We are very delighted that you have shown interest in our enterprise. Data protection is of a particularly high priority for the management of the todo Gesellschaft für Informationstechnik mbH. The use of the Internet pages of the todo Gesellschaft für Informationstechnik mbH is possible without any indication of personal data; however, if a data subject wants to use special enterprise services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject.
The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to the todo Gesellschaft für Informationstechnik mbH. By means of this data protection declaration, our enterprise would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this data protection declaration, of the rights to which they are entitled.
As the controller, the todo Gesellschaft für Informationstechnik mbH has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.
The data protection declaration of the todo Gesellschaft für Informationstechnik mbHis based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration should be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would like to first explain the terminology used.
In this data protection declaration, we use, inter alia, the following terms:
Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is:
todo Gesellschaft für Informationstechnik mbH
Kitzingstraße 15-19
12277 Berlin
Germany
Managing directors: Andreas Dobrawa, Thomas Kühne
Phone: +49 30 726 192 0
Email: [email protected]
Website: www.goodstag.com
For questions about data protection and to exercise your rights, contact us at [email protected].
This website is delivered through Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. On every request Cloudflare processes technically necessary data: IP address, date and time, the page requested, referrer, browser type and version, and operating system. This is required to deliver the website and protect it against attacks (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. We do not store server log files ourselves and draw no conclusions about you from this data.
Fonts are loaded from our own server; no connection to Google Fonts is made.
We use cookies and similar technologies. Technically necessary cookies are set on the basis of Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(f) GDPR. All other cookies and services (statistics and marketing) are used only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
We manage your consent with the cookie banner of Enzuzo Inc., Toronto, Canada. Your choice is stored in the cookies cookies-functional, cookies-analytics, cookies-marketing and cookies-preferences and logged as proof of consent.
You can change or withdraw your consent at any time with effect for the future by reopening the cookie settings via the cookie icon on the website. You can also delete or block cookies in your browser; some features of the website may then not work.
When you contact us through the contact form, the contact forms on our industry pages, the price request forms or by email, we process your name, email address and message, and for price requests also the plan and volume you selected. We use this data solely to handle your request (Art. 6(1)(b) GDPR for enquiries about our services, otherwise Art. 6(1)(f) GDPR).
Form submissions are delivered to our mailbox through the email service Resend (Resend, Inc., USA), which acts on our behalf.
We delete your data once your request has been fully dealt with, unless statutory retention obligations apply (e.g. six or ten years for business correspondence under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code).
To protect this contact form against automated misuse we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Turnstile determines whether an entry is made by a person or by an automated program, and processes the IP address, information about the browser and device, and interactions with the website for that purpose. The processing is based on Art. 6(1)(f) GDPR, in our legitimate interest in protecting the form against spam and abuse. Turnstile is operated in invisible mode. Further information is set out in Cloudflare’s Turnstile Privacy Addendum.
We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It loads the statistics and marketing services described below and sets no cookies itself; loading it does transmit your IP address to Google. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in integrating these services efficiently and in applying your consent).
We use Google Consent Mode. As long as you have not consented, Google services set no cookies. Google Ads may, however, send cookieless signals without identifiers, such as that a page was viewed, the time, browser information and your consent status.
With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) we use Google Analytics 4 from Google to analyse how our website is used and to improve it. This includes pages viewed, time on page, where the visit came from, approximate location, device and browser information, and events such as submitting a form or clicking a button or link. Google Analytics 4 does not store IP addresses.
Google Analytics sets the cookies _ga and _ga_* with a lifetime of up to two years. Data may also be transferred to Google LLC in the USA. Further information is available in Google's privacy policy.
With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) we use Google Ads. This tells us whether a visit from a Google ad leads to an enquiry through one of our forms (contact, industry page or price request); Google may also build audiences for advertising (remarketing). For this, cookies such as _gcl_au and _gcl_aw (up to 90 days) and cookies on Google domains (e.g. IDE, up to 13 months) are set.
When you submit a form, the email address you entered may be converted in your browser into a hash value (SHA-256) and transmitted to Google, so that Google can match the enquiry to an ad click (enhanced conversions). This happens only with your consent.
Google is independently responsible for building audiences and improving its advertising services. Further information is available in Google's privacy policy.
With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) we use the OpenAI Ads measurement pixel. It tells us whether a visit from an ad in ChatGPT leads to an enquiry through our contact, industry page or price request forms. The provider in the EEA is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland; processing by OpenAI, L.L.C. in the USA is possible.
The pixel processes the click identifier from the ad, a random browser identifier, the page viewed, the time, the measured event and technical data such as IP address and browser information. Contact details you enter in a form may be converted in the browser into a hash value (SHA-256) and transmitted for matching. The pixel sets the cookies __oppref (30 days) and __obref (12 months). If you withdraw your consent, the pixel is switched off and these cookies are deleted. Further information is available in OpenAI's privacy policy.
With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) we use Microsoft Clarity to understand how our website is used and where it can be improved. Clarity records interactions such as mouse movements, clicks, scrolling and the pages viewed, and shows them to us as heatmaps and session replays. Entries in form fields and selection lists, numbers and email addresses are masked in your browser and are not recorded; the remaining text of our pages, which is the same for every visitor, is visible in the recordings. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; processing by Microsoft Corporation in the USA is possible.
Clarity processes a random visitor identifier, the pages viewed, the time, information about your device and browser and your IP address, from which an approximate location is derived. It sets the cookies _clck (12 months) and _clsk (1 day); on its own domains clarity.ms and bing.com, Microsoft also sets the cookies MUID and SRM_B (13 months), MR (7 days), ANONCHK (10 minutes) and SM (end of session), which keep a Microsoft browser identifier in step across Microsoft services. Recordings are deleted after 30 days. Clarity is only loaded after you have consented to statistics cookies; if you withdraw your consent, it is no longer loaded. Further information is available in Microsoft's privacy statement.
With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) we use Leadfeeder to find out which companies visit our website. Leadfeeder compares the IP address of a visit with company databases to identify the organisation behind it; it does not identify individual persons. The provider is Dealfront Group GmbH, Durlacher Allee 73, 76131 Karlsruhe, Germany; the data is stored on Amazon Web Services in Ireland.
Leadfeeder processes your IP address, the pages viewed, the time, the referring page and information about your browser and device. It sets the cookie _lfa (12 months), which recognises returning visits. Leadfeeder is only loaded after you have consented to statistics cookies; if you withdraw your consent, the cookie is deleted and Leadfeeder is no longer loaded. Further information is available in Leadfeeder's privacy notice.
On some pages we embed our online demo for digital product passports (dpp-creator.goodstag.com), which we operate ourselves. Loading it transmits your IP address to that server (Art. 6(1)(f) GDPR). If you request information through the demo, we process your details to handle your request (Art. 6(1)(b) GDPR); with your consent this is also reported to Google Analytics as an event.
Besides us, the recipients of your data are the service providers named above: Cloudflare (hosting and spam protection), Resend (email delivery), Enzuzo (consent management) and, only with your consent, Google, Microsoft, OpenAI and Dealfront (Leadfeeder). We have agreements under Art. 28 GDPR with our processors.
Some of these providers process data in the USA or Canada. Canada is covered by an adequacy decision of the European Commission. Transfers to the USA go to companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR) or are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.
If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.
You have the following rights regarding the personal data we hold about you:
Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.
To exercise your rights, an informal message to [email protected] is enough.
The data controller shall collect and process the personal data of applicants for the purpose of the processing of the application procedure. The processing may also be carried out electronically. This is the case, in particular, if an applicant submits corresponding application documents by e-mail or by means of a web form on the website to the controller. If the data controller concludes an employment contract with an applicant, the submitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If no employment contract is concluded with the applicant by the controller, the application documents shall be automatically erased two months after notification of the refusal decision, provided that no other legitimate interests of the controller are opposed to the erasure. Other legitimate interest in this relation is, e.g. a burden of proof in a procedure under the General Equal Treatment Act (AGG).
Art. 6(1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. Is our company subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR.
In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured in our company and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6(1) lit. d GDPR.
Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47 Sentence 2 GDPR).
Storing information on your device and accessing it is additionally governed by Section 25 TDDDG (see "Cookies and consent").
Where we base processing on Art. 6(1)(f) GDPR, our legitimate interests are providing the website securely and reliably, protecting it against misuse and spam, integrating our services efficiently and handling your enquiries.
The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of the contract or the initiation of a contract.
We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner).
Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded.
Before personal data is provided by the data subject, the data subject must contact any employee. The employee clarifies to the data subject whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of non-provision of the personal data.
As a responsible company, we do not use automatic decision-making or profiling.
Last updated: October 2026
