Effective: May 2026
This Privacy Policy applies to the ALMARA Partner Platform at partner.almara.life (the “Partner Platform”) and informs you about the processing of personal data in connection with the initiation, establishment and execution of a partnership with ALMARA.
The processing of personal data of end customers on the B2C platform almara.life is subject to a separate B2C Privacy Policy.
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Ubu Beteiligungs GmbH
Zehlendorfer Damm 75A
14532 Kleinmachnow
Germany
Email: office@ubu-beteiligung.de
Further information on the controller can be found in our Legal Notice.
For questions regarding the collection, processing or use of your personal data, for information requests, rectification, restriction or erasure of data, as well as for the withdrawal of any consent granted, please contact:
Email: dataprotection@ubu-beteiligung.de
A Data Protection Officer has not been appointed, as the legal requirements for such appointment are not met.
We process personal data on the following legal bases:
In the context of the Partner Platform, we process the following categories of personal data:
Personal data is deleted or restricted as soon as the purpose of storage no longer applies. Longer storage may be required to fulfil commercial and tax retention obligations (up to ten years under Sections 147 AO, 257 HGB) or to fulfil DAC7 reporting obligations.
The Partner Platform is hosted on servers of STRATO AG, Pascalstraße 10, 10587 Berlin, Germany. The servers are located in Germany. When you access the Partner Platform, STRATO collects data automatically transmitted by your browser (server log files), in particular IP address, date and time of access, transferred data volume, page accessed and browser information.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and secure presentation of the Partner Platform. We have concluded a data processing agreement with STRATO pursuant to Article 28 GDPR.
The Partner Platform uses cookies and similar technologies only to the extent necessary for operation and use (in particular session cookies for login, security cookies, language settings). These are set without consent on the basis of Section 25(2) No. 2 TDDDG.
To the extent that further cookies or third-party services are used (e.g. for reach measurement of publicly accessible acquisition pages), these are set exclusively with your express consent (Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR) via our consent manager Borlabs Cookie, a service provided by Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany. Details can be found in our Cookie Policy for the Partner Platform.
On the publicly accessible areas of the Partner Platform (in particular acquisition and information pages), with your express consent, we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (the “LinkedIn”). Through the Insight Tag, data is transmitted for reach measurement, conversion tracking and the targeting of advertising campaigns on LinkedIn to its affiliate LinkedIn Corporation, USA.
When you access a page on which the Insight Tag is embedded, the following data is in particular processed: truncated IP address, timestamp of the page view, browser and device information, referrer URL, and – if you are logged in to LinkedIn or a LinkedIn cookie is set on your device – your LinkedIn member ID.
When using the LinkedIn Insight Tag, ALMARA and LinkedIn act as joint controllers within the meaning of Article 26 GDPR for the collection and transmission of your personal data to LinkedIn. The essential cornerstones of our agreement with LinkedIn are:
LinkedIn’s joint controller agreement is available at legal.linkedin.com/pages-joint-controller-addendum.
LinkedIn transfers data to LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. LinkedIn Corporation is certified under the EU-US Data Privacy Framework; data transfer to the USA takes place on the basis of the adequacy decision of the European Commission of 10 July 2023.
The legal basis for setting the tag is Section 25(1) TDDDG; the legal basis for the subsequent processing is Article 6(1)(a) GDPR (consent). You can withdraw your consent at any time via our consent manager Borlabs Cookie with effect for the future.
Further information on LinkedIn’s data processing can be found in the LinkedIn Privacy Policy.
When you register as a partner, we collect the company and contact data necessary to verify your suitability and to initiate the partner contract (see section 2.2). Input takes place via a form on the Partner Platform.
The legal basis is Article 6(1)(b) GDPR (pre-contractual measures). If the data is not required to process your request, it is deleted after completion of the process; data relevant to contract initiation is retained for the duration of a possible later contract initiation.
The data collected during onboarding may be transferred to our CRM system for further processing. We use or evaluate the following providers (the live status is maintained in the current version of this Privacy Policy):
A data processing agreement pursuant to Article 28 GDPR is concluded with the respective provider. The legal basis is Article 6(1)(b) GDPR (contract initiation) and Article 6(1)(f) GDPR (legitimate interest in efficient sales pipeline management).
As part of profile verification, you upload documents to evidence your business activity, in particular:
These documents are stored exclusively for the purpose of profile verification and for the fulfilment of our legal due diligence obligations. The data is stored for the duration of the partnership as well as for statutory retention periods.
Insofar as we are obliged under the German Anti-Money Laundering Act (GwG) or comparable foreign provisions to identify the contractual partner or its beneficial owners, we collect and process the necessary data (in particular name, date of birth, address, nationality, identity document data of legal representatives and beneficial owners as required).
The legal basis is Article 6(1)(c) GDPR. The data is deleted after the statutory retention period (generally five years after termination of the business relationship pursuant to Section 8(4) GwG).
After successful profile verification, a partner account is created. To log in to the partner account, you use a self-selected email address and password. When using the partner account, technical data is processed (login times, IP address, browser, actions performed).
The legal basis is Article 6(1)(b) GDPR (contract performance) and Article 6(1)(f) GDPR (legitimate interest in security and functionality of the platform).
We take appropriate technical and organisational measures to protect partner accounts, in particular password hashing, encrypted transmission (TLS), login logging and, where applicable, two-factor authentication. You are obliged to treat your access data confidentially and not to share it with third parties.
In the context of brokering bookings, we transfer end-customer data (in particular name, booking code, date, number of participants, contact data where applicable) to you as a partner. This processing takes place under joint controllership pursuant to Article 26 GDPR.
The essential content of the joint controllership agreement concluded between ALMARA and the partner is set out in a separate annex to the partner contract; it can be made available on request. The essential cornerstones are:
The partner undertakes to process the transferred end-customer data exclusively for the provision of the booked experience and to fulfil legal obligations. Use beyond this (in particular for own marketing purposes) is only permitted with the express consent of the end customer.
For payment processing between end customers, ALMARA and partners, we use Stripe Connect Express. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. In this arrangement:
In relation to the platform function, Stripe is a processor for ALMARA. In relation to the account relationship with the partner (identification, KYC, payout), Stripe is an independent controller.
Stripe Payments Europe, Ltd. is based in the EU; data transfer to third countries may occur as part of intra-group processing (in particular to Stripe Inc., USA). Stripe Inc. is certified under the EU-US Data Privacy Framework.
The legal basis is Article 6(1)(b) GDPR (contract performance) and Article 6(1)(c) GDPR (legal obligations).
Further information: https://stripe.com/privacy; information on Stripe Connect: https://stripe.com/connect/legal
As a reporting platform operator within the meaning of EU Directive 2021/514 (DAC7), implemented in Germany by the Platform Tax Transparency Act (PStTG), we are obliged to transmit certain information about the providers active on our platform and the remuneration they receive annually to the Federal Central Tax Office (BZSt).
The reported data includes in particular:
The legal basis is Article 6(1)(c) GDPR in conjunction with the PStTG. If the data required for reporting is not made available to us, we are entitled, after two reminders but no earlier than 60 days after the first request, to close the partner account or to withhold payouts until the data is provided.
We send a partner newsletter at regular intervals with information on platform developments, new functions, training offers and relevant market updates. Registration takes place via the double opt-in procedure.
For dispatch, we use Mailchimp, a service provided by Intuit Inc., 2700 Coast Avenue, Mountain View, California 94043, USA. Mailchimp is certified under the EU-US Data Privacy Framework. We have concluded a data processing agreement with Mailchimp pursuant to Article 28 GDPR.
The legal basis is Article 6(1)(a) GDPR (consent). You can unsubscribe from the newsletter at any time.
Further information: https://mailchimp.com/legal/privacy/
Independently of the newsletter, we send you transactional emails necessary for the execution of the partnership (in particular booking notifications, settlements, contract changes, security notices). It is not possible to opt out of this communication as long as the partnership exists. The legal basis is Article 6(1)(b) GDPR.
An external appointment booking tool may be used to arrange demo appointments. When used, the data you enter (name, email, desired appointment) is transmitted to the respective provider:
The specific provider used is indicated on the demo booking page. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures) and Article 6(1)(a) GDPR (consent, where required).
For webinars, onboarding training and product trainings, we may use external webinar platforms, in particular WebinarGeek (WebinarGeek B.V., Netherlands) or WebinarKit (WebinarKit LLC, USA). When registering for webinars, your registration data (name, email) is transmitted to the respective provider.
The legal basis is Article 6(1)(b) GDPR (training as part of partnership execution) and Article 6(1)(a) GDPR. For US providers, third-country transfer takes place on the basis of the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
For communication with partner prospects and existing partners, we use, analogous to the B2C platform, the services Tidio (Tidio LLC, USA, DPF certified) and/or Superchat (Superchat GmbH, Berlin, Germany). The function and data processing essentially correspond to that described in the B2C Privacy Policy.
The legal basis is Article 6(1)(a) GDPR (consent) and Article 6(1)(b) GDPR (contract initiation and performance).
To the extent that personal data is transferred in the context of the above processing to third countries outside the European Economic Area (in particular to the USA), this takes place on one of the following legal bases:
Upon request, we will provide you with further information on the safeguards taken.
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
(State Commissioner for Data Protection and the Right of Access to Files, Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany
Phone: +49 33203 356-0
Email: poststelle@lda.brandenburg.de
Web: www.lda.brandenburg.de
This Privacy Policy is currently valid and has the status of May 2026. Due to the further development of the Partner Platform and our services, or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. The current Privacy Policy can be accessed and printed at any time on the Partner Platform at /en/partner-privacy-policy.
