Privacy Policy

This privacy policy explains how personal data is processed when you use the "The Phish Menu" platform (the "Platform"). Last updated: July 2026. The German version of this policy prevails in case of any discrepancy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

jaeger + haeckerhase gmbh
Pinienstraße 2, 40233 Düsseldorf, Germany
Managing Directors: Markus Jäger, Denis Häcker, Michael Hasselbusch
Düsseldorf Local Court, HRB 66211 · VAT ID DE278970438
Phone: +49 211 828075-0 · Email: info@jaeger-haeckerhase.de

For any data-protection questions, please contact us at the address above or by email at datenschutz@thephishmenu.de.

2. Roles: controller and processor

We process personal data in two distinct roles:

As a controller for the data of the organizations that book the Platform (customer administrators, contract and billing data) and for operating the website.
As a processor for the personal data of the employees whom a customer organization invites to the training. In that respect the customer organization is the controller; processing is carried out under a data processing agreement (DPA) pursuant to Art. 28 GDPR.

3. Data processed and purposes

3.1 Account and access data

When you register and sign in, we process your name, email address, a password (stored only in encrypted form), your organization membership and your chosen function role. Administrator accounts are additionally secured with two-factor authentication. Purpose: providing, securing and administering the user account. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (account security).

3.2 Training and progress data

During the training we process your learning progress, completed modules, results of interactive exercises and completion/certificate data. Purpose: delivering and evidencing the security-awareness training. Legal basis: Art. 6(1)(b) GDPR in relation to the organization, or processing on behalf under Art. 28 GDPR.

3.3 Server log data

When the Platform is accessed, technically necessary data (e.g. IP address, date/time, resource requested) is processed to ensure operation, stability and security. Legal basis: Art. 6(1)(f) GDPR.

4. Hosting

The Platform is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data center in Germany (Nuremberg). A data processing agreement is in place with Hetzner. Legal basis: Art. 6(1)(f) GDPR (secure, performant operation).

5. Payment processing (Mollie)

We use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, to process payments. The payment and billing data entered during checkout is transmitted to Mollie to carry out the payment. Mollie processes payment data as its own controller or as a processor in accordance with its privacy notices. Legal basis: Art. 6(1)(b) GDPR.

6. Invoicing

To meet statutory retention and record-keeping obligations (in particular under commercial and tax law), we process invoicing data (company, billing address, country, VAT ID where applicable, service and amount details). Legal basis: Art. 6(1)(c) GDPR (legal obligation).

7. Transactional emails

To send necessary emails (e.g. invitations, password resets, order confirmations) we use the Microsoft 365 email service provided by Microsoft Ireland Operations Ltd. Legal basis: Art. 6(1)(b) and (f) GDPR.

8. Error and operations monitoring (Sentry)

To detect and fix technical errors we use Sentry (Functional Software Inc.) in the EU region. This may process technical error data and, to a limited extent, personal identifiers (e.g. user ID). Legal basis: Art. 6(1)(f) GDPR (stability and security).

9. AI voice-cloning feature (ElevenLabs) – optional and consent-based

In the "Artificial Intelligence" module you may optionally run a demonstration of an AI voice clone. A short voice recording of the participant is processed to generate an example synthetic voice. This constitutes biometric / special-category data (Art. 9 GDPR).

The feature is optional and is only run after your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). Consent may be withdrawn at any time with effect for the future.
Processing is carried out by ElevenLabs, Inc., based in the USA. The transfer is safeguarded primarily by the EU-US Data Privacy Framework (European Commission adequacy decision), to which ElevenLabs is certified; the EU Standard Contractual Clauses (SCC) and a Transfer Impact Assessment (TIA) apply in addition.
The recording is used only for the immediate demonstration and is not stored for further use.

10. Cookies and local storage

We use only technically necessary cookies or comparable storage techniques (e.g. a session cookie for sign-in, cross-site request forgery protection, language preference). We do not use any analytics, tracking or marketing cookies. Legal basis: Section 25(2) TDDDG (technically necessary) and Art. 6(1)(f) GDPR. No consent is required for this.

11. Audience measurement (umami, cookieless)

On our public marketing pages we use the self-hosted open-source analytics software umami to compile statistics about the use of our website (e.g. page views, referrers, device type). umami works without cookies and without storing or reading any information on your device; IP addresses are not stored, and only aggregated, anonymous statistics are produced. No profile of individual visitors is created; the data never leaves our server in Germany. The legal basis is our legitimate interest in analysing and improving our online offering (Art. 6(1)(f) GDPR). As no information is stored on or read from your device, Section 25 of the German TDDDG does not apply and no consent is required.

12. Recipients / sub-processors

To provide the Platform we use carefully selected service providers, each with the data-protection agreements required:

Hetzner Online GmbH (hosting, Germany)
Mollie B.V. (payment processing, Netherlands)
Microsoft Ireland Operations Ltd. (email delivery, EU)
Functional Software Inc. / Sentry (error monitoring, EU region)
ElevenLabs Inc. (AI voice clone, USA – only with consent, see section 9)

A current overview is available on request.

13. Third-country transfers

A transfer to a third country (USA) takes place exclusively within the optional, consent-based AI voice-cloning feature (section 9) and is safeguarded by the EU-US Data Privacy Framework (adequacy decision) and, in addition, the EU Standard Contractual Clauses. Otherwise, personal data is processed within the EU/EEA.

14. Retention

We process personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. Account and training data is deleted after the contractual relationship ends or on the instruction of the responsible organization; invoicing data is retained in accordance with statutory periods.

15. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent given at any time with effect for the future. You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR); the competent authority includes the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Where your rights concern data we process on behalf of your organization, please contact that organization as the controller; we will support them in fulfilling the request.

16. Data security

We take appropriate technical and organizational measures (TOMs) to protect your data, including transport encryption (TLS), tenant-separated data storage, access controls, two-factor authentication for administrators and regular backups. Details are documented in our TOMs and provided to customer organizations as an annex to the DPA.

17. Changes

We update this privacy policy as changes in our processing or the legal situation require. The version published on the Platform at the relevant time applies.