Privacy policy

Last updated: 23 October 2026

In this privacy policy, Tolingo GmbH ("we" or "us") informs you about how we process your personal data ("data") when you visit our website https://www.beglaubigte-uebersetzung.eu and use our services. Embassy Translations is a brand of Tolingo GmbH.

This policy also explains the rights you have. We take the protection of your personal data and your privacy very seriously and comply with the applicable data protection laws, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

If any of the terms used in this policy are unclear, our explanations under "Glossary of data protection terms" may help. You are also welcome to contact us informally with any questions about data protection using the contact details below.

This English version is provided for your convenience. The German version (Datenschutzerklärung) is legally binding.

Controller and data protection officer

Controller
Tolingo GmbH
Kühnehöfe 3
22761 Hamburg
Germany
Managing Director: Jens Völkel
Phone: 0800 55 133 07
Email: info@beglaubigte-uebersetzung.eu

Data protection officer of Tolingo GmbH
Herting Oberbeck Datenschutz GmbH
Hallerstr. 76
20146 Hamburg
Germany
Email: datenschutzbeauftragter@tolingo.com

Questions about data protection
An informal message to datenschutz@tolingo.com is enough to exercise your rights.

1. Withdrawal of consent and right to object

Withdrawal of your consent to data processing and right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

Many data processing operations are only possible with your express consent or on the basis of a legitimate interest under Art. 6(1)(f) GDPR. You can withdraw any consent you have given at any time. An informal email to datenschutz@tolingo.com is sufficient. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

Where data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on these provisions. The legal basis for each processing operation is stated in this privacy policy. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (objection under Art. 21(2) GDPR).

To exercise your right to object, simply send an email to datenschutz@tolingo.com.

2. Data processing when you visit our website

We process personal data when you visit this website. In principle, you can visit our website without providing any personal data. Our website is designed to collect as little data from you as necessary. Data is collected for the purposes and to the extent described below. We only pass your data on to third parties as described below.

3. Collection and processing of personal data

Providing our website

When you visit our website, we automatically collect and process data in order to provide the website. This includes:

the date and time of your visit
the address of the website from which you came to us
the pages you visit on our website
information about your web browser (browser type and version)
the operating system of the device you use to access our website and services
your internet service provider
the IP address of your device

This data is processed for the following purposes:

ensuring a smooth connection to the website
ensuring convenient use of our website
evaluating system security
other administrative purposes

The legal basis for processing your data to provide our website and services is Art. 6(1)(f) GDPR.

Our legitimate interest follows from the purposes listed above: to offer you our website and the services provided through it in a technically flawless, secure way that is optimised for your needs. Server log file data is stored separately from other data.

Hosting

This website runs on HubSpot's content management system and is served from HubSpot's servers. The provider is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland. The data is stored in a data centre in the EU. HubSpot processes the data solely on our behalf under a data processing agreement. A transfer to the parent company HubSpot, Inc. in the USA cannot be ruled out; HubSpot, Inc. is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website reliably and securely.

Contact and quote requests

We provide forms on our website for contacting us and requesting quotes. The forms are provided via HubSpot, and the information you enter is stored in our HubSpot system. We use this information to handle your request. We only collect and process your personal data if you provide it voluntarily and knowingly. This includes:

first and last name
email address
phone number
your message
uploaded files, for example the documents to be translated

The legal basis for processing your data for the purpose of contacting us is Art. 6(1)(a) GDPR, based on the consent you have given voluntarily. The personal data we collect through the contact form is deleted once your request has been dealt with, unless it is needed for an order.

Email communication

We run our email accounts on Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes emails solely on our behalf under a data processing agreement. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. We also handle emails sent to info@beglaubigte-uebersetzung.eu in our HubSpot inbox.

The legal basis is Art. 6(1)(b) GDPR where your message concerns a quote or an order, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in replying to your message.

Quotes and orders

To process quotes and orders, we collect and process the following data, which is required to conclude and properly perform the contract. We only collect and process your personal data if you provide it voluntarily and knowingly. This includes:

first and last name
company name and tax number, where applicable
billing address: street, postcode, town, country
delivery address if the translation is sent by post
phone number
email address
communication history
previous requests and orders

The legal basis for processing your data for the purpose of placing an order is Art. 6(1)(a) GDPR, based on the consent you have given voluntarily, and Art. 6(1)(b) GDPR for the performance of the contract. The personal data we collect is stored until the statutory retention period expires and is then deleted, unless we are obliged under Art. 6(1)(c) GDPR to store it for longer due to retention and documentation obligations under tax and commercial law (HGB, StGB or AO), or you have consented to longer storage under Art. 6(1)(a) GDPR.

Translation

The client sends us files to be translated, which we store and make available to the translator for processing. Unless otherwise agreed, we also use freelance service providers for this, which may include service providers outside the EU. After the order has been completed, source and target files are stored within the statutory retention periods.

The legal basis for processing the documents you send us for translation is Art. 6(1)(b) GDPR.

Payment information

You pay by bank transfer on invoice. No data is passed on to third-party providers.

4. Use of cookies

We use cookies on our website. We use technically necessary cookies, for example to store your cookie settings, on the basis of Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR. We only use all other cookies, in particular HubSpot's analytics cookies, with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you give via our cookie banner. You can change or withdraw your choice at any time using the "Cookie settings" link at the bottom of every page.

You can also disable cookies in your browser settings. Without cookies, however, some functions of our website may only work to a limited extent or not as usual.

5. Tracking and analytics services

Matomo (web analytics)

We use the open-source web analytics software Matomo on this website. It shows us how our website is used, how visitors find us (for example via search engines, ads or links on other websites) and which of these lead to requests or orders. This helps us improve our services and our advertising.

We run Matomo ourselves on our own server at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data centre in the EU. IONOS processes the data solely on our behalf under a data processing agreement. The data is not passed on to third parties or transferred to countries outside the EU.

Matomo does not set any cookies for analytics and does not read any information from your device. The following is processed:

your IP address, which is shortened before it is stored (e.g. 192.168.xxx.xxx)
the pages visited and the date and time of the visit
the website from which you came to us (without URL parameters) and campaign identifiers in links
browser, operating system, device type and language setting
your approximate location (country, region, city), derived from your IP address
whether you submitted a contact form or clicked a phone or email link, and whether you are making the request as a company or as a private individual, but not what you entered (for example, neither your name nor the name of your company)

To assign several page views to one visit, Matomo creates a checksum from your IP address, browser identifier, language setting and a random value that changes daily. The full IP address is only used briefly and is not stored. Recognition is possible for 24 hours at most; no profile across several days is created.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical analysis of the use of our website, measuring the success of our advertising and improving our services.

We automatically delete data on individual visits after 13 months. We keep aggregated statistics without personal reference for longer.

You can object to tracking by Matomo at any time. If you activate the objection below, we store a cookie (matomo_optout) in your browser that remembers your objection; it serves this purpose only. If you delete your cookies or use a different browser, you will need to activate the objection again.

Opt out of Matomo

Your visits are recorded in anonymised form with Matomo.

HubSpot (analytics)

With your consent, we use HubSpot's analytics functions on this website (for the provider, see "Hosting").

This involves tracking pixels and cookies that are stored on your computer and allow us to analyse how you use the website. HubSpot evaluates the information collected (e.g. IP address, geographical location, browser type, duration of the visit and pages viewed) on our behalf to generate reports on visits and the pages visited.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time using the "Cookie settings" link at the bottom of every page.

You can find more information about how HubSpot works in HubSpot's privacy policy: https://legal.hubspot.com/privacy-policy

6. Your rights

Right of access (Art. 15 GDPR)
Under Art. 15 GDPR, you have the right to obtain information from us as to whether and which data we process about you. This includes, among other things, how long and for what purpose we process the data, where it comes from and to which recipients or categories of recipients we pass it on. You can also obtain a copy of this data from us.

Right to rectification (Art. 16 GDPR)
Under Art. 16 GDPR, you have the right to have inaccurate or outdated information about you corrected without delay. You can also request that incomplete personal data be completed. Where required by law, we will also inform third parties of this correction if we have passed your data on to them.

Right to erasure ("right to be forgotten", Art. 17 GDPR)
Under Art. 17 GDPR, you have the right to request that we erase your personal data without delay if one of the grounds listed in Art. 17 GDPR applies.

Right to restriction of processing (Art. 18 GDPR)
Under Art. 18 GDPR, you have the right to request that we restrict the processing of your personal data if one of the conditions listed in Art. 18 GDPR is met.

Right to withdraw consent (Art. 7(3) GDPR)
Under Art. 7(3) GDPR, you can withdraw any consent you have given us at any time with effect for the future. You can do so by sending an informal message to the contact addresses above.

Right to data portability (Art. 20 GDPR)
Under Art. 20 GDPR, you have the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to others. Details and restrictions can be found in Art. 20 GDPR. Exercising this right does not affect your right to erasure.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Under Art. 77 GDPR, you have the right to lodge a complaint with a competent supervisory authority, or with the supervisory authority in the member state of your habitual residence, your place of work or the place of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR.

Right to object (Art. 21 GDPR)
Under Art. 21 GDPR, you have the right to object to the processing of your personal data at any time. If the conditions for a valid objection are met, we will no longer process your personal data.

How to exercise your rights
To exercise your rights, please contact us (informally if you wish) at:
Email: datenschutz@tolingo.com

7. Glossary of data protection terms

This privacy policy uses some terms that are also used by legislators, in particular in the EU General Data Protection Regulation (GDPR). Because we want this privacy policy to be easy to understand, we explain some important terms below:

Processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of a controller.
Data subject: Any identified or identifiable natural person whose personal data is processed by the controller.
Browser: A program for displaying websites on the internet.
Cookies: Cookies are small files that are stored on your device and that store certain settings and data for exchange with your browser, unless you prevent this through technical settings. Cookies allow the websites and servers you visit to distinguish your browser from other browsers. A particular browser can therefore be recognised and identified by its unique cookie ID. Where possible, we use cookies that are deleted when you close your browser (session cookies). We also use cookies that are stored on your computer for longer (persistent cookies). In addition to configuring your browser not to accept cookies, you can delete cookies that have already been set at any time using your browser or other programs. Please note, however, that not using cookies may mean that not all functions of our website or services can be used in full.
Third party: A natural or legal person, public authority, agency or other body that is authorised to process the personal data.
Consent: Any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
Recipient: A natural or legal person, public authority, agency or other body to which personal data is disclosed, whether a third party or not.
IP address: An address assigned to your device (e.g. smartphone or computer) on the internet so that your device can be addressed and reached there.
Personal data: Any information relating to an identified or identifiable natural person (also called "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Pseudonymisation: The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information. This is particularly the case where such additional information is kept separately and is subject to technical and organisational measures ensuring that the data cannot be attributed to an identified or identifiable natural person with reasonable effort.
Processing: Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller: The natural or legal persons, public authorities, agencies or other bodies which, alone or jointly with others, determine the purposes and means of the processing of personal data.

8. Security

Your personal data is transmitted to us in encrypted form. We use the SSL/TLS encryption system (Secure Sockets Layer/Transport Layer Security) for this.

We use technical and organisational security measures to protect your personal data against misuse, loss, destruction or access by unauthorised persons. Our security measures reflect the current state of the art and are continuously improved in line with technological developments.

9. Validity and changes to this privacy policy

This privacy policy is currently valid. Further development of our website, the implementation of new technologies or changes in legal or regulatory requirements may make it necessary to amend this privacy policy. We therefore reserve the right to make such changes at any time.

Last updated: 23 October 2026. Responsible: Tolingo GmbH, Hamburg