Privacy Policy

Welcome to CloseUp. Below, we would like to explain to you which personal data we process, how we process this personal data, and which rights you have with regard to this processing.

1. Controller responsible for data processing

The controller responsible for data processing is

CLOSE UP SOLUTIONS LTD
Roseland, Flat 8, Triq it-Tempesta
SPB 2400 Saint Paul's Bay
Malta
Email: datenschutz@closeupme.com

We have not appointed a data protection officer for our company and are not required to do so. If you have questions about how we ensure data protection on our website, or if you wish to exercise your rights set out below under Section 2, you can reach us at the addresses stated above.

2. Your rights regarding data processing carried out by us

We are happy to inform you whether and which of your personal data are processed by us and for which purposes (Art. 15 GDPR). In addition, subject to the respective statutory requirements, you have the right to rectification (Art. 16 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to erasure (Art. 17 GDPR) and the right to data portability (Art. 20 GDPR). Subject to the statutory requirements, you have the right to object to processing (Art. 21 GDPR). To exercise your aforementioned rights, please contact us using the contact details stated above.

If our data processing is based on your consent within the meaning of Art. 6(1)(a) GDPR, you can withdraw this consent at any time, freely and without giving reasons (Art. 7(3) GDPR). The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

Exercising your rights described above is free of charge for you.

Without prejudice to these rights and to the possibility of seeking any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority at any time. The supervisory authority responsible for us is:

Office of the Information and Data Protection Commissioner (IDPC)
Airways House, High Street
Sliema SLM 1549
Malta
Website: idpc.org.mt

You can also contact the supervisory authority at your place of residence or work in the European Union.

3. Data security

We have taken extensive technical and organisational measures to protect your personal data against manipulation, loss, destruction or access by unauthorised third parties.

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from “http://” to “https://” and by the padlock symbol in your browser bar. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

If, after the conclusion of a contract subject to a fee, we ask you to transmit your payment data (e.g. credit card numbers) to us, these data are required for payment processing. Payment transactions using the common means of payment (credit card, direct debit) are made exclusively via an encrypted SSL or TLS connection.

4. Automated decision-making (including profiling)

We do not process your personal data as part of an automated decision-making procedure (including profiling) and do not intend to carry out such processing.

5. Recipients of data

In the following cases, we transmit your data to the following categories of recipients:

• Where we use processors to fulfil the purposes we have stated, we transmit personal data to these processors under a data processing agreement (Art. 28 GDPR). The legal basis in this case is Art. 28 GDPR.
• Where necessary to fulfil our contractual obligations, to external service providers, such as in particular the commissioned credit institution for invoicing or shipping service providers. The legal basis in this case is Art. 6(1)(b) GDPR.
• Where necessary to fulfil a legal obligation to which we are subject, to external bodies, such as in particular authorised law enforcement and tax authorities. The legal basis in this case is Art. 6(1)(c) GDPR.
• Where necessary to safeguard legitimate interests, a transmission to third parties, in particular to external service providers, may likewise be necessary. Our legitimate interests include in particular the defence and enforcement of our legal claims. The legal basis in this case is Art. 6(1)(f) GDPR.

6. Processing of data you actively provide to us

Use of the website

The website can be used without you actively providing us with your personal data. Where you actively provide us with your personal data (for example name, address or email addresses), this is always done on a voluntary basis. Please note that certain personal data are processed when you visit the website without you actively providing them. Below, we explain which data these are and which processing operations are carried out with them.

Creator account on CloseUp

If you wish to create a creator account on CloseUp, we ask you for some information during registration, including in particular your name and postal address, your email address and your password. We also need your bank account details and tax information for payouts of revenue shares. The mandatory information requested when registering a creator account must be provided in full. Otherwise, we will reject the registration for a creator account.

The legal basis for the data processing is Art. 6(1)(b) GDPR; we use your data to be able to perform the contract concluded with you for the creator account and to be able to pay you the revenue shares from the sale of your content. We retain your data for as long as the creator account exists. Statutory retention periods remain unaffected.

For authentication and user management, we use the Clerk service. Clerk is an offering of Clerk, Inc., 2261 Market Street STE 10607, San Francisco, CA 94114, USA. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Clerk, Inc. as our service provider. You can find the privacy policy of Clerk, Inc. here: https://clerk.com/legal/privacy . Clerk, Inc. participates in the EU-US Data Privacy Framework. Any data transfers to the USA connected with our use of Clerk are lawful in accordance with the adequacy decision of the European Union pursuant to Art. 45(1)(a) GDPR.

Use of age verification systems (AVS): DIDIT

To ensure compliance with youth protection law, we use the AVS DIDIT. DIDIT is an offering of the company MARKETS PROLIVE 360, S.L., C/ Nàpols 227, 1a - 08013 Barcelona, Spain. DIDIT uses various personal data to determine whether a person is of legal age. These may also include special categories of personal data within the meaning of Art. 9 GDPR. DIDIT will request these data when the AVS is started.

We have concluded a data processing agreement pursuant to Art. 28 GDPR with MARKETS PROLIVE 360 as our service provider. You can find the privacy policy of MARKETS PROLIVE 360 here: https://didit.me/de/terms/privacy-policy/

The legal basis for this transmission is your consent pursuant to Art. 6(1)(a) GDPR or, where special categories of personal data are concerned, pursuant to Art. 9(1)(a) GDPR. You give your consent when you agree to the use of DIDIT in the purchase process. You can withdraw your consent at any time by cancelling the age verification.

Contacting us

If you contact us with an enquiry, we process the personal data you provide in the enquiry in order to handle, manage and respond to your enquiry.

The legal basis for this processing of your data is Art. 6(1)(b) GDPR, insofar as it concerns the initiation of a contract or customer support within the framework of an existing contractual relationship. Otherwise, the legal basis is Art. 6(1)(f) GDPR, namely our legitimate interest in communicating as desired with everyone who is interested in our work.

We store the data you provide when contacting us until the purpose of the data storage ceases to apply (e.g. after your enquiry has been fully processed). Statutory retention periods remain unaffected.

7. Processing of data from your end devices: “cookies” and similar identifiers

“Consent manager”

On our website, we use technical aids for various services and functions that are stored on your end device. These are in particular cookies, but also similar so-called identifiers, such as tracking pixels or web beacons (all such technical aids are collectively referred to in this document as “cookies”). We explain which services and functions use cookies in this privacy policy. Most of the cookies we use are so-called “session cookies”. They are automatically deleted when your visit ends. Other cookies remain stored on your end device until you delete them. These cookies enable us to recognise your browser on your next visit.

When you access our offering, our consent manager is displayed to you immediately. The consent manager will ask you whether you consent to the use of cookies. You can call up the consent manager again at any time via the “Cookie settings” button and change settings you have made previously.

Technically necessary cookies

Our website uses cookies for technically necessary functions: the technical structure of the website requires us to use certain cookies. Without these technologies, our website cannot be displayed completely and correctly, or the support functions could not be made available. We explain which cookies these are in this privacy policy and also in the consent manager. You cannot deselect these cookies if you wish to use our website. The legal basis for the use of such cookies is Art. 5(3), second sentence, of the ePrivacy Directive (Directive 2002/58/EC, implemented in Malta by S.L. 586.01). For the processing of personal data that takes place in the context of the use of such cookies, the legal basis is our legitimate interest within the meaning of Art. 6(1)(f) GDPR, namely our legitimate interest in being able to offer you a functional and operational website.

Other cookies

In addition, we use optional cookies for the use of which we need your consent: we only use these cookies after we have received your consent via the consent manager. The functions are only activated if you consent and can serve, in particular, to enable us to analyse and improve visits to our website, to make it easier for you to use it across different browsers or end devices, to recognise you during a visit, or to serve advertising (where applicable also to orient advertising to interests, to measure the effectiveness of ads or to show interest-based advertising). We explain which cookies these are in this privacy policy. The legal basis for the use of such cookies is your consent pursuant to Art. 5(3) of the ePrivacy Directive (Directive 2002/58/EC, implemented in Malta by S.L. 586.01). We explain the legal basis for the processing that takes place in the context of the use of such cookies below, in connection with the explanation of the respective functions that use cookies.

8. Processing of data when visiting the website: data processing in the context of technical provision

Log files

When you visit our website and view its content, information is transmitted from your browser to our server, including the following personal data: IP address, timestamp, user agent/device, session IDs, error/performance logs, CDN/caching logs

This information is temporarily stored in a so-called log file until automated deletion, which regularly takes place within 7 days. In the case of security-relevant events, longer storage may also take place if this is necessary for the analysis.

We process this data in order to provide and display our website and the content it contains to you, and for protection against brute-force attacks. The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest in the processing arises from the fact that the processing is technically necessary in order to display our website to you and to ensure the stability and security of the website. The data is deleted as soon as it is no longer required for the described purpose. You can object to this legitimate interest at any time.

Our “consent manager”: FlowAppz

As we explain under Section 7, we offer you the option on our website to configure and control the use of cookies at any time with the help of our consent manager. However, our consent manager must communicate with your device, that is, it must know its IP address, in order to function correctly. This is processed in anonymised form. The consent manager must also store the consent or the refusal of consent, as well as the date and time of the consent and browser information, as it could otherwise not fulfil its purpose.

On our website, we use the consent manager of FlowAppz. The consent manager is a service of the company Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. We have concluded a data processing agreement pursuant to Art. 28 GDPR with CookieBot as our service provider. The processing by FlowAppz takes place exclusively within the European Union. You can find the privacy policy of FlowAppz here: https://flowappz.com/privacy-policy

When you enter our website, a consent manager cookie is stored in your browser, in which the consents you have given or the withdrawal of these consents are stored. This data is not passed on to the provider of the consent manager. This cookie has a lifetime of 12 months. This means that your browser remembers the settings you made in the consent manager for this period; the cookie is deleted upon expiry of this period.

The legal basis for the use of this cookie is Art. 5(3), second sentence, of the ePrivacy Directive (Directive 2002/58/EC, implemented in Malta by S.L. 586.01). For the data processing that takes place in the context of the use of the consent manager, the legal basis is our legitimate interest within the meaning of Art. 6(1)(f) GDPR in offering you a functional and operational website and in enabling you to control the cookies used on it. The data is deleted at the latest upon expiry of the lifetime of the cookie. You can object to this legitimate interest at any time.

Webflow

In order to be able to display our website and the content available on it to you, it must be hosted. When you access the website, we must communicate with your device. For this purpose, we must know the IP address used by your device for the access, because just as a parcel cannot reach its destination without a postal address, a website needs the IP address. Without knowledge of the IP address, it is not possible to display the website and the content available on it on your device.

For the hosting of our website and the display of the content available on it, we use the content delivery network (“CDN”) of the company Webflow. The CDN is a service of Webflow Inc., 398 11th Street, 2nd Floor, San Francisco, California, 94103 USA. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Webflow as our service provider. Because the Webflow CDN is made available in a decentralised manner on various servers distributed around the world, Webflow has implemented compliance measures for such international data transfers. These measures use, among other things, the EU standard contractual clauses. You can find the privacy policy of Webflow here: https://webflow.com/legal/privacy

The legal basis for the data processing is our legitimate interest within the meaning of Art. 6(1)(f) GDPR in offering you a website that functions as well and as securely as possible and loads quickly. For this purpose, our website is stored in the Webflow CDN in a decentralised manner on various servers distributed around the world and made available from there. This achieves a fast loading time of the website, higher reliability, protection against brute-force attacks and increased protection against data loss. The transmission of the IP address to Webflow takes place in anonymised form. It is stored by Webflow for 24 hours and then deleted. No tracking or other further processing of this data takes place. You can object to this legitimate interest at any time.

Cloudflare

We use the content delivery network of Cloudflare Inc., 101 Townsend St., San Francisco, California 94107, USA (“Cloudflare”). Cloudflare offers a content delivery network with DNS. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Cloudflare as our service provider. Technically, the transfer of information between your browser and our website is routed via the Cloudflare network. Cloudflare is thereby able to analyse the traffic between the user and our websites, for example in order to detect and fend off attacks on our services. In addition, Cloudflare may store cookies on your computer for optimisation and analysis purposes. You can find the privacy policy of Cloudflare here: https://www.cloudflare.com/privacypolicy/

Cloudflare collects statistical data about the visit to our websites. The access data include: name of the page accessed, file, date and time of the access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the page visited previously), IP address and the requesting provider. Cloudflare uses the log data for statistical evaluations for the purpose of operating, securing and optimising the offering.

The legal basis for the processing is Art. 6(1)(f) GDPR, namely our legitimate interest in the protection and security of our systems. Cloudflare participates in the EU/US Data Privacy Framework. Any data transfers to the USA connected with our use of Cloudflare are lawful in accordance with the adequacy decision of the European Union pursuant to Art. 45 GDPR.

MUX

We likewise use the content delivery network of Mux, Inc., 50 Beale St., 9th floor, San Francisco, CA 94105, USA (“MUX”). MUX offers a content delivery network specifically for video files. In doing so, MUX may store cookies on your computer for optimisation and analysis purposes. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Webflow as our service provider. You can find the privacy policy of MUX here: https://www.mux.com/privacy

The legal basis for the processing is Art. 6(1)(f) GDPR, namely our legitimate interest in the protection and security of our systems. MUX participates in the EU/US Data Privacy Framework. Any data transfers to the USA connected with our use of MUX are lawful in accordance with the adequacy decision of the European Union pursuant to Art. 45 GDPR.

jsDelivr

We likewise use the content delivery network jsDelivr of Volentio JSD Ltd., Suite 2a1, Northside House, Mount Pleasant, Barnet, England, EN4 9EB (“jsDelivr”). jsDelivr is an open-source solution and uses cookies. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Webflow as our service provider. You can find the privacy policy of jsDelivr here: www.jsdelivr.com/privacy-policy-jsdelivr-net

The legal basis for the processing is Art. 6(1)(f) GDPR, namely our legitimate interest in the protection and security of our systems. Any data transfers to the United Kingdom (UK) connected with our use of jsDelivr are lawful in accordance with the adequacy decision of the European Union pursuant to Art. 45 GDPR.

9. Processing of data when visiting the website: web analytics

Google Analytics

We would like to know how users use our website and how we can improve our website. To analyse user behaviour, we use the Google Analytics service on our website. The service sets and uses cookies and processes the IP address used by your device.

“Google” is a group of companies and consists of the companies Google Ireland Ltd. (provider of the service), Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as well as other affiliated companies of Google LLC. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Google Ireland Ltd. as our service provider. You can find further information on Google Analytics as well as Google’s privacy policy at https://policies.google.com/?hl=de .

We use Google Analytics with the “User-ID function” deactivated. This means that, according to Google, user behaviour is not collected and attributed to a pseudonymously created ID of the user. Also, according to Google, the IP address used by your device is shortened and anonymised by Google immediately and still within the European Union. According to Google, non-anonymised IP addresses reach the USA only in exceptional cases. According to Google, the IP address transmitted by your browser in the context of Google Analytics is also not merged with other data from Google.

During your visit to the website, your user behaviour is recorded in the form of “events”. Events can be:

• Page views
• First visit to the website
• Start of the session
• Web pages visited
• Your “click path”, interaction with the website
• Scrolls (whenever a user scrolls to the end of the page (90%))
• Clicks on external links
• internal search queries
• Interaction with videos
• File downloads
• ads seen / clicked
• Language setting

In addition, the following is recorded:

• Your approximate location (region)
• Date and time of the visit
• Your IP address (in shortened form)
• technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
• Your internet provider
• the referrer URL (via which website/advertising medium you came to this website)

The information generated by the cookies about your use of this website, which, owing to the anonymisation of the IP address, regularly cannot be attributed to any person, is generally transmitted to a Google server in the USA and stored there. On our behalf, Google will use this information to evaluate the use of the website, to compile reports on website activity and to provide further services associated with website use and internet use to the website operator. The data sent by us and linked to cookies is automatically deleted after two months. The maximum lifetime of the Google Analytics cookies is two years. Data whose retention period has been reached is deleted automatically once a month.

The legal basis for the use of this cookie is your consent pursuant to Art. 5(3) of the ePrivacy Directive (Directive 2002/58/EC, implemented in Malta by S.L. 586.01). For the data processing that takes place in this context, the legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You give us both via our consent manager (cf. Section 7 above), via which you can withdraw your consent at any time. You can also generally prevent the described processing by means of settings in your browser program. Google participates in the EU/US Data Privacy Framework. Any data transfers to the USA connected with our use of Google services are lawful in accordance with the adequacy decision of the European Union pursuant to Art. 45(1)(a) GDPR.

Use of Matomo

If you give us your consent to do so, we use Matomo, a web analytics service based on open-source software, for the analysis and statistical evaluation of the use of the website. Cookies are used for this purpose. The information obtained in this way about website use is transmitted exclusively to our servers and summarised in pseudonymous usage profiles. We use the data to evaluate the use of the website. The collected data is not passed on to third parties. IP addresses are anonymised (IP masking), so that attribution to individual users is no longer possible. No data transfer to countries outside the European Union takes place.

The legal basis for the data processing is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time.

As of: October 2026