Privacy Policy

This privacy policy explains how personal data is processed when you use the "The Phish Menu" platform (the "Platform"). Last updated: September 2026. The German version of this policy prevails in case of any discrepancy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

jaeger + haeckerhase gmbh
Pinienstraße 2, 40233 Düsseldorf, Germany
Managing Directors: Markus Jäger, Denis Häcker, Michael Hasselbusch
Düsseldorf Local Court, HRB 66211 · VAT ID DE278970438
Phone: +49 211 828075-0 · Email: info@jaeger-haeckerhase.de

For any data-protection questions, please contact us at the address above or by email at datenschutz@thephishmenu.de.

2. Roles: controller and processor

We process personal data in two distinct roles:

• As a processor (on behalf of the customer): all data of the customer's employees: accounts (name, email, function role), credentials (password hash, 2FA), training and progress data, completions and certificates, and the voice recording in the AI demo. In that respect the customer organisation is the controller; processing is carried out under a data processing agreement (DPA) pursuant to Art. 28 GDPR.
• As a controller in our own right: contract and master data of the customer and its administrator contacts (company, name, email, optional phone number, order), invoicing and payment data (payment processing via Mollie), support and contact correspondence (mailboxes info@, support@, datenschutz@), web-server security logs (IP addresses, 14 days), error monitoring (Sentry, without personal data), visitor statistics of the public website (umami, without cookies), and reminder and trial-period emails to administrators.

3. Data processed and purposes

Origin of the data

If your organisation invited you to use the Platform, we generally receive the personal data required to set up and run the training from your organisation.

Necessity of providing data

Certain personal data is required to set up a user account and to provide the Platform and the intended training functions. Without this data the corresponding functions cannot be used, or only to a limited extent.

Where information is voluntary, we point this out separately.

This applies in particular to the AI voice-cloning feature under section 9; not using it has no effect on the rest of the Platform. There is no disadvantage in not using the AI feature.

3.1 Account and access data

When you register and sign in, we process your name, email address, a password (stored only in encrypted form), your organisation membership and your chosen function role. When signing up for a trial account you may optionally provide a phone number; we use it only for questions about the trial and the contractual relationship. Administrator accounts are additionally secured with two-factor authentication. Purpose: providing, securing and administering the user account. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (account security).

3.2 Training and progress data

During the training we process your learning progress, completed modules, results of interactive exercises and completion/certificate data. Purpose: delivering and evidencing the security-awareness training. Legal basis: Art. 6(1)(b) GDPR in relation to the organisation; between the organisation and its employees, Section 26 of the German Federal Data Protection Act (BDSG, employee data protection).

3.3 Server log data

When the Platform is accessed, technically necessary data (e.g. IP address, date/time, resource requested) is processed to ensure operation, stability and security. Legal basis: Art. 6(1)(c) GDPR.

3.6 No automated decision-making

The Platform determines learning progress automatically (completion of modules, passing the final check with at least eight of ten correct answers, issuing the certificate). Your organisation only sees the status, the number of completed modules and the completion date, never individual answers or scores. Automated decision-making with legal effect or similarly significant effect within the meaning of Art. 22 GDPR does not take place.

4. Hosting

The Platform is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany (Nuremberg). A data processing agreement is in place with Hetzner. Legal basis: Art. 6(1)(f) GDPR (secure, performant operation).

5. Payment processing

Mollie: We use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, to process payments. The payment and billing data entered during checkout is transmitted to Mollie to carry out the payment. Mollie processes payment data as its own controller or as a processor in accordance with its privacy notices. Legal basis: Art. 6(1)(b) GDPR.

PayPal: Payments are processed via Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands (privacy notice: https://www.mollie.com/en/privacy). If you choose PayPal as the payment method, your payment data is additionally processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, as an independent controller (privacy notice: https://www.paypal.com/en/legalhub/privacy-full). We receive only the payment status and a payment reference. Legal basis: Art. 6(1)(b) GDPR.

6. Invoicing

To meet statutory retention and record-keeping obligations (in particular under commercial and tax law), we process invoicing data (company, billing address, country, VAT ID where applicable, service and amount details). Legal basis: Art. 6(1)(c) GDPR (legal obligation).

7. Transactional emails

To send necessary emails (e.g. invitations, password resets, order confirmations) we use the Microsoft 365 email service provided by Microsoft Ireland Operations Ltd. Legal basis: Art. 6(1)(b) and (f) GDPR.

8. Error and operations monitoring (Sentry)

To detect and fix software errors we use Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). Only technical error data is transmitted (error message, affected page, browser and operating-system version, time), no personal data such as IP address, user identifier or input. The error data is stored exclusively in the EU region (Frankfurt) and retained for about 30 days. Legal basis: Art. 6(1)(f) GDPR (stability and security).

9. AI voice-cloning feature (ElevenLabs) – optional and consent-based

In the "Artificial Intelligence" module you may optionally run a demonstration of an AI voice clone. The demonstration can be skipped without any disadvantage to you. A short voice recording of the participant is processed to generate an example synthetic voice. This constitutes biometric / special-category data (Art. 9 GDPR).

• The feature is optional and is only run after your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). Consent may be withdrawn at any time with effect for the future.
• Processing is carried out by ElevenLabs, Inc., based in the USA. The transfer is safeguarded primarily by the EU-US Data Privacy Framework (European Commission adequacy decision), to which ElevenLabs is certified; the EU Standard Contractual Clauses (SCC) and a Transfer Impact Assessment (TIA) apply in addition.
• The recording is used only for the immediate demonstration and is not stored for further use.

10. Cookies and local storage

We use only technically necessary cookies or comparable storage techniques (e.g. a session cookie for sign-in, language preference). We do not use any analytics, tracking or marketing cookies. Legal basis: Section 25(2) TDDDG (technically necessary) and Art. 6(1)(f) GDPR. No consent is required for this.

11. Campaign attribution

If you reach our website via an advertisement or a campaign link, the address bar contains campaign parameters (e.g. “utm_source”, “utm_campaign”) and possibly a click identifier (“gclid”). If you then create a trial account, we store these values once alongside the account in order to evaluate which campaign the contact came from. They are not transmitted to Google or any other third party and are not stored on your device. The legal basis is Art. 6(1)(b) GDPR (initiating and performing the trial contract); the values are deleted together with the account.

The same applies to referral links. Users of the platform can recommend a company via a personal link. If that company then creates an account, we store the referral code once alongside the account in order to attribute the referral. The referring person sees in their overview the name of the referred company, the sign-up date, the account status and further details required for the referral programme, such as the amounts invoiced to that company. To pay out a referral reward, we process the data of the referring person required for that purpose. The referral code is not stored on your device and is not transmitted to third parties. The legal basis is Art. 6(1)(b) GDPR (initiating the trial contract or performing the referral agreement) and Art. 6(1)(f) GDPR (attributing the referral). The attribution is deleted together with the account; billing records are retained for the statutory retention periods.

At events run by jaeger + haeckerhase (e.g. podcast recordings), guests can open a sign-up page on the Platform via a QR code and leave their first name, last name and email address (optionally: company) in order to receive the event information and the link to the recording by email afterwards. The legal basis is Art. 6(1)(b) GDPR (sending the requested information). The address is not used for any further advertising. The sign-up data is deleted once the mailing has been sent.

12. Recipients / sub-processors

To provide the Platform we use carefully selected service providers, each with the data-protection agreements required:

13. Third-country transfers

Personal data is processed within the EU/EEA. A transfer to a third country (USA) takes place exclusively within the optional, consent-based AI voice-cloning demonstration with ElevenLabs Inc. (section 9). The provider of our error monitoring (Sentry, section 8) is based in the USA; the error data processed there contains no personal data and is stored in the EU region.

Both providers are certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); the EU Standard Contractual Clauses apply in addition.

14. Retention

We process personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. Account and training data is deleted after the contractual relationship ends or on the instruction of the responsible organisation; invoicing data is retained in accordance with statutory periods.

15. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR); the competent authority includes the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Where we process your personal data on behalf of your organisation, your organisation is generally responsible for fulfilling your data-protection rights and information requests. You can therefore contact your organisation directly. We support it in handling such requests in accordance with the statutory requirements.

16. Withdrawal of consent

Where the processing of your personal data is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out on the basis of the consent before its withdrawal remains unaffected.

17. Changes

We update this privacy policy as changes in our processing or the legal situation require. The version published on the Platform at the relevant time applies.