← Back to home

Privacy Policy

The rendering below is an unofficial translation provided for ease of understanding. Only the German version of this text is legally binding.

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data means all data by which you can be personally identified.

1.2 The controller for the processing of data on this website within the meaning of the General Data Protection Regulation (GDPR) is Michail Frantzeskakis, Paragogoi by FlyDropGlobal, Am Hackenbruch 68e, 40231 Düsseldorf, Germany, tel.: 015236362561, e-mail: info@paragogoi.com. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1 When you use our website purely for informational purposes, i.e. if you do not register or otherwise transmit information to us, we only collect such data as your browser transmits to the server of the website (so-called "server log files"). When you visit our website, we collect the following data, which are technically necessary for us to display the website to you:

  • Our visited website
  • Date and time at the time of access
  • Amount of data sent in bytes
  • Source/reference from which you reached the page
  • Browser used
  • Operating system used
  • IP address used (where applicable: in anonymised form)

Processing takes place in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. Our hosting provider Lovable also processes the information listed above in its request logs as an independent controller for its own purposes (see section 3 for details). Beyond this, we do not pass this information on to third parties or use it in any other way. However, we reserve the right to subsequently check the server log files if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or requests to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the lock symbol in your browser bar.

3) Hosting & Content Delivery Network

Hosting and development of the application: Lovable Labs Incorporated, One Lincoln Street, Boston, MA 02111, USA, as processor. In this context, personal data may be transferred to the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). They are incorporated by reference into Lovable's Data Processing Addendum: https://lovable.dev/data-processing-agreement. Their text is published in the Annex to Commission Implementing Decision (EU) 2021/914. Data protection officer of Lovable: Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, dpo@lovable.dev.

Insofar as Lovable processes content or user data of the published application, Lovable acts as our processor and on our instructions. By contrast, the request logs that Lovable generates to operate and secure the hosting, and which contain in particular the respective visitor's IP address, approximate location and browser and device information, are processed by Lovable as an independent controller for its own purposes, namely the security, operation and improvement of its platform, as provided for in the Data Processing Addendum and described in Lovable's privacy policy (https://lovable.dev/privacy). There you will also find information on the legal basis, the storage period, transfers to third countries and your rights in relation to Lovable. The legal basis for Lovable receiving this information when you visit our website is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of our website.

The published pages are delivered via a worldwide content delivery network from the nearest location in each case. In this process, the data mentioned in section 2.1 may also be processed outside the European Union. The provider bases transfers to third countries on EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914).

We operate the platform's database, the login and the data storage at Supabase Inc. in the Frankfurt am Main region, Germany. The data stored there remains on servers within the European Union, unless different data recipients are named below for specific processing operations.

We have concluded a data processing agreement with Supabase Inc. which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties. A data processing agreement pursuant to Art. 28 GDPR has been in force with Lovable Labs Incorporated since 04.11.2026.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after the browser is closed (so-called "session cookies"), while others remain on your device for longer and enable the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of the cookie settings of your web browser.

Insofar as personal data are also processed through individual cookies used by us, the processing takes place in accordance with Article 6(1)(b) GDPR either for the performance of the contract, in accordance with Article 6(1)(a) GDPR in the case of consent given, or in accordance with Article 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that the functionality of our website may be limited if cookies are not accepted.

When you visit our website, our hosting provider (section 3) sets the cookie "__cf_bm" via the network of Cloudflare through which the pages are delivered. It serves to fend off automated access (bots) and contains, in encrypted form, information used to assess whether an access is automated and, where applicable, a session identifier. According to Cloudflare, it is not used to track users from site to site or from session to session. The cookie expires after 30 minutes without activity. The storage on your device and access to it take place under Section 25(2)(2) TDDDG, as they are strictly necessary for the secure provision of the website you are visiting. The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the website against misuse. In this process, data may also be processed in the USA; section 3 applies to the transfer.

Each time a page of our website is loaded, our hosting provider (section 3) also sets the cookie "__dpl" anew. It contains the identifier of the published version of our website that was delivered to you, a time value and a technical character string of the hosting provider. According to the provider, it serves to assign your browser's further requests to the same published version of our website, so that the pages load without errors even if a new version is published during your visit. Your browser sends it with every further request to our website; it is not transmitted to other websites. The cookie expires 24 hours after it was last set. The storage on your device and access to it take place under Section 25(2)(2) TDDDG, as they are strictly necessary for the error-free provision of the website you are visiting. Insofar as personal data are processed, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the stable and error-free delivery of our website. In this process, data may also be processed in the USA; section 3 applies to the transfer.

Section 7.5 applies to the cookie "pg_ref", which we use to store a referral only with your consent.

5) Contacting us

5.1 In the context of contacting us (e.g. via contact form or e-mail), personal data are processed – exclusively for the purpose of handling and answering your request and only to the extent necessary for this.

The legal basis for the processing of these data is our legitimate interest in answering your request in accordance with Article 6(1)(f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Article 6(1)(b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations conflict with this.

5.2 - Resend

For sending transactional e-mails, i.e. event-driven messages triggered by a specific user interaction (such as conclusion of a contract, registration or password reset), we use the following provider: Plus Five Five, Inc., 2261 Market Street, #5039, San Francisco, CA 94114, USA

On the basis of our legitimate interest in effective and user-friendly e-mail communication, we transfer the data you provide when carrying out such a user action to this provider pursuant to Article 6(1)(f) GDPR, so that it handles the dispatch of e-mails on our behalf.

We also send all other e-mails from info@paragogoi.com via this provider, such as replies to requests and messages to Referral Partners. In doing so, the provider processes the e-mail addresses of sender and recipient, the recipient's name where provided, and the subject and content of the e-mail. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the reliable sending of our e-mails. Where the e-mail concerns a contract with you or its initiation, Article 6(1)(b) GDPR is also a legal basis.

We have concluded a data processing agreement with the provider which protects our site visitors' data and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

6) Data processing when opening an account for professionals

6.1 In accordance with Article 6(1)(b) GDPR, personal data continue to be collected and processed to the extent required in each case if you provide them to us when opening an account as a professional. Which data are required for opening the account can be seen from the input mask of the corresponding form on our website.

6.2 Publication of the professional's provider identification

An account on this platform is opened exclusively for professionals (entrepreneurs) who operate their own provider page via the platform. The provider data supplied by the professional upon registration – name or company name, legal form where applicable, address, e-mail address and telephone number as well as, where provided, VAT identification number or tax number and register details – are published in publicly accessible form on the provider page of the respective professional, namely in the provider identification (imprint) and in the professional's privacy policy.

The purpose of the publication is to fulfil the statutory information obligations incumbent on the professional as a service provider (Section 5 DDG or corresponding provisions at the professional's place of establishment) and to enable interested parties to make direct contact. The legal basis is Article 6(1)(b) GDPR, since the provision of a provider page with legally compliant provider identification is the subject matter of the contract concluded with the professional.

The published data are accessible worldwide and may be recorded by search engines. They are removed as soon as the provider page is deactivated or the account is deleted. We have no influence on cached copies held by search engines or internet archives.

6.3 Deletion of your account is possible at any time and can be effected by sending a message to the aforementioned address of the controller. After deletion of your account, your data will be deleted, provided that all contracts concluded through it have been fully processed, no statutory retention periods conflict with this and no legitimate interest in continued storage exists on our part.

7) Data processing for contract performance

7.1 To process the contract, we work together with the following service provider(s) who support us wholly or partly in the performance of concluded contracts. Certain personal data are transmitted to these service providers in accordance with the following information.

7.2 Use of payment service providers

- Stripe

Professionals can pay the remuneration for their page by card via the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. They receive the payment link together with the invoice; payment takes place on a Stripe page and not on this website. Alternatively, payment by bank transfer is possible (Service Description, section 8). Visitors do not pay anything via this website.

If a professional chooses to pay via Stripe, the payment data required for this (including name, address, bank and payment card information, currency and transaction number) and details of the invoice being paid are passed on to Stripe pursuant to Article 6(1)(b) GDPR. The data are passed on exclusively for the purpose of processing the payment and only to the extent necessary for this.

7.3 Order and contact requests to professionals (processing on behalf)

Via our platform, you can send requests (e.g. order or product requests) directly to a professional listed on the platform. Which data are required for this can be seen from the input mask of the corresponding form. These data are transmitted to the respective professional and processed exclusively for the purpose of handling and processing your request.

The controller under data protection law for the processing of these request data is the respective professional. We process these data on their behalf as a processor within the meaning of Article 28 GDPR on the basis of a data processing agreement concluded with the professional. The legal basis for the processing by the professional is Article 6(1)(b) GDPR (performance of pre-contractual measures or performance of the contract).

To exercise your data subject rights (see section 9) with regard to these data, please primarily contact the respective professional. You can also contact us at any time; we will forward your request to the professional.

The request data are deleted as soon as they are no longer required for handling and processing the request and no statutory retention obligations conflict with this. In all other respects, section 10 of this privacy policy applies.

7.4 - Automatic translation

The pages of professionals are displayed in 25 languages. For this purpose, the texts that a professional enters for their own page within the framework of the contractual relationship with them (in particular product names, descriptions, and questions and answers) are translated automatically into the other languages. These texts may contain personal data, such as names.

For the translation we use a language model of the Claude model family by Anthropic. We do not access it via Anthropic but via the AI service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg, which acts as our processor on the basis of a contract pursuant to Art. 28 GDPR. Processing takes place exclusively in this provider's data centres in the European Union, namely in Germany, Sweden, Italy, Spain, Ireland and France. The provider determines, according to load, in which of these data centres an individual request is processed.

According to the provider, the transmitted texts are not stored by it beyond the respective translation, are not used to train models and are not passed on to Anthropic.

The legal basis is Art. 6(1)(b) GDPR, as presenting the page in all languages offered is part of the contract with the professional (Service Description, section 2.4). Insofar as the texts contain data of other persons, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting the page in all languages offered, as provided for in the contract.

7.5 - Referral Partner Programme

If you apply to our Referral Partner Programme, we process the data contained in your participation request together with the data required to run the programme. These are: name or company name, address, date of birth, e-mail address, a tax number where one exists, the referral code assigned to you together with the referrals attributed to it, and the bank account to which the commission is paid.

We collect the date of birth in order to identify unambiguously the person to whom a commission is paid. Without it we cannot make a payout.

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary to enter into and perform the participation relationship. Where we retain the data beyond that in order to meet commercial and tax record-keeping obligations, the legal basis is Art. 6(1)(c) GDPR.

If you use the referral partner area (paragogoi.com/partner-portal), we additionally process: your e-mail address, to send you a one-time sign-in code; the time and hash values of the e-mail address and the IP address of each code request, to protect against misuse, which we delete after 24 hours; and, while you are signed in, a technically necessary session key in your browser, which is removed when you sign out. We inform you by e-mail about every new commission. The legal basis is Art. 6(1)(b) GDPR and, for protection against misuse, Art. 6(1)(f) GDPR (legitimate interest in secure access). Section 5 additionally applies to sending e-mails.

Data is passed to third parties only where this is necessary for payout through our bank or for compliance with statutory obligations towards the tax authorities. Your participation request reaches us by e-mail; section 5 additionally applies to that transmission channel. Section 10 applies to the storage period and section 9 to your rights.

If, as a professional, you indicate a referral at your first contact with us, we store the referral code and the day of contact and, when your access is activated, the day of activation. You indicate a referral if you name a referral code, if our form or an e-mail prepared by our website transmits a code that comes from a link of the same visit or from a stored referral (next paragraph), or if you name the code or the name of a Referral Partner or of their portal in the field "How did you hear about us?" or in your first message. You see such a code in the form or in the e-mail before sending, and you can remove it. The sole purpose is to determine and settle the remuneration of the Referral Partner. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest, and that of the Referral Partner, lies in correct settlement. Where retention obligations exist, the legal basis is Art. 6(1)(c) GDPR. Recipient (Art. 13(1)(e) GDPR): the Referral Partner receives only the day of your contact and of your activation, the day, amount and rate of each payment, the number of active referred professionals, and the day, amount and type of any chargeback, never your name, your contact details or other identifying particulars. We store these particulars as long as claims to remuneration can arise or cease from them, and thereafter until the statutory retention periods expire. Your right to object under section 9.2 remains unaffected. Any entry in the field "How did you hear about us?" is voluntary; it is part of your request (section 5.1) and is not passed on to Referral Partners.

Storing a referral in your browser: if you open paragogoi.com via a link containing a referral code, we ask whether we may store the referral in your browser for 90 days. Without your consent, our website keeps the code only in your browser's working memory during this visit. If you agree, we set the cookie "pg_ref", which contains only the referral code and the date of storage, and no particulars about you. Your browser sends it with every request to paragogoi.com; we use it only to fill the code into our form or into an e-mail prepared by our website if you request a page within 90 days. This way the referral can be credited to the Referral Partner even if you only send your request on a later visit. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Consent is voluntary; if you decline, we store nothing and you can use our website without restriction. The cookie deletes itself after 90 days. You can withdraw your consent at any time with effect for the future by deleting the cookie via the link "Stored referral", which appears at the bottom of our pages while a referral is stored; the lawfulness of the processing up to the withdrawal remains unaffected. We do not recognise you by any other means, in particular not by your IP address or by characteristics of your device (fingerprinting).

7.6 Administration and communication tools

For e-mail correspondence via info@paragogoi.com we use Google Workspace provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; a data processing agreement pursuant to Art. 28 GDPR (Cloud Data Processing Addendum) is in place with Google. In this process, data may also be processed in the United States; Google LLC is certified under the EU-US Data Privacy Framework. E-mails to info@paragogoi.com are received on our behalf by checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany, a subsidiary of dogado GmbH, Dortmund, on mail servers of the dogado group and forwarded to our mailbox at Google Workspace. We send our e-mails, such as replies to requests and messages to Referral Partners, via Resend (section 5.2). E-mails to info@paragogoi.com received up to 16.10.2026 were forwarded to a mailbox at Gmail, where they are still stored. We store documents, including copies of our correspondence as evidence, in Google Drive. The provider of Gmail and Google Drive is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; here, too, data may be processed in the United States. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in handling correspondence and documents securely and in one place.

To support the administration of the platform, database analyses and the handling of e-mails and documents, we use the AI tool Claude by Anthropic Ireland, Limited, Ireland. This is distinct from the automatic translation under section 7.4. Insofar as personal data is processed in this context, such as data of professionals, visitors or Referral Partners displayed during administration, this is done from 01.11.2026 under the "Team" plan pursuant to Anthropic's Commercial Terms of Service and a data processing agreement (Data Processing Addendum); Anthropic acts as a processor. Use of the contents for training the models is excluded. Anthropic stores the data in the United States; the basis for the transfer is the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Modules 2 and 3). The data is stored for the term of the contract and deleted within 30 days of the end of the contract, unless a statutory retention obligation exists. The legal basis is that of the respective underlying processing.

8) Website functionalities

- Cloudflare Turnstile

On this website we use the CAPTCHA service of the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA

The service checks whether an input is made by a natural person or abusively by machine-based and automated processing, and blocks spam, DDoS attacks and similar automated malicious access. In order to ensure that an action is carried out by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the device used, detection data on the browser and operating system type used as well as the date and duration of the visit, and transmits these to the provider's servers for evaluation.

The legal basis is our legitimate interest in establishing individual personal responsibility on the internet and in preventing misuse and spam pursuant to Article 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

9) Rights of the data subject

9.1 The applicable data protection law grants you, vis-à-vis the controller, with regard to the processing of your personal data, the following data subject rights (rights to information and intervention), whereby reference is made to the legal basis cited for the respective exercise requirements:

  • Right of access pursuant to Article 15 GDPR;
  • Right to rectification pursuant to Article 16 GDPR;
  • Right to erasure pursuant to Article 17 GDPR;
  • Right to restriction of processing pursuant to Article 18 GDPR;
  • Right to notification pursuant to Article 19 GDPR;
  • Right to data portability pursuant to Article 20 GDPR;
  • Right to withdraw consent given pursuant to Article 7(3) GDPR;
  • Right to lodge a complaint pursuant to Article 77 GDPR.

9.2 RIGHT TO OBJECT

IF, IN THE CONTEXT OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE THE PROCESSING OF THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA ARE PROCESSED BY US FOR THE PURPOSES OF DIRECT MARKETING, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE THE PROCESSING OF THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

10) Duration of storage of personal data

The duration of the storage of personal data is determined on the basis of the respective legal basis, the purpose of the processing and – where applicable – additionally on the basis of the respective statutory retention period (e.g. commercial and tax retention periods).

In the case of processing of personal data on the basis of an express consent pursuant to Article 6(1)(a) GDPR, the data concerned are stored until you withdraw your consent.

If statutory retention periods exist for data that are processed within the framework of legal or quasi-legal obligations on the basis of Article 6(1)(b) GDPR, these data are routinely deleted after expiry of the retention periods, provided that they are no longer required for the performance or initiation of the contract and/or no legitimate interest in continued storage exists on our part.

In the case of processing of personal data on the basis of Article 6(1)(f) GDPR, these data are stored until you exercise your right to object under Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

In the case of processing of personal data for the purpose of direct marketing on the basis of Article 6(1)(f) GDPR, these data are stored until you exercise your right to object under Article 21(2) GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data are otherwise deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.