I. Data Controller
Upfields GmbH
Bahnhofstraße 5
83727 Schliersee

Represented by the Managing Directors Dr. Veit Quirin Lindholz and David Zellinger
E-mail: team@upfields.de

No Data Protection Officer has been appointed, as the legal requirements for such an appointment are not met.

II. Supervisory Authority
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 27
91522 Ansbach
E-mail: poststelle@lda.bayern.de

III. Data Processing When Visiting the Website
When accessing the website, technical data is automatically transmitted by the browser and processed in server log files (IP address, browser type, operating system, referrer URL, date/time, HTTP status, amount of data transferred).

The purpose of this processing is the technical provision and security of the website. The legal basis is Article 6(1)(f) GDPR. The recipient is our hosting provider, Wix.com Inc., acting as a processor pursuant to Article 28 GDPR. No transfer to third countries takes place. The data is stored for a maximum of 7 days.

IV. Cookies and Analytics
No cookies are used for analytics, tracking, or marketing purposes. No user tracking is carried out, and no user profiles are created.

V. Social Media Presence
We maintain profiles on Instagram, Facebook, LinkedIn, and TikTok for the purpose of presenting our company and communicating with prospective customers, clients, and business partners. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in public relations and communication.

When visiting our social media profiles, personal data is processed by the respective platform operators (e.g., IP address, device information, usage behavior, and, for logged-in users, profile-related information). These providers process such data particularly for analytics and advertising purposes. We have no influence over this data processing.

For so-called “Insights” or statistical data, joint controllership pursuant to Article 26 GDPR exists with the respective platform operators:

Meta Platforms Ireland Ltd. (Instagram, Facebook)
LinkedIn Ireland Unlimited Company
TikTok Technology Limited
Google Ireland Ltd. (YouTube)

The essential content of the joint controllership arrangements is provided by the respective platforms. Data subjects may exercise their rights both with us and directly with the platform operators.

Personal data transmitted directly to us via these platforms (e.g., messages or comments) is processed solely for handling the respective request. The legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. The data will be deleted once the matter has been conclusively processed, unless statutory retention obligations apply.

A transfer of personal data to third countries (particularly the United States) may be carried out by the platform operators and is based on appropriate safeguards pursuant to Article 46 GDPR (e.g., Standard Contractual Clauses or certifications under the EU-U.S. Data Privacy Framework).

We also maintain a profile on the Transfermarkt platform (transfermarkt.de), operated by Transfermarkt GmbH & Co. KG, Wandsbeker Zollstraße 5a, 22041 Hamburg, Germany. Data processing on this platform is carried out solely under the responsibility of Transfermarkt GmbH & Co. KG in accordance with its own privacy policy.

VI. Contact
When contacting us by e-mail or other communication channels, we process the data you provide (e.g., name, e-mail address, and the content of your inquiry).

The purpose is to process your inquiry and, where applicable, to initiate or perform a contract. The legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

The data will be deleted as soon as the inquiry has been fully processed. Where the contact results in a contractual relationship or concerns tax-relevant matters, the statutory retention periods of up to ten years apply (§§ 257 German Commercial Code (HGB), 147 German Fiscal Code (AO)).

Data is only disclosed to the hosting provider and/or e-mail service provider within the scope of data processing agreements.

VII. Sources of Data
We process only the data that you provide directly to us.

VIII. External Links
The operators of external websites are solely responsible for their content.

IX. Your Rights
You have the right at any time to:

• Access (Article 15 GDPR)

• Rectification (Article 16 GDPR)

• Erasure (Article 17 GDPR)

• Restriction of Processing (Article 18 GDPR)

• Data Portability (Article 20 GDPR)

• Object to Processing (Article 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). As we do not process personal data on the basis of consent pursuant to Article 6(1)(a) GDPR, there is no right of withdrawal under Article 7(3) GDPR.

X. Obligation to Provide Data
Providing a means of contact (in particular an e-mail address) is necessary for processing inquiries. Without such information, it is not possible to respond to your request. Apart from this, there is no legal or contractual obligation to provide personal data when merely visiting the website.

XI. Automated Decision-Making
No automated decision-making or profiling takes place.

Version: June 2026