THIRSTYZONE – PRIVACY POLICY

  1. Controller UB thirsty GmbH Eurotec-Ring 15 47445 Moers Germany Managing Director: Udo Bruns Email:  hello@thirstyzone.com 

  1. General Information We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR). Personal data means any information relating to an identified or identifiable natural person.

  1. Data Processing When Using the Platform When using THIRSTYZONE, we process in particular the following data: Company data (e.g. company name, address, industry) Contact data (name, email address, phone number) Account data (login details, platform usage) Communication data (messages between users) Product data (descriptions, images, prices) Transaction-related data Processing is carried out for the purposes of: Providing the platform Facilitating business contacts Performing contractual relationships Improving and further developing the platform Legal basis: Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR

  1. Registration and User Account During registration, the data you provide is processed in order to create a user account and enable the use of the platform.

  1. Payment Processing (Stripe) We use the following service provider for payment processing: Stripe Payments Europe Ltd. Dublin, Ireland Payment data is transmitted directly to Stripe. Stripe may transfer data to third countries (e.g. the USA). In such cases, appropriate safeguards pursuant to Art. 44 et seq. GDPR are applied (in particular Standard Contractual Clauses). Further information:  https://stripe.com/privacy 

  1. Newsletter and Marketing Communication (1) If you subscribe to our newsletter, we will use your email address to send you regular information about our services, offers and updates. (2) Subscription is carried out using a double opt-in procedure. (3) Legal basis: your consent pursuant to Art. 6 (1) (a) GDPR. (4) You may unsubscribe at any time via the unsubscribe link in your user account or by contacting us. (5) In the context of newsletter distribution, we may analyze whether and when emails are opened and which links are clicked in order to optimize our content.

  1. CRM System (Bigin) We use a CRM system (“Bigin”) to manage customer relationships. The following data may be processed in particular: Company data (company, contact details, industry, contact persons) Communication history Contract and interaction data Processing is carried out for: Organizing customer relationships Managing sales activities Communication with users Legal basis: Art. 6 (1) (b) and (f) GDPR If data is processed outside the EU, appropriate safeguards in accordance with the GDPR are applied.

  1. Platform Operation (InnoLoft) The technical provision and operation of the platform are carried out by: InnoLoft GmbH Aachen, Germany InnoLoft processes data on our behalf as a processor pursuant to Art. 28 GDPR. This includes in particular: Hosting (provider: AWS) and operation of the platform Processing of user data Technical infrastructure

  1. Hosting (IONOS) Our website is hosted by: IONOS SE Elgendorfer Straße 57 56410 Montabaur Germany IONOS processes data on our behalf for the purpose of providing the website. In particular, the following data may be processed: IP address Log files Access data

  1. Social Media Presence (LinkedIn and Instagram) (1) The Provider operates company profiles on LinkedIn and Instagram to inform about THIRSTYZONE, services and updates, and to communicate with users and interested parties. (2) When visiting these social media pages, personal data is processed by the respective platform operators. This may include in particular: IP address Device information Interactions with content (e.g. likes, comments, shares) Usage behavior and interest profiles (3) Data processing is carried out independently by the platform operators. Further information can be found in their privacy policies: LinkedIn:  https://www.linkedin.com/legal/privacy-policy Instagram (Meta):  https://privacycenter.instagram.com/policy (4) Where we interact with users via our social media presence (e.g. comments, direct messages or posts), personal data is processed on the basis of Art. 6 (1) (f) GDPR (legitimate interest in public relations, communication and marketing). (5) We do not have full control over data processing by the platform operators. In particular, user behavior analysis (e.g. via analytics tools) is carried out independently by them. (6) Users may generally assert their rights (access, deletion, objection, etc.) both against us and directly against the platform operators. However, since only the platform operators have full access to user data, it is recommended to assert such rights directly with them.

  1. Communication Between Users If you use communication features, content and metadata are processed to enable communication between users.

  1. Data Sharing Data is shared: with other users within the platform with service providers (Stripe, CRM, hosting) where legally required

  1. International Data Transfers Transfers to third countries only take place in compliance with appropriate safeguards pursuant to Art. 44 et seq. GDPR.

  1. Data Retention Data is stored only for as long as necessary for the respective purposes or as required by statutory retention obligations.

  1. Your Rights You have the right to: Access Rectification Erasure Restriction of processing Data portability Objection

  1. Withdrawal of Consent You may withdraw any consent at any time with effect for the future.

  1. Right to Lodge a Complaint You have the right to lodge a complaint with a supervisory authority. Competent authority: State Commissioner for Data Protection North Rhine-Westphalia  www.ldi.nrw.de 

  1. Data Security We implement technical and organizational measures to protect your data.

  1. Amendments We reserve the right to amend this privacy policy.



April 2026