Privacy policy — mmkdigital

This privacy policy (version: 10 November 2026) explains in accordance with Article 13 of the General Data Protection Regulation (EU) 2016/679 (GDPR) which personal data is processed when mmkdigital.io is visited, on which legal basis this happens and which rights data subjects have.

Data controller

MMK DIGITAL GmbH Schorndorfer Str. 42 71638 Ludwigsburg, Germany

Represented by the managing directors Marc Klein and Clemens Müssener

Email: hello@mmkdigital.io, phone: (+49) 176 846 563 86

Data protection enquiries can be sent to the same address.

Services used

Microsoft and Tally process the data on our behalf under a data processing agreement pursuant to Article 28 GDPR. Google provides the fonts under its own responsibility. Google operates Google Analytics on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Providing data in forms is neither a statutory nor a contractual requirement. Without the information marked as mandatory, however, an enquiry cannot be processed.

Microsoft Azure

When: On every page request
Data: IP address, date and time, requested address and amount of data transferred, previously visited page (referrer), browser and operating system
Purpose: Delivering the website, stability and security, for example fending off attacks
Legal basis: Article 6(1)(f) GDPR, legitimate interest in secure operation
Retention: No longer than 30 days; data needed to investigate a specific security incident until that investigation is complete
Third country: Access from the USA cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework (adequacy decision under Article 45 GDPR); standard contractual clauses under Article 46(2)(c) GDPR apply in addition.
Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Privacy information: https://www.microsoft.com/en-gb/privacy/privacystatement

Email and phone

When: When contacting us by email or phone, including applications sent by email
Data: Name, contact details, content and time of the message or call and any other information provided
Purpose: Handling and answering the enquiry; for applications, carrying out the application process
Legal basis: Article 6(1)(b) GDPR where the enquiry concerns an existing or prospective contract; otherwise Article 6(1)(f) GDPR, legitimate interest in answering it; for applications as described under Tally
Retention: Until the enquiry has been dealt with, unless statutory retention obligations apply, for example under Section 257 of the German Commercial Code (HGB) or Section 147 of the German Fiscal Code (AO); application documents as described under Tally
Service: We receive and store emails via Microsoft 365. Provider, third country and privacy information as for Microsoft Azure.

Tally

When: After consent in the notice at the bottom of the page or at the form itself: when the embedded forms are loaded and submitted. Consent given at the form covers the forms only, not Google Analytics.
Data: On loading, IP address and browser information; on submission, the information entered, including billing details for training registrations and the documents uploaded for applications
Purpose: Collecting enquiries, training registrations and applications
Legal basis: For loading the forms, consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG; for training registrations and enquiries about a prospective contract Article 6(1)(b) GDPR; for other enquiries Article 6(1)(f) GDPR, legitimate interest in answering them; for applications Article 6(1)(b) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG) and, where documents contain special categories of personal data such as health information, Article 9(2)(b) GDPR in conjunction with Section 26(3) BDSG
Withdrawal: At any time with effect for the future via “Cookie settings” at the bottom of every page, including consent given at a form
Retention: Enquiries until they have been dealt with, unless statutory retention obligations apply; training registrations for the retention periods under Section 257 HGB and Section 147 AO; application documents six months after the process has ended unless an employment relationship is established
Other recipients: The forms are delivered via Cloudflare, Inc. (USA), which processes the IP address and browser information.
Third country: Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, for which an adequacy decision by the European Commission under Article 45 GDPR is in place.
Provider: Tally BV, Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium
Privacy information: https://tally.so/help/privacy-policy

Google Fonts

When: When the Tally forms are loaded, that is only after consent
Data: IP address and browser information
Purpose: Displaying the fonts in the form
Legal basis: Consent under Article 6(1)(a) GDPR
Withdrawal: As for Tally, via “Cookie settings” at the bottom of every page
Retention: As determined by Google, see the provider's privacy information
Third country: Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision under Article 45 GDPR).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy information: https://policies.google.com/privacy?hl=en-GB

Google Analytics

When: After consent in the notice at the bottom of the page: on every page view
Data: Pages viewed, time spent and clicks, the page visited before (referrer), device and browser details, approximate location (country, region, city) and a random identifier of the browser. The IP address is only used to determine the approximate location and is not stored.
Purpose: Audience measurement: analysing which content is used in order to improve content and navigation
Legal basis: Consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG
Withdrawal: At any time with effect for the future via “Cookie settings” at the bottom of every page
Retention: Event data according to the retention period set in Google Analytics, at most 14 months; cookies see below
Third country: Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR); standard contractual clauses under Art. 46(2)(c) GDPR apply in addition.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy information: https://policies.google.com/privacy?hl=en

Company pages on social networks

We maintain company pages on LinkedIn and Instagram. The links in the footer are plain links: data is only sent to the provider once a link is clicked.

When these pages are visited, the respective provider processes personal data under its own responsibility, for example for advertising and market research, and may link it to a user account. For the page statistics (Insights) that the provider makes available to us in aggregated form, we are jointly responsible with the provider (Article 26 GDPR). Under the corresponding agreements, the provider is responsible for informing data subjects and fulfilling their rights. These rights are therefore most effectively exercised directly with the provider; enquiries sent to us are forwarded.

Purpose: Presenting the company, communicating with interested parties and applicants
Legal basis: Article 6(1)(f) GDPR, legitimate interest in communicating with interested parties
Third country: Data may be transferred to the parent companies in the USA. LinkedIn Corporation and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework (adequacy decision under Article 45 GDPR).

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Privacy information: https://www.linkedin.com/legal/privacy/eu
Insights: https://legal.linkedin.com/pages-joint-controller-addendum

Instagram

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Privacy information: https://privacycenter.instagram.com/policy
Insights: https://www.facebook.com/legal/terms/page_controller_addendum

Cookies and browser storage

The website and the embedded forms store individual pieces of information in the browser (cookies and similar techniques). They remain stored until deleted in the browser settings, unless stated otherwise.

Strictly necessary

Consent: The decision made in the consent notice and the consent given at a form
Display: The selected colour mode, once it is changed
Language switch: The position on the page when switching language; deleted directly afterwards

This information is strictly necessary for features explicitly requested and therefore does not require consent under Section 25(2) no. 2 TDDDG.

With consent: Tally

Recognition: A random identifier with which Tally links repeated visits to a form
Form session: An identifier of the current session in the form
Draft: Information already entered but not yet submitted, so that it is kept when the form is reloaded

The legal basis is consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. It can be withdrawn via “Cookie settings” at the bottom of every page. Information already stored can also be deleted in the browser settings.

With consent: Google Analytics

_ga: A random identifier with which Google Analytics recognises repeat visits from the same browser; two years
_ga_9MLC385X8M: Stores the state of the current session; two years

Further information

The connection to the website and to the embedded forms is encrypted with TLS, recognisable by “https://” in the address bar.

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

If the processing changes, we will update this privacy policy. The version published here applies.

Rights of data subjects

Data subjects have the following rights towards us under the GDPR. A message to hello@mmkdigital.io is sufficient to exercise them.

Access: Confirmation as to whether and which data is processed, and a copy of that data (Article 15 GDPR)
Rectification: Correction of inaccurate and completion of incomplete data (Article 16 GDPR)
Erasure: Erasure of the data where the conditions of Article 17 GDPR are met
Restriction: Restriction of processing under Article 18 GDPR, for example while the accuracy of the data is being verified
Data portability: Receipt of the data provided in a structured, commonly used and machine-readable format (Article 20 GDPR)
Withdrawal: Withdrawal of consent given, with effect for the future (Article 7(3) GDPR)

We inform recipients of the data about any rectification, erasure or restriction in accordance with Article 19 GDPR.

Right to object

Where processing is based on Article 6(1)(f) GDPR, it can be objected to at any time on grounds relating to the particular situation of the data subject (Article 21(1) GDPR). We will then no longer process the data unless there are compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

Without prejudice to any other remedy, there is a right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg) Heilbronner Straße 35 70191 Stuttgart, Germany https://www.baden-wuerttemberg.datenschutz.de