Privacy Policy

1. Data Controller and Contact Information

The data controller within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act is:

torq.partners Finance GmbH

20 Saarbrücker Street

10405 Berlin, Germany

Email: privacy@torq.partners

External Data Protection Officer

We have appointed the following individual as our external data protection officer:

Ralf Fischer, Assistant Jurist

Legal Counsel

ClixOn Datenschutz UG

Email: datenschutz@torq.partners

2. General Information on Data Processing

As a general rule, we process our users’ personal data only to the extent necessary to provide a fully functional website, as well as our content and services, or if you have given your consent. The legal bases are, in particular, Article 6(1)(a) of the GDPR (consent), (b) (contract/precontractual measures), (c) (legal obligation), and (f) (legitimate interest).

Personal data will be deleted as soon as the purpose of the processing no longer applies and there are no legal retention requirements that prevent this (see Section 16).

3. Website Hosting and Server Log Files

Every time our website is accessed, our system automatically processes data from the requesting device (server log files): IP address, date and time of the request, time zone, the specific page or file accessed, the HTTP status code, the amount of data transferred, the referrer URL, and information about the browser, operating system, and language settings.

The purpose is to ensure the technically error-free operation of the website and to guarantee system security and stability. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in secure and functional operation). The server log files are deleted after 30 days at the latest.

Hosting (Webflow)

Our website is hosted using the Webflow service (Webflow, Inc., U.S.). In doing so, Webflow processes the technically necessary access data on our behalf. The legal basis for this is Article 6(1)(f) of the GDPR. For information on data transfers to the U.S., see Section 15.

4. Cookies and Consent

Our website uses cookies and similar technologies (e.g., local storage). We use technically necessary cookies in accordance with Section 25(2) of the TDDDG and Article 6(1)(f) of the GDPR. We use all other cookies and services—in particular those for statistics and marketing—exclusively with your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

We obtain your consent through the consent management tool “Cookiebot” (provider: Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark). Services that require consent will not be loaded until you have given your consent. You can revoke or modify your consent at any time with future effect via the cookie dialog on our website; revoking your consent is just as easy as giving it.

You can find an up-to-date overview of the cookies used—including the provider, purpose, and retention period—in the cookie dialog (cookie policy).

5. Reach Measurement and Analysis

Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The service is integrated via Google Tag Manager, in some cases using server-side tagging. Google Analytics processes, among other things, device and browser data, page views, interactions, and a pseudonymous identifier (cookies _ga, _ga_PQL77F9EMC). The purpose is to conduct a pseudonymous analysis of user behavior in order to optimize our website.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). According to Google, IP addresses are not permanently logged in Google Analytics 4; however, IP data may be processed (e.g., for approximate geolocation). Data may be transferred to the United States (see Section 15). Cookie retention period: up to 2 years.

HubSpot (Analytics)

We use HubSpot (HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA) to analyze usage behavior. HubSpot processes usage data and sets cookies (including __hstc, hubspotutk, __hssc, and __hssrc). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For information on the use of HubSpot for forms, downloads, and newsletters, see Sections 9–11.

6. Marketing and Advertising

Google Ads (Conversion Tracking)

We use Google Ads to measure the success of our online advertising (Google Ireland Limited). In doing so, a cookie may be set to track conversions (_gcl_au, valid for approximately 3 months). The legal basis for this is your consent (Art. 6(1)(a) of the GDPR). For information on data transfers to the U.S., see Section 15.

LinkedIn Insight Tag / LinkedIn Ads

We use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; parent company LinkedIn Corporation, USA) for conversion tracking, retargeting, and reach analysis. This involves setting cookies (including bcookie, li_gc, lidc) and transmitting data to LinkedIn. The legal basis is your consent (Art. 6(1)(a) GDPR). For information on data transfers to the U.S., see Section 15.

Apollo (Visitor Recognition)

We use the Apollo service (Apollo.io / Apollo Data Cloud, Inc., USA) to recognize and analyze visitors to our website. The purpose is to identify potentially interested companies and contacts for our sales and marketing activities (lead generation). In doing so, usage and device data, as well as an identifier (including apolloAnonId; domains aplo-evnt.com, assets.apollo.io), are processed.

The legal basis is your consent (Art. 6(1)(a) of the GDPR, § 25(1) of the TDDDG). You may withdraw this consent at any time via the cookie dialog.

7. Embedded Content (YouTube via Embedly)

We embed YouTube videos on certain pages (e.g., the Careers page). The videos are embedded using the Embedly service (Embedly, Inc., USA); the videos are provided by Google Ireland Limited (YouTube). The video is not loaded until you have given your marketing consent. During loading, cookies may be set and data (including IP address, device information, and interactions) may be transmitted to Embedly or Google. The legal basis is your consent (Art. 6(1)(a) GDPR). For information on data transfers to the U.S., see Section 15.

8. Functional Services

Cloudflare (Security and Delivery)

We use Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) as a content delivery network and to protect against attacks and bots, including via Cloudflare Turnstile. This involves setting technically necessary cookies (__cf_bm, _cfuvid). The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in secure, uninterrupted operation). For information on data transfers to the United States, see Section 15.

Weglot (Website Translation)

We use Weglot (Weglot SAS, 138 rue d’Aboukir, 75002 Paris, France) to provide our website in multiple languages. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in multilingualism) or your consent, to the extent that cookies are set. Data processing takes place within the EU.

9. Contacting Us and the Contact Form

When you contact us (by email or through the contact form), we process the information you provide to handle your inquiry and for any follow-up questions. The contact form is hosted on Webflow and protected against spam by Cloudflare Turnstile; the Inputflow service may be used to process form submissions.

The legal basis for contract-related inquiries is Article 6(1)(b) of the GDPR (implementation of pre-contractual measures); for all other inquiries—such as general inquiries or inquiries from a company’s contacts—it is Article 6(1)(f) of the GDPR (legitimate interest in responding to and documenting the inquiry). Your data will be deleted as soon as the inquiry has been fully processed, provided that no statutory retention requirements prevent this.

To process your request, we engage the aforementioned service providers as data processors; any further disclosure of your data will occur only to the extent necessary for the performance of the contract or as required by law.

10. Newsletters and Marketing Emails

When you subscribe to our newsletter, we use the email address you provide—and, if applicable, other information—to send you information about our services, financial topics, and events. The newsletter is sent via HubSpot. Registration is done using the double opt-in process; we log your registration and confirmation for record-keeping purposes. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time by clicking the unsubscribe link or by sending us a message. We analyze open and click-through rates to measure the newsletter’s effectiveness.

11. Downloads and Other Forms

We use embedded HubSpot forms to provide access to certain content (e.g., downloads, white papers, templates). We process the data entered in these forms to provide the requested content and—to the extent you have given your consent—for marketing purposes. The legal basis is Article 6(1)(b) of the GDPR (provision of content) or Article 6(1)(a) of the GDPR (consent, to the extent that the data is used for marketing purposes).

12. Customer Satisfaction Survey (NPS)

As part of satisfaction surveys (Net Promoter Score), we process your rating, any free-text comments, and technical details such as a response ID, a project ID, and a timestamp. This data is transmitted via a webhook to the automation service Make (Make.com) and processed there. The purpose is to evaluate and improve our services. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in quality assurance) or your consent, if provided.

13. Applications

We use the HiBob platform (job application portal) for job applications. The data processed in connection with your application will be used exclusively for the purposes of the application process. The separate privacy policy for job applicants, which is provided to you during the application process, applies. The legal basis is Section 26 of the German Federal Data Protection Act (BDSG) or Article 6(1)(b) of the General Data Protection Regulation (GDPR).

14. Business Partner Data

We process data from business partners for the purpose of establishing and fulfilling contractual relationships. The legal basis for natural persons is Article 6(1)(b) and (c) of the GDPR; for contacts at legal entities, it is Article 6(1)(f) of the GDPR (legitimate interest in communication). Recipients may include service providers, banks and payment service providers, tax advisors, attorneys, courts, and government agencies, to the extent that this is necessary or required by law.

15. Data Transfers to Third Countries

To the extent that we transfer personal data to recipients in the United States or other countries outside the EU/EEA, we do so either on the basis of an adequacy decision by the European Commission—in particular, the EU-U.S. Data Privacy Framework for providers certified under that framework—or on the basis of the European Commission’s Standard Contractual Clauses (Art. 46 of the GDPR) together with supplementary safeguards. A list of certified companies is available at dataprivacyframework.gov.

To the best of our knowledge, Google, HubSpot, LinkedIn, and Cloudflare are certified under the EU-U.S. Data Privacy Framework. For providers that are not certified, we base the transfer on the European Commission’s Standard Contractual Clauses, along with supplementary safeguards. The United States does not have a level of data protection fully comparable to that under EU law; in particular, government agencies may access data under certain conditions.

16. Retention Periods and Deletion Deadlines

We store personal data only for as long as is necessary for the respective purposes. Afterward, the data is deleted unless there are statutory retention requirements. Depending on the type of document, the retention periods under commercial and tax law are generally as follows:

  • 10 years for business records, inventories, financial statements, and similar documents (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)),
  • 8 years for accounting records (reduced from 10 to 8 years starting in 2025),
  • 6 years for business correspondence received and sent.

The time limits begin at the end of the calendar year in which the relevant document was created or the last entry was made—not necessarily at the end of the contract.

17. Your Rights

In accordance with the applicable legal requirements, you have the right to:

  • Information about the personal data we process (Art. 15 of the GDPR),
  • Rectification of inaccurate or incomplete data (Art. 16 of the GDPR),
  • Erasure (Art. 17 of the GDPR) and restriction of processing (Art. 18 of the GDPR),
  • Data portability, provided that the processing is automated and based on consent or a contract (Art. 20 GDPR),
  • Objection to processing based on legitimate interests and to direct marketing (Art. 21 GDPR),
  • Withdrawal of consent that has already been given, effective for the future (Art. 7(3) of the GDPR).

You also have the right to file a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin (www.datenschutz-berlin.de).

18. Automated Decision-Making

Automated decision-making, including profiling as defined in Article 22 of the GDPR, does not take place.

19. Validity and Amendments to This Statement

We will update this Privacy Policy as soon as there are changes to our data processing practices. The version currently published on this website is the one that applies.

As of August 2026.

‍