When you visit our profiles on social networks, data about you is automatically collected and stored over which we have no influence. We would like to expressly point out that you use these profiles and their functions at your own responsibility.
For our LinkedIn company page, there is joint controllership pursuant to Art. 26 GDPR with LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) with regard to the processing of page view data for statistical purposes.
LinkedIn privacy policy: https://de.linkedin.com/legal/privacy-policy
Purpose: External presentation, recruiting, communication with prospects and customers.
Data processed: Data that you yourself disclose on the social network (e.g., profile information, comments, messages), as well as aggregated statistical data (reach, demographics).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in marketing and external presentation); if applicable, Art. 6(1)(a) GDPR (consent via the platform).
Storage period: In accordance with the data protection provisions of the respective provider.
Third-country transfer: For US-based platforms (e.g., LinkedIn), data may be transferred to the USA; safeguarded by the EU-US Data Privacy Framework and standard contractual clauses.
XI. Your Rights as a Data Subject
Under the GDPR, you have the following rights:
- Right of access (Art. 15 GDPR) – You can request information as to whether and which personal data we process about you.
- Right to rectification (Art. 16 GDPR) – You can request the rectification of inaccurate data or the completion of incomplete data.
- Right to erasure (Art. 17 GDPR) – You can request the erasure of your data, provided that no statutory retention obligations or other reasons prevent this.
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability (Art. 20 GDPR) – You can receive the data you have provided in a structured, commonly used and machine-readable format.
- Right to withdraw consent given (Art. 7(3) GDPR) – The lawfulness of the processing carried out before the withdrawal remains unaffected.
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
To exercise your rights, an informal message to the following address is sufficient:
datenschutz@bridgly.de
RIGHT TO OBJECT (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest). If your data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing. If you object, we will no longer process your personal data for these purposes. You can send your objection informally to datenschutz@bridgly.de.
Competent Supervisory Authority
The data protection supervisory authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: www.lda.bayern.de
You can also contact the data protection supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.
XII. Security of Processing
We take technical and organisational measures pursuant to Art. 32 GDPR to protect your personal data against unauthorized access, accidental or unlawful alteration, loss, or destruction. These include in particular:
- encryption of data transmission (TLS/SSL);
- encryption of stored data, where necessary;
- access restrictions based on the need-to-know principle;
- role-based permissions;
- multi-factor authentication for sensitive systems;
- regular data backups;
- regular training of our employees on data protection and information security.
Our security measures are continuously adapted to technological developments.
XIII. Current Version and Changes to This Privacy Policy
This privacy policy reflects the status as of September 2026. Due to the further development of our website and offerings or changes in legal requirements, it may become necessary to amend this privacy policy. You can find the current version at any time at www.bridgly.de/datenschutzerklaerung.
We support the IHK initiative "Pack ma's digital" to help businesses in Upper Bavaria with digitalization and secure the future of the region.