Data Protection Declaration
Information on Data Processing Pursuant to Arts. 13 and 14 GDPR
We are pleased that you are visiting our website. Protecting the security of your personal information when you use our website is very important to us. We would therefore like to inform you here about which of your personal data we collect when you visit our website and for what purposes it is used.
This Privacy Notice applies to the online services of Driven Investment GmbH, which are available under the domain driven-investment.com and its various subdomains (collectively, “our website”).
In this notice, we explain when we store which data and how we use it—naturally in compliance with applicable law. Data protection at Driven Investment GmbH is based in particular on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). When you use the internet, we also follow the Telecommunications Digital Services Data Protection Act (TDDDG) of the Federal Republic of Germany in order to protect your personal data.
Below, we explain which information we collect during your visit to our website and how that information is used.
Who is responsible and how can you contact us?
Controller
for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR)
Driven Investment GmbH
Pariser Straße 1, 10719 Berlin, Germany
Telephone: +49 (0) 30 / 544 53 69 40
Email: contact@driven-investment.com
Data Protection Officer
DataSolution LUD GmbH
Isarstr. 13, 14974 Ludwigsfelde, Germany
Mr Kay Kühnel
Email: k.kuehnel@ds-lud.de
What is this about?
This Privacy Notice fulfils the statutory transparency requirements for the processing of personal data. Personal data means any information relating to an identified or identifiable natural person. Examples include your name, age, address, telephone number, date of birth, email address, IP address or your user behaviour when visiting a website. Information that cannot be linked to you, or can only be linked to you with disproportionate effort—for example through anonymisation—is not personal data. The processing of personal data, such as collection, retrieval, use, storage or transmission, always requires a legal basis and a defined purpose.
Stored personal data is deleted once the purpose of processing has been achieved and there are no lawful grounds for further retention. For each processing operation, we provide information about the specific retention periods or the criteria used to determine them. Irrespective of this, in individual cases we retain your personal data for the establishment, exercise or defence of legal claims and where statutory retention obligations apply.
Who receives your data?
We disclose personal data processed on our website to third parties only where this is necessary to fulfil the relevant purposes and is covered by the applicable legal basis in the individual case, for example consent or the pursuit of legitimate interests. In individual cases, we may also disclose personal data to third parties where this serves the establishment, exercise or defence of legal claims. Possible recipients may include law enforcement authorities, lawyers, auditors, courts and similar bodies.
Where we use service providers to operate our website and those providers process personal data on our behalf as processors pursuant to Art. 28 GDPR, they may be recipients of your personal data. Further information on the use of processors and web services is provided in the overview of the individual processing operations.
General information on data processing
As a general rule, we collect and use personal data only insofar as this is necessary to provide a functional website and our content and services, or where we collect and process data for other purposes independently of the website.
Legal basis for processing personal data
We process personal data on the following legal bases:
- Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.
- Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to take steps prior to entering into a contract.
- Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
- Where processing is necessary for the purposes of a legitimate interest pursued by our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
In connection with each processing operation, we refer to the relevant legal terminology so that you can identify the basis on which we process personal data.
Where personal data is processed on the basis of your consent, you have the right to withdraw that consent at any time with effect for the future.
Where we process data on the basis of a balancing of interests, you as the data subject have the right, subject to the requirements of Art. 21 GDPR, to object to the processing of your personal data.
Deletion of data and retention period
The personal data of the data subject is deleted or restricted as soon as the purpose of storage no longer applies. Data may be stored beyond this point where this is provided for by the European or national legislature in EU regulations, laws or other provisions to which the controller is subject. Data is also restricted or deleted when a retention period prescribed by those rules expires, unless continued storage is necessary for entering into or performing a contract.
Email contact
You may contact us using the email addresses provided. In this case, the personal data transmitted with the email will be stored.
Legal basis for data processing
The legal basis for processing the data is initially our legitimate interest in processing data in connection with contact initiated by the person making the enquiry. Where the contact is aimed at entering into a contract, the additional legal basis for processing is the initiation or performance of a contractual relationship.
Purpose of data processing
The personal data is processed solely for the purpose of handling the contact and responding to your enquiry.
Retention period
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For personal data transmitted by email, this is the case when the respective conversation with the user has ended. A conversation is deemed to have ended when the circumstances indicate that the matter in question has been conclusively resolved.
Right to object
You may object to the processing of your data at any time. For this purpose, we have set up the email address datenschutz@driven-investment.com. Please note that, in the event of an objection, the conversation cannot be continued. All personal data stored in the course of the contact will then be deleted.
Consulting and support for business contacts
For the consulting and support of corporate customers, in addition to information about the business partner or potential business partner, we collect and use the contact person, telephone number, email address, postal address and, where applicable, position. We obtain this information from various sources, including enquiries by email or telephone, events, trade fairs and business cards received by our sales staff.
No data is disclosed to third parties in this context.
Legal basis for data processing
The legal basis for processing the data is our legitimate interest in the processing. Where the contact is aimed at entering into a contract, the additional legal basis for processing is the pre-contractual relationship or the conclusion of the contract.
Purpose of data processing
We use this contact information exclusively for our own purposes and to tailor our own sales activities to actual needs.
Retention period
As a general rule, no fixed deletion period is specified. However, if our sales department has had no contact with the business contact for three years, the sales department will decide whether the contact person’s data should be deleted.
Where the contact relates to a pre-contractual relationship, such as a request for a quotation, the transmitted data is additionally stored in our administrative software and used for contract performance. If no contractual relationship is established, we delete the data at the end of the year following a one-year period.
Right to object
As a business contact, you may object to the processing of your data at any time. For this purpose, we have set up the email address datenschutz@driven-investment.com. In this case, all personal data relating to the contact person and stored in connection with the business partner will be deleted.
Newsletter service
We would like to take the opportunity to inform our business contacts regularly about our offers and products by means of an information newsletter or by post.
Legal basis for data processing
The legal basis for processing the data is the recipient’s consent.
Purpose of data processing
The personal data is processed solely for the purpose of sending individual mailings.
Retention period
The data is deleted or, where necessary, restricted as soon as the electronic mailing service is unsubscribed from.
Right to object
As a recipient of mailings, you may object to the processing of your data at any time. For this purpose, we have set up the email address datenschutz@driven-investment.com. Please state the relevant email address in your message.
Your application for a vacancy
If you provide us with personal data as part of the application process, that data is collected, processed and/or used in the following data types and categories:
- Personal data (first name and surname, date of birth, address, school-leaving qualification)
- Communication data (telephone number, mobile telephone number, email address)
- Data relating to assessment and evaluation during the application process
- Education and training data (school, vocational training, civilian/military service, university studies, doctorate)
- Data relating to previous professional experience, education certificates and employment references
- Information on other qualifications, such as language skills, IT skills and voluntary activities
- Where applicable, application photograph
- Where applicable, application history
We use the personal data you submit exclusively for processing your application for the advertised position. Access to your personal data is limited to persons involved in the application process. All employees involved in data processing are obliged to maintain the confidentiality of your data. We do not disclose your personal data to third parties unless you have consented to the disclosure or we are required to disclose it by law and/or by an official or court order.
Legal basis for data processing
The legal basis for processing the data is the pre-contractual relationship or the conclusion of a contract with the applicant. Before forwarding application documents, we will obtain consent.
Purpose of data processing
The data submitted to us is used exclusively by the relevant department to process the application and for communication purposes.
Retention period
The data is deleted as soon as it is no longer required for the purpose for which it was collected, and no later than six months after rejection. If we wish to retain your application documents beyond this period, we will first obtain your agreement in the form of implied consent to longer storage.
Where an employment or other contractual relationship is established, we delete the data received once the applicable national, commercial, statutory or contractual retention requirements have been met.
Right to object
You may object to the processing of your data at any time. To do so, please send an email to the office to which you submitted your application.
What rights do you have?
Where your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:
- You have a right of access to the personal data stored about you, the purposes of processing, any disclosures to other bodies and the retention period.
- If data is inaccurate or no longer required for the purposes for which it was collected, you may request rectification, erasure or restriction of processing. Where provided for in the relevant processing procedures, you may also inspect and, where applicable, correct your data yourself.
- Where reasons arising from your particular situation weigh against the processing of your personal data and the processing is based on a legitimate interest, you may object to that processing. The controller will then no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.
- Where personal data concerning you is processed for direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing or related profiling purposes, the personal data concerning you will no longer be processed for those purposes.
You have the right to withdraw your data protection consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
If you have questions about your rights or how to exercise them, please contact the management or the Data Protection Officer.
Your right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you as a data subject have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes data protection law.
The supervisory authority with which the complaint has been lodged will inform you of the progress and outcome of the complaint, including the possibility of a judicial remedy.
Further information is available on the website of the German Federal Commissioner for Data Protection and Freedom of Information. Follow this link: https://www.bfdi.bund.de/DE/Buerger/Inhalte/Allgemein/Datenschutz/BeschwerdeBeiDatenschutzbehoereden.html.
How is your data processed when you use the website?
Below, we inform you about the individual processing operations, the scope and purpose of processing, the legal basis, any obligation to provide your data and the relevant retention period. No automated decision-making in individual cases, including profiling, takes place.
Provision of the website
Nature and scope of processing
When you access and use our website, we collect the personal data that your browser automatically transmits to our server. The following information is temporarily stored in a log file:
- IP address of the requesting device
- Date and time of access
- Name and URL of the file accessed
- Website from which access was made (referrer URL)
- Browser used and, where applicable, the operating system of your device, as well as the name of your access provider
Purpose and legal basis
Processing is carried out to protect our overriding legitimate interest in displaying our website and ensuring its security and stability on the basis of Art. 6(1)(f) GDPR. The collection of data and storage in log files is essential for operation of the website. There is no right to object to this processing due to the exception under Art. 21(1) GDPR. Where further storage of log files is required by law, processing is based on Art. 6(1)(c) GDPR. There is no statutory or contractual obligation to provide the data; however, it is technically impossible to access our website without providing the data.
Retention period
The above data is stored for the duration of the website display and, for technical reasons, for a maximum of seven additional days.
Web hosting provider
Our website is hosted by IPtoX® GmbH, Lüner Rennbahn 9, 21339 Lüneburg, Germany. IPtoX® GmbH is an EU-based provider. No transfer to a third country takes place.
Do we use cookies?
Cookies are small text files that we send to the browser on your device during your visit to our website and that are stored there. As an alternative to cookies, information may also be stored in your browser’s local storage. Some functions of our website cannot be provided without the use of cookies or local storage (technically necessary cookies). Other cookies enable us to carry out various analyses, for example by allowing us to recognise the browser you use when you return to our website and to receive various information. Cookies help us make our online services more user-friendly and effective, for example by enabling us to understand how you use our website and to identify your preferred settings, such as country and language settings. Where third parties process information by means of cookies, they collect that information directly through your browser. Cookies do not cause any damage to your device. They cannot execute programs or contain viruses.
No cookies are used on our website (as of June 2026).
Presence on social media platforms
We maintain fan pages, accounts or channels on the networks listed below in order to provide you with information and offers within social networks and to offer additional ways of contacting us and learning about our services. Below, we explain which data we and the respective social network process in connection with your access to and use of our fan pages and accounts.
Data we process about you
If you contact us using a network’s messaging or messenger function, we process the name you use there and the content of your message insofar as this is necessary to handle your request.
Through the networks’ statistics or insights functions, we receive aggregated analyses that cannot be traced back to individual persons, such as reach, interactions and general information about the composition of our followers. We cannot use these analyses to draw conclusions about individual persons.
The legal basis for processing in connection with communication and the evaluation of aggregated statistics is our legitimate interest in an appealing public presence and in communicating with prospective customers and business partners pursuant to Art. 6(1)(f) GDPR. Where you have given consent to the respective network, Art. 6(1)(a) and Art. 7 GDPR also apply.
Data processed about you by social networks
You do not have to be a member of the relevant social network or have a user account with that network merely to view the content of our fan pages or accounts.
Please note, however, that when you access a social network, the network may collect and store data even from website visitors who do not have a user account, for example technical data required to display the website, and may use cookies and similar technologies over which we have no control. Details can be found in the privacy policies of the respective social network.
If you wish to interact with content on our fan pages or accounts, for example by commenting on, sharing or liking our posts, and/or contact us via messenger functions, you must first register with the relevant social network and provide personal data.
We have no control over the processing of your data by social networks when you use them. To the best of our knowledge, your data is stored and processed in particular in connection with providing the services of the relevant social network and for analysing user behaviour through cookies, pixels, web beacons and similar technologies. Based on this analysis, advertising tailored to your interests may be displayed both within and outside the social network. It cannot be ruled out that social networks also store your data outside the EU/EEA and disclose it to third parties.
Information on the precise scope and purposes of processing your personal data, retention and deletion periods, and policies on the use of cookies and similar technologies in connection with registration for and use of social networks can be found in the privacy and cookie policies of the respective networks. Those policies also contain information on your rights and options for objecting.
Facebook page
We maintain a Facebook page. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (US parent company: Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA).
When you visit our Facebook page, Meta collects, among other things, your IP address and other information stored as cookies on your device. Meta uses this data to provide us with aggregated statistics (“Page Insights”) on the use of our page. These statistics do not allow us to draw conclusions about individual persons.
With regard to the processing of this Insights data, we and Meta are joint controllers pursuant to Art. 26 GDPR. Meta provides the essential content of the joint controllership agreement at https://www.facebook.com/legal/terms/page_controller_addendum. Under that agreement, Meta bears primary responsibility for processing the Insights data. You may exercise your data subject rights both against Meta and against us; however, full implementation can generally only be carried out by Meta.
The legal basis is Art. 6(1)(f) GDPR, namely our legitimate interest in communication and public presentation; where you have given consent to Meta, Art. 6(1)(a) and Art. 7 GDPR apply. Meta may also transfer personal data to the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses may also apply.
Further information is available in Meta’s Privacy Policy at https://www.facebook.com/privacy/policy/ and in the information on Page Insights at https://www.facebook.com/help/pages/insights.
LinkedIn company profile
We maintain a company profile on LinkedIn. For users in the European Economic Area, the provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (US parent company: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA).
When you visit our profile, LinkedIn processes personal data, such as your name, job title where applicable and IP address, using various tracking technologies and provides us with aggregated, non-personal statistics derived from that data. We have no influence over the data collected by LinkedIn using these technologies; in this respect, LinkedIn is regarded as the controller. We are responsible for the content we publish and for our communications with you.
Where LinkedIn provides us with aggregated page statistics, this takes place under joint controllership pursuant to Art. 26 GDPR. LinkedIn provides further information at https://legal.linkedin.com/pages-joint-controller-addendum.
The legal basis is Art. 6(1)(f) GDPR; where you have given consent to LinkedIn, Art. 6(1)(a) and Art. 7 GDPR apply. LinkedIn may also transfer personal data to the USA. LinkedIn Corporation is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses may also be used.
Further information is available in LinkedIn’s Privacy Policy at https://www.linkedin.com/legal/privacy-policy and in its Cookie Policy at https://www.linkedin.com/legal/cookie-policy.
Instagram profile
We maintain an Instagram profile. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (US parent company: Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA).
When you visit our Instagram profile, Meta collects, among other things, your IP address and other information stored as cookies on your device and uses it to provide us with aggregated statistics on the use of our profile. These statistics do not allow us to draw conclusions about individual persons. We and Meta are joint controllers for the processing of this Insights data pursuant to Art. 26 GDPR; the joint controllership agreement referred to above for the Facebook page applies accordingly.
The legal basis is Art. 6(1)(f) GDPR; where you have given consent to Meta, Art. 6(1)(a) and Art. 7 GDPR apply. A transfer to the USA is also possible in this context. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses may also be used.
Further information is available in Instagram’s Privacy Policy at https://privacycenter.instagram.com/policy/.
Links to our social media profiles
The logos of social networks and sharing functions, such as Facebook share buttons, are embedded on our website solely as links. They are not active social media plugins: when you access our pages, no connection is established to the networks’ servers and no data is transmitted to them. Only when you click a logo or sharing button are you redirected to the relevant network or is the sharing dialogue opened. From that point onward, the privacy information of the respective provider applies.
Publication of images:
Where we publish photographs featuring our business partners on our social media channels, for example photographs from events, we generally obtain the consent of the persons depicted in advance. Any person depicted, as well as other third parties, may object at any time with future effect to the publication of their personal data in the form of photographs. For this purpose, we have set up the email address datenschutz@driven-investment.com.
Please note that once a photograph has been published on one of our social media channels, we no longer have any control over further processing by the respective platform operator. Once an image has been uploaded, the provider processes it under its own responsibility and in accordance with its own terms. This may include storing, analysing, linking and disclosing the image data, transferring it to third countries and using it for the provider’s own purposes, for example to train automated systems.
Depending on the visibility settings, published photographs may also be viewed, stored, copied and redistributed by other users and third parties and may be processed further using technical means, including artificial intelligence, for example for facial recognition or the automated creation, analysis or alteration of image content. Neither we nor the person depicted has any control over such processing by the platform operator or third parties.
Withdrawal of consent or an objection will result in our removing the photograph concerned from our own channels. Copies previously made or processing previously carried out by the platform operator or third parties may remain unaffected and may continue outside our sphere of influence.
Data processing outside the European Union
Where personal data is processed outside the European Union, this is indicated in the preceding sections.
Security
We use technical and organisational security measures in accordance with Art. 32 GDPR to protect the data we manage against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments. Access is limited to a small number of authorised persons who are subject to specific data protection obligations and are involved in the technical, administrative or editorial management of data.
For security reasons and to protect the transmission of confidential content, such as enquiries you send to us as the website operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection because the address line in your browser changes from “http://” to “https://” and a padlock symbol appears in the browser bar. When SSL or TLS encryption is enabled, data that you transmit to us cannot be read by third parties. We have also implemented technical and organisational measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction and unauthorised access by third parties.
Updates and amendments to this Privacy Notice
We reserve the right to amend, update or supplement this Privacy Notice at any time. Any revised information on data processing applies only to personal data collected or changed after the revised version takes effect. The current version is always available on this website.
Version dated 22 June 2026 (replaces the version dated 9 October 2025)