Try now
HomeLegal

Privacy Policy

Last updated: 1 October 2026

This privacy policy describes our public website and the registration, ordering and support processes explained below. Information about optional landing tracking applies to the public website; the separately described support functions also concern the authenticated application. Linked external services process data under their own privacy notices.

Thank you for visiting our website. Data protection is very important to us, and we want you to feel secure while visiting our website.

You can therefore visit our website without providing personal data. However, using specific features, services or offers on our website may involve the processing of personal data. We collect, process and use personal data only if you have consented to its collection, processing and use or an appropriate legal basis exists.

We reserve the right to amend this privacy policy at any time with effect for the future. The current version is always available on our website and can be saved and printed.

Below, we provide detailed information about the nature, scope and purpose of the personal data we collect, use and process and explain your rights as a data subject.

Open cookie settings

Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of Member States and other data protection provisions is:

Civil-law partnership, represented by:

Denis Hoeger Caballero
Nobelstr- 3-5, 41189 Mönchengladbach
Owner: Denis Hoeger - Caballero
VAT ID: DE 293 033 132


Just Viral GmbH & Co. KG
Reinholdstraße 5, 21073 Hamburg
Managing director: Resul Mert Capa
Commercial register: HRB 138201, VAT ID: DE 306 459 825


Marius Glauer
Mühlenkamp 31, 22303 Hamburg
VAT ID: DE 304 137 075

Email: support@funnelcockpit.com

Telephone: on request

Access data and hosting with Vercel

Technical access data is processed to deliver and secure our website. This includes the IP address, request time and duration, requested URL, HTTP status, amount of data transferred, browser, device and operating system information and, where available, the referring page. This data enables website delivery, attack detection and investigation of technical errors.

We use Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, for hosting, server-side processing and delivery through a content delivery network. Vercel processes technical requests and access data. Our legitimate interest in a reliable and secure website is the legal basis under Article 6(1)(f) GDPR; Article 6(1)(b) GDPR additionally applies when providing contractual services. Hosting is necessary regardless of your optional tracking choices.

Technical logs are retained only for as long as needed for operation, security and error analysis. Longer retention may be necessary to investigate a specific security incident or meet statutory retention requirements. The public landing website loads fonts and its own design assets through our website delivery infrastructure. Vercel Web Analytics and Vercel Speed Insights are not integrated there.

Further information about Vercel: https://vercel.com/legal/privacy-notice

Vercel information about processing on behalf of customers and international processing: https://vercel.com/legal/dpa

Recipients and international data transfers

The providers listed below may process data on our behalf or act as independent controllers for their own purposes. In particular, Vercel, Intercom, PostHog and Google may involve US companies or additional subprocessors. A European storage location alone does not rule out access from third countries. Transfers outside the European Economic Area are subject to Articles 44 et seq. GDPR. An applicable adequacy decision or appropriate safeguards, particularly EU Standard Contractual Clauses and any necessary supplementary measures, may provide the basis. You can request information about the safeguards applicable to a particular processing activity at support@funnelcockpit.com.

Cookies, local storage and consent

We use technically necessary storage to remember your privacy choices and provide functions you explicitly request. On the landing website, the “gdprcookienotice” cookie stores your choices, a timestamp and the version of those choices for 30 days. Storage or access involving strictly necessary technologies is based on Section 25(2)(2) TDDDG. Personal data processing is based on Article 6(1)(f) GDPR for managing your privacy choices or Article 6(1)(b) GDPR for requested contractual functions.

Optional analytics and marketing technologies on the landing website are disabled initially. PostHog is loaded only after you consent to the “Analytics” category; Google Ads only after you consent to the “Marketing” category. The legal bases are Section 25(1) TDDDG for storage or access to information on your device and Article 6(1)(a) GDPR for personal data processing. Pseudonymous identifiers are not the same as anonymous data.

You can select categories individually, reject optional tracking and change or withdraw consent at any time with future effect using “Cookies” in the footer or “Open cookie settings” on this page. Withdrawal stops the relevant landing tracking and removes its accessible browser storage. Withdrawal does not automatically delete data already lawfully processed; your right to erasure remains. You can also delete cookies and local storage in your browser. Local storage has no automatic expiry without additional deletion logic.

Data collection and use during registration

You can register on our website. In this case, we collect the personal data you voluntarily provide during registration. The respective input forms show which data is collected.

The legal basis for processing your data is accordingly Article 6(1)(b) GDPR.

We use the data you provide only to perform the contract and provide our contractual services. We may also share your data with one or more processors (for example, payment service providers) who likewise use it solely internally on our behalf.

We also store your IP address and the date and time of registration to prevent misuse of our website and the services offered and, where necessary, investigate criminal offenses. Storing this data is therefore necessary for our own protection. The legal basis for processing personal data is Article 6(1)(f) GDPR. These purposes also constitute our legitimate interest in processing data under Article 6(1)(f) GDPR.

This data is generally not shared with third parties unless disclosure is legally required or serves law enforcement purposes.

Once the contract has been fully performed or your account deleted, your data is initially blocked from further use and deleted after statutory retention periods expire, unless you have expressly consented to further use or we reserve further use permitted by law and described below.

Website analytics with PostHog

After you consent to analytics, we use PostHog, Inc. to analyse use of our public landing website. The landing is configured for PostHog Cloud EU at eu.i.posthog.com; PostHog describes storage in Frankfurt am Main for this service. The purpose is to understand which pages are used and improve our website. The legal basis is Article 6(1)(a) GDPR.

Collected data includes page views, timestamps, pseudonymous browser and session identifiers and technical browser, device and screen characteristics. Transmission necessarily exposes the IP address to the provider; approximate location information may be derived from it. The landing sends page URLs without query parameters or fragments. This landing integration does not send names, email addresses, form inputs or content from your FunnelCockpit account to PostHog. Automatic click capture, session replay, surveys and automatic exception capture are disabled there.

PostHog stores its pseudonymous identifier in the browser’s local storage under “ph_landing…”. This storage remains until you delete it in your browser or withdraw analytics consent. In addition, the “referrerUrl” analytics cookie may store the referring page without query parameters or fragments for up to 30 days. Server-side analytics data is retained only for as long as necessary for the stated analysis purposes; statutory erasure obligations are taken into account when you request erasure or the purpose ceases. You can contact support@funnelcockpit.com for access or erasure requests.

PostHog privacy information: https://posthog.com/privacy

Information about processing on behalf of customers at PostHog: https://posthog.com/dpa

Google Ads and conversion measurement

After you consent to marketing, we use Google Ads with the Google tag for campaign and conversion measurement. The provider for the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC and other Google companies may participate in processing. We measure page visits and the visitor conversion event configured in our Google tag to assess advertising effectiveness. Google Analytics is not integrated into the public landing website.

IP address, browser and device information, visited pages, timestamps, advertising interactions and cookie or similar identifiers may be transmitted to Google. Depending on your consent and Google settings, Google may process this information to measure and personalise advertising and associate it with other data. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. Without marketing consent, the landing does not load Google Ads scripts or send tracking requests to Google.

Google describes a lifetime of up to 90 days for conversion cookies with the “_gcl_” prefix. Other storage used by Google may have different lifetimes; see Google’s cookie information for details. When you withdraw marketing consent, the landing stops tracking, removes accessible advertising cookies and reloads the page to stop previously loaded tracking scripts. You can also change advertising personalisation settings in your Google account.

Google privacy policy: https://policies.google.com/privacy

Information about Google cookies and their lifetimes: https://policies.google.com/technologies/cookies

Newsletter and newsletter analysis through Klick-Tipp

This website uses Klick-Tipp to send newsletters. The provider is KLICK-TIPP LIMITED, 15 Cambridge Court, 210 Shepherd's Bush Road, London W6 7NJ, United Kingdom.

Our newsletter is published regularly and contains information about online marketing and particularly our product.

To subscribe, you must provide your email address. You may voluntarily provide additional details, such as your name. Registration uses a double opt-in process. After registering on our website, you receive a confirmation email and must confirm your subscription again. This entire process is documented and stored, including the registration and confirmation times and your IP address. Collecting this data lets us trace the process if an email address is misused and therefore protects our legal interests. By subscribing, you agree to receive our newsletter.

Where you have consented, the legal basis for processing your data after subscribing to the newsletter is Article 6(1)(a) GDPR.

Your data is stored on Klick-Tipp's servers. Klick-Tipp uses it to send and evaluate newsletters. Evaluation takes place on our behalf, but Klick-Tipp may also use the data to ensure and improve the quality of its own services.

When the newsletter is opened, its web beacon is retrieved from Klick-Tipp's server. This request collects information about your browser, system, IP address and the time of access. It also records whether and when the newsletter is opened and which links are clicked. These statistical measurements support the technical service improvements described above.

You may withdraw your consent to storing and using your personal data to receive the newsletter and to the statistical collection described above at any time with effect for the future. To withdraw consent, use the designated link in the newsletter, unsubscribe on our website or email your withdrawal to: support@funnelcockpit.com to notify us.

Your data is deleted once it is no longer necessary for the purpose for which it was collected. Your email address is therefore stored for as long as the newsletter subscription remains active.

For further data protection information, consult Klick-Tipp's privacy policy at https://www.klick-tipp.com/datenschutzerkl%C3%A4rung.

Email and contact form

In accordance with legal requirements, our website provides details enabling rapid electronic contact and direct communication with us, including our email address and contact form. If you contact us by email or through the form, the personal data you transmit is stored automatically. Other personal data processed during contact serves to prevent misuse of the contact form and ensure the security of our information technology systems.

The legal basis for processing data transmitted by email is Article 6(1)(f) GDPR. If contact aims to conclude a contract, Article 6(1)(b) GDPR provides an additional legal basis.

We use the personal data you transmit solely to process your specific inquiry. The data provided is always treated confidentially.

Data is deleted once it is no longer necessary for its collection purpose. For personal data entered in the contact form and sent by email, this is when the conversation with you has ended. The conversation has ended when the circumstances show that the matter has been conclusively resolved.

You may withdraw your consent to processing your personal data at any time. If you contact us, you may object to storage of your personal data at any time. In that case, the conversation cannot continue.

Customer support with Intercom and Chatbyte

We use Intercom and Chatbyte to handle support requests. The service used depends on the support channel and configuration. No Intercom or Chatbyte widgets are currently loaded on the public landing website. The following information concerns contacting our support team and chat functions in the authenticated FunnelCockpit application.

Processed data includes your messages, attachments you voluntarily provide, contact details and technical connection data. In the authenticated application, we also send your name, email address, FunnelCockpit user identifier and subscription tier to the support service being used to associate your request with your account. The purpose is to handle your requests, provide assistance and associate communication with your customer account.

Contract-related and pre-contractual requests are handled under Article 6(1)(b) GDPR. Article 6(1)(f) GDPR applies to other enquiries; our legitimate interest is reliable handling and documentation of support requests. Storage or access to your device requiring consent is subject to Section 25(1) TDDDG; storage strictly necessary for an explicitly requested chat function is subject to Section 25(2)(2) TDDDG. Support content is retained for as long as needed to handle requests, maintain necessary documentation, address existing claims or meet statutory obligations.

Intercom

Intercom is provided by the Intercom group, including Intercom R&D Unlimited Company, 124 St Stephen’s Green, Dublin 2, Ireland, and Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, USA. The service supports our team in handling messages, chat histories and their association with customers. Depending on the features used and contractual configuration, Intercom subprocessors and processing outside the European Economic Area may be involved. This notice does not guarantee exclusively European processing.

Intercom privacy information: https://www.intercom.com/legal/privacy

Intercom subprocessors and processing locations: https://www.intercom.com/legal/subprocessors-list

Chatbyte and AI-assisted support

Chatbyte is provided by Chatbyte GmbH, Hamburg, Germany. The service can use AI to answer and summarise support requests and hand them over to our team. Your messages and the context provided for the request are processed for this purpose. AI responses may contain errors; you can request assistance from our support team at support@funnelcockpit.com. Please do not submit passwords or unnecessary sensitive information.

Chatbyte describes processing of product-related customer data in EU regions and the use of providers including Microsoft Azure OpenAI in the EU for AI processing. According to the provider, customer data is not used to train general foundation models. The subprocessors involved depend on the modules enabled. See Chatbyte’s platform privacy policy and data processing agreement for further information on recipients, storage locations and erasure. AI-assisted support does not make solely automated decisions about you with legal or similarly significant effects.

Chatbyte platform privacy information: https://www.chatbyte.ai/de/plattform/datenschutz

Chatbyte data processing agreement and subprocessors: https://www.chatbyte.ai/de/plattform/auftragsverarbeitungsvertrag

Advertising and partner attribution with Digistore24

After your marketing consent, we store the Digistore24 attribution parameters supplied in a link—ds24tr (tracking key), aff (affiliate ID) and cam (campaign key)—in the cookies ds24tr, ds24aff and ds24cam for up to 30 days each. With analytics or marketing consent, the referrerUrl cookie may also store the external referring URL for up to 30 days. We retain only its origin and path; query strings and fragments are removed. Existing values from the previous Local Storage are migrated into these time-limited cookies only after the corresponding consent, and the old Local Storage entries are removed. The purpose is to attribute visits and orders to advertising and partner referrals. Processing is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

When you open a Digistore24 checkout link with marketing enabled, we add these attribution parameters and, where available, the sanitized referring URL as the custom parameter in that link. Digistore24 receives these data when its checkout is opened. Internal links and unrelated external links are not changed, and attribution alone loads no Digistore24 script or order form on our website. You can withdraw consent in the cookie settings. We then remove these attribution data from accessible browser storage and stop adding them to checkout links. Data already sent to Digistore24 are not automatically deleted retroactively; the checkout privacy information and data subject rights remain applicable.

Payment providers through Elopage and Digistore24

We use elopage and Digistore24 for payment processing and provision of our services. These are provided by elopay GmbH, Joachimsthaler Straße 21, 10719 Berlin (“elopage”) and Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim (“Digistore24”). Through them, we offer PayPal, credit card, instant bank transfer, direct debit and invoice payments.

Payment by credit card, instant bank transfer, direct debit and invoice

If you select invoice, credit card, instant bank transfer or direct debit as your payment method during checkout, your data is automatically transmitted to elopage or Digistore24.

We transmit the following data to elopage or Digistore24: First name, surname, company where applicable, address, email address, bank account details, credit card details and other data necessary for payment processing. The legal basis for processing your data for payment is Article 6(1)(b) GDPR.

When paying by instant bank transfer, you transmit your PIN and TAN. After technically checking your account balance and retrieving further information to verify sufficient funds, Elopage or Digistore24 transfers payment to us. We are then automatically notified of the financial transaction.

elopage or Digistore24 may also disclose personal data to affiliated companies, service providers or subcontractors where necessary to fulfill contractual obligations or where data is to be processed on their behalf.

Payment service provider PayPal

When you open an external ordering or payment process through our website, the relevant provider processes the data required for ordering, billing and payment under its own privacy notices. A link alone does not load that provider’s order form or tracking on the landing website. Please refer to the information in the relevant checkout process.

elopage and Digistore24 have engaged PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) to process our PayPal payments.

If you select PayPal as your payment method during checkout on our website, your data is automatically transmitted to PayPal. By selecting this payment option, you consent to the transmission of your personal data described below.

elopage and Digistore24 transmit your first name, surname, address, date of birth, gender, email address, IP address, telephone number, mobile number and other data necessary for payment processing to PayPal. Personal data connected with your order is also necessary for payment processing. Payment information may be exchanged, including bank details, card number, expiry date and CVC code, item quantity and number, product and service data, prices and taxes, previous purchasing behavior or other information about your financial circumstances. 

The data is transmitted to process payments. The legal basis for processing your data is accordingly Article 6(1)(b) GDPR.

The transmission also serves fraud prevention. Personal data is transmitted to PayPal particularly when you have consented. The legal basis following consent is Article 6(1)(a) GDPR. PayPal may transmit personal data exchanged between PayPal and us to credit reference agencies. This transmission serves identity and credit checks to prevent fraud.

PayPal also discloses personal data to affiliated companies (the PayPal group), service providers or subcontractors where necessary to fulfill contractual obligations or where data is to be processed on its behalf.

You may withdraw your consent to the handling of personal data with PayPal at any time. Withdrawal does not affect personal data that must be processed, used or transmitted for contractual payment processing. 

For further data protection information, including the credit reference agencies used, consult the privacy principles: https://www.paypal.com/de/webapps/mpp/ua/privacy-full of PayPal.

Data security

We protect our website and other systems against loss, destruction, access, alteration or distribution of your data by unauthorized persons through numerous technical and organizational measures. Despite regular checks, complete protection against all risks is impossible and cannot be guaranteed. You are therefore always free to transmit your personal data to us by other means, such as telephone or post.

Legal basis for processing personal data

Where we obtain your consent to processing personal data, Article 6(1)(a) GDPR provides the legal basis.

Where personal data must be processed to perform a contract to which you are a party, Article 6(1)(b) GDPR provides the legal basis. This also applies to processing necessary for precontractual measures.

Where processing personal data is necessary to fulfill a legal obligation to which our company is subject, Article 6(1)(c) GDPR provides the legal basis.

Where your vital interests or those of another natural person require processing personal data, Article 6(1)(d) GDPR provides the legal basis.

Where processing is necessary to safeguard our company's or a third party's legitimate interest and your interests, fundamental rights and freedoms do not override that interest, Article 6(1)(f) GDPR provides the legal basis.

Legitimate interests in processing

Where your personal data is processed under Article 6(1)(f) GDPR, our legitimate interest, unless otherwise stated, is conducting our business activities. We have otherwise specified our purposes and interests for each processing activity above.

Data deletion and retention period

Your personal data is deleted or blocked once the purpose of storage no longer applies or you withdraw consent. It may also be retained where European or national legislators provide for this in EU regulations, laws or other provisions to which the controller is subject. If the storage purpose no longer applies, you withdraw consent or a retention period prescribed by European or other competent legislators expires, personal data is routinely blocked or deleted in accordance with the law, unless further storage is necessary to conclude or perform a contract.

Right of access

You also have the right to obtain information about the personal data stored about you and a copy of it from us, free of charge, at any time. You are also entitled to information about:

  • the purposes of processing,
  • the categories of personal data being processed,
  • the recipients or categories of recipients to whom personal data has been or will be disclosed, particularly recipients in third countries or international organizations,
  • where possible, the intended retention period for the personal data or, if this is not possible, the criteria used to determine that period,
  • the existence of a right to rectification or erasure of personal data, restriction of processing by the controller or objection to that processing,
  • the right to lodge a complaint with a supervisory authority,
  • where personal data was not collected from the data subject: All available information about its source, and
  • the existence of automated decision-making, including profiling under Article 22(1) and (4) GDPR, and, at least in those cases, meaningful information about the logic involved and the significance and intended consequences of that processing for the data subject.

You are also entitled to information about whether personal data has been transferred to a third country or international organization. If so, you are entitled to information about the appropriate safeguards associated with the transfer.

Right to rectification

You have the right to request prompt rectification and/or completion of inaccurate or incomplete personal data concerning you. We must rectify it without delay.

Right to restriction of processing

You have the right to request restriction of processing if one of the following conditions applies:

  • The data subject contests the accuracy of personal data, for a period enabling the controller to verify its accuracy.
  • Processing is unlawful, and the data subject opposes erasure and requests restriction of use instead.
  • The controller no longer needs the personal data for processing purposes, but the data subject requires it to establish, exercise or defend legal claims.
  • The data subject has objected to processing under Article 21(1) GDPR, and it has not yet been determined whether the controller's legitimate grounds override those of the data subject.

Where processing of your personal data has been restricted, that data may, apart from storage, be processed only with your consent, to establish, exercise or defend legal claims, to protect another natural or legal person's rights, or for reasons of important public interest of the Union or a Member State.

Where processing has been restricted under the conditions above, we will inform you before the restriction is lifted.

Right to erasure

You have the right to request that personal data concerning you be erased without delay if one of the following reasons applies and processing is not necessary:

  • The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
  • The data subject withdraws consent on which processing under Article 6(1)(a) or Article 9(2)(a) GDPR was based, and no other legal basis exists.
  • The data subject objects under Article 21(1) GDPR and no overriding legitimate grounds for processing exist, or objects under Article 21(2) GDPR.
  • The personal data was unlawfully processed.
  • Erasure is necessary to fulfill a legal obligation under Union or Member State law to which the controller is subject.
  • The personal data was collected in relation to information society services offered under Article 8(1) GDPR.

Where we have made personal data public and must erase it under Article 17(1) GDPR, we take reasonable measures, including technical measures, considering available technology and implementation costs, to inform other controllers processing the published data that the data subject has requested erasure of all links to that data or copies or replications of it, insofar as processing is not necessary.

The right to erasure does not apply where processing is necessary:

  • to exercise the right to freedom of expression and information;
  • to fulfill a legal obligation requiring processing under Union or Member State law to which the controller is subject, or to perform a task in the public interest or exercise official authority vested in the controller;
  • for reasons of public interest in public health under Article 9(2)(h) and (i) and Article 9(3) GDPR;
  • for archiving in the public interest, scientific or historical research, or statistical purposes under Article 89(1) GDPR, insofar as the right described in section a) is likely to make achieving those purposes impossible or seriously impair them; or
  • to establish, exercise or defend legal claims.

Right to notification

If you have exercised your right to rectification, erasure or restriction of processing with us, we must inform every recipient to whom your personal data was disclosed of that rectification, erasure or restriction, unless this is impossible or involves disproportionate effort.

You have the right to be informed about those recipients by us.

Right to data portability

You have the right to receive personal data concerning you that you provided to us in a structured, commonly used, machine-readable format. You also have the right to transmit it to another controller without hindrance from us where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or a contract under Article 6(1)(b) GDPR and carried out by automated means, provided it is not necessary for a task in the public interest or exercise of official authority vested in us.

When exercising your data portability right under Article 20(1) GDPR, you also have the right to have personal data transmitted directly from us to another controller where technically feasible and where this does not adversely affect others' rights and freedoms.

The right to data portability does not apply to processing necessary for a task in the public interest or exercise of official authority vested in the controller.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing personal data concerning you based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

Following an objection, we no longer process the personal data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.

Where we process your personal data for direct marketing, you may object at any time to processing for that purpose. This also applies to profiling insofar as it relates to direct marketing. If you object to direct marketing processing, we will no longer process your personal data for those purposes.

You also have the right to object, on grounds relating to your particular situation, to our processing your personal data for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless processing is necessary for a task in the public interest.

You may contact us at any time to exercise your right to object. When using information society services, notwithstanding Directive 2002/58/EC, you may also exercise that right through automated means using technical specifications.

Right to withdraw data protection consent

You have the right to withdraw your consent to processing personal data at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Right concerning individual automated decisions, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, provided the decision

  • is not necessary to conclude or perform a contract between you and us, or
  • is permitted by Union or Member State law to which we are subject, and that law contains appropriate measures to safeguard your rights, freedoms and legitimate interests, or
  • is made with your explicit consent.

If the decision

  • is necessary to conclude or perform a contract between you and us, or
  • is made with your explicit consent,

we implement appropriate measures to safeguard your rights, freedoms and legitimate interests, including at least the right to human intervention on our part, to express your point of view and to contest the decision.

Existence of automated decision-making

We do not make solely automated decisions about you that have legal or similarly significant effects within the meaning of Article 22 GDPR. Possible processing for advertising purposes is described in the Google Ads section.

Right to lodge a complaint with a supervisory authority

Without prejudice to other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, workplace or the alleged infringement, if you believe processing of your personal data breaches the GDPR.

The supervisory authority receiving the complaint informs the complainant of its progress and outcome, including the possibility of a judicial remedy under Article 78 GDPR.