PRIVACY POLICY
Data Controller
The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
UNDPLUS GmbH
Prinzenstraße 85c
10969 Berlin
Germany
Phone: +49 30 67 94 5237
Email: info@undplus.com
To the extent that individual processing operations are carried out by UNDPLUS München GmbH (c/o Hanne Hallwaß, Corneliusstraße 16, 80469 Munich, email: info@undplus.com), particularly in the case of inquiries or project initiations related to Munich, that company may be solely or jointly responsible for them.
General Information on Data Processing
We collect personal data only to the extent necessary to provide a functional website and our content and services. The processing of personal data is based on one of the following legal bases:
Art. 6(1)(a) GDPR (consent)
Art. 6(1)(b) GDPR (contract or pre-contractual measures)
Art. 6(1)(c) GDPR (legal obligation)
Art. 6(1)(f) GDPR (legitimate interests)
Hosting and Server Log Files
This website is hosted by Framer B.V., Wilhelminaplein 4, 3072 DE Rotterdam, Netherlands. When you visit the website, the hosting provider automatically stores the following information in server log files:
IP address of the requesting device
Date and time of access
URL or file accessed
Referrer URL
Browser type and browser version
Operating system used
Amount of data transferred
This processing is carried out on the basis of Art. 6(1)(f) GDPR. Its purpose is the technical provision, stability and security of the website. The log data is stored only for as long as necessary for these purposes.
We have concluded a data processing agreement with Framer B.V. pursuant to Art. 28 GDPR. Where data is transferred to countries outside the EEA, this is done on the basis of standard contractual clauses pursuant to Art. 46 GDPR.
Web Fonts (hosted via Framer)
This website uses fonts served through the infrastructure of our hosting provider Framer B.V. (framerusercontent.com). No connection to Google or other third-party font services is established. When the font files are retrieved, your IP address is technically transmitted to Framer (see "Hosting and Server Log Files").
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a consistent and performant presentation of the website.
Cookies, Local Storage and Consent Management
This website uses a consent banner. It lets you decide which categories of non-essential technologies may be used.
Categories in the banner:
Necessary: always active. These technologies are required for the website to function.
Preferences: currently not used for any additional services.
Analytics: Google Tag Manager and Google Analytics 4 (see below).
Marketing: currently not used for any services. If we use marketing technologies in the future, we will do so only with your consent and will update this policy beforehand.
Your consent decision is stored in your browser's local storage, under the entries "framerCookiesConsentMode" and "framerCookiesDismissed". This storage is technically necessary to respect your choice. It is based on Art. 6(1)(f) GDPR in conjunction with § 25(2) no. 2 TDDDG and does not require consent.
All non-essential technologies are used only after you have given your prior consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
You can change or withdraw your consent at any time with future effect. To do so, open "Cookie Settings" in the footer of this website.
Google Tag Manager
With your consent to the "Analytics" category, this website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Tag Manager is used to load and manage website tags, in our case Google Analytics.
Google Tag Manager is only loaded after you have given your consent. Before that, no connection to Google servers is established. The Tag Manager itself does not set cookies and does not create user profiles. When it is loaded, however, your IP address and technical browser information are transmitted to Google servers, which may also be located in the USA.
We use Google Consent Mode. It passes your consent decision to the Google services, and the default setting is "denied".
The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
Google Analytics 4
With your consent to the "Analytics" category, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses cookies and similar technologies to analyse how visitors use the website. This includes:
pages viewed and time spent on the site
referring website
device type and browser
approximate location (country or city)
interactions with content
Google processes this information on our behalf to evaluate the use of the website and to compile reports on website activity. Google Analytics 4 does not log or store full IP addresses. IP addresses are used only to derive approximate location data and are then discarded.
We have deactivated Google Signals, and Google Analytics is not linked to Google Ads or other advertising services. Your data is therefore not used for advertising purposes or for cross-device tracking.
Retention: Event-level data is automatically deleted after 2 months. User-level data is deleted after 14 months.
Cookies used: _ga and _ga_<container-ID>, each with a storage period of up to 2 years.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time with future effect via "Cookie Settings" in the footer.
We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, on the basis of the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, standard contractual clauses (Art. 46 GDPR) apply.
Further information: https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/
Framer Analytics
This website uses Framer Analytics, the analytics function integrated into our hosting provider Framer B.V. Framer Analytics does not set cookies and does not use persistent identifiers. It only creates aggregated statistics, such as page views and referrers, that do not allow individual visitors to be identified. Your IP address is processed only briefly and technically by Framer for this purpose (see "Hosting and Server Log Files") and is not stored for analytics purposes.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the cookieless, privacy-friendly statistical evaluation of website usage. Since no information is stored on or read from your device for this purpose, no consent under § 25 TDDDG is required.
Contact
When you contact us by email or telephone, we process the personal data you transmit in order to respond to your inquiry. This includes in particular your name, contact details and the content of your inquiry.
The legal basis is Art. 6(1)(b) GDPR if your inquiry is aimed at the conclusion or performance of a contract. Otherwise, the legal basis is Art. 6(1)(f) GDPR. We delete the data as soon as your inquiry has been fully processed, unless statutory retention obligations apply.
Job Applications
We process application documents exclusively for the purpose of conducting the application process. This applies in particular to name, contact details, CV, references, portfolio and any other information you provide voluntarily.
The legal basis is Section 26 of the German Federal Data Protection Act (BDSG) and Art. 6(1)(b) GDPR. If you are not hired, we delete your application data after the process has been completed, generally within six months. This does not apply if there is a legal retention obligation or if you have consented to longer storage.
Portfolio and Media Content
This website displays project images, reference photos and similar media. If this media is hosted directly on Framer's servers, no personal data of website visitors is transferred to third parties.
If media content from external providers (e.g. video platforms) is embedded, this is done only with your prior consent (Art. 6(1)(a) GDPR).
Recipients and Processors
Personal data may be transferred to external service providers (processors) to the extent necessary for operating the website or processing inquiries. We currently use the following processors:
Framer B.V., Wilhelminaplein 4, 3072 DE Rotterdam, Netherlands: hosting, website infrastructure and Framer Analytics
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: tag management and web analytics, only with your consent
We have concluded data processing agreements pursuant to Art. 28 GDPR with all processors.
Transfers to Third Countries
Data may be transferred to countries outside the European Economic Area (EEA) in connection with hosting, analytics or embedded services. Such transfers take place only on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular the EU Commission's standard contractual clauses.
Where data is transferred to Google LLC (USA), this is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in addition, on standard contractual clauses.
Retention Period
We store personal data only for as long as necessary for the respective purpose of processing or as required by statutory retention obligations, in particular under commercial and tax law. As soon as the purpose no longer applies and no such obligations remain, the data is deleted or anonymised.
Rights of Data Subjects
Under the GDPR, you have the following rights:
Right of access (Art. 15 GDPR)
Right to rectification of inaccurate data (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
Right to withdraw consent with future effect (Art. 7(3) GDPR), for example via "Cookie Settings" in the footer
To exercise these rights, simply send an informal email to: info@undplus.com
Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The competent supervisory authority for UNDPLUS GmbH (Berlin) is:
Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin
www.datenschutz-berlin.de
Automated Decision-Making and Profiling
We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Validity and Changes to This Privacy Policy
This privacy policy is current as of October 2026. We reserve the right to amend it so that it always complies with current legal requirements and the actual processing operations on this website.
As of: October 2026
