October 2025

1. Introduction and Controller

Protecting your personal data is important to us. This Privacy Policy explains what personal data we collect when you visit our website [your domain, e.g. deine-buchseite.de] and during the purchase process, how we use it, and what rights you have.

Controller responsible for data processing on this website in accordance with the General Data Protection Regulation (GDPR):

pathways digital SL

C/ Gremi de Sabaters 21

07009 Palma

Spain

privacy@pathways-digital.com

2. Definitions

Personal data: Any information relating to an identified or identifiable natural person (e.g. name, email address, IP address).

Processing: Any operation performed on personal data (e.g. collection, storage, use, deletion).

Controller: The natural or legal person who determines the purposes and means of the processing of personal data, alone or jointly with others.

3. Type and Scope of Data Processing

We process personal data that you voluntarily provide to us when visiting our website, contacting us, or purchasing a product. This includes in particular:

• Inventory data: Name, address, email address, phone number (during the ordering process).

• Usage data: Information about your visit to our website (e.g. pages visited, time spent, clicks).

• Contact data: Information provided when contacting us via email, contact form, or phone.

4. Purposes and Legal Bases of Processing

We process your data for the following purposes and on the following legal bases:

For contract performance and pre-contractual measures (Art. 6(1)(b) GDPR):

• Processing your order data for the conclusion and execution of the purchase contract (e.g. provision of the e-book).

• Communication regarding your order.

For compliance with legal obligations (Art. 6(1)(c) GDPR):

• Storage of invoices and accounting data in accordance with tax and commercial laws.

For the protection of our legitimate interests (Art. 6(1)(f) GDPR):

• Optimization of our website and offers.

• Ensuring the operation and security of our IT systems.

• Advertising and market research, unless you have objected.

Based on your consent (Art. 6(1)(a) GDPR):

• For sending our newsletter (if offered and subscribed by you).

• For the use of specific analytics and marketing services (see section 7).

You may withdraw your consent at any time with effect for the future.

5. Disclosure of Data to Third Parties

We do not share your personal data with third parties unless:

• It is necessary for contract performance (e.g. payment providers).

• You have given your explicit consent.

• We are legally obliged to do so.

• The disclosure is to processors who act strictly in accordance with our instructions (see section 6).

6. Processors

We use external service providers (processors) to provide our services. These process data exclusively on our behalf and under strict data protection requirements. These include in particular:

• Hosting providers: For operating our website.

• Payment providers: For processing payments.

• Platform for digital product sales: Systeme.io

7. Use of Cookies and External Services

We use cookies and various external services on our website to ensure functionality, analyze usage, and conduct marketing activities.

What are cookies?

Cookies are small text files stored by your browser on your device. They store specific information to be retrieved during your next visit.

We obtain your consent for most cookies and external services that are not essential for website operation via a Consent Management Tool (CMP).

Below are the services we use and how we handle them:

7.1 Systeme.io (Sales Platform and Email Marketing)

Purpose: Systeme.io is our all-in-one platform for selling digital products (landing page, order process, email marketing). It processes your data to fulfill contracts (name, email, payment details) and send emails (order confirmations, newsletters).

Processed data: Contact, inventory, contract, and usage data.

Legal basis: Art. 6(1)(b) GDPR (contract performance) for orders and Art. 6(1)(a) GDPR (consent) for newsletters.

Privacy Policy: [Link to Systeme.io Privacy Policy]

Note: Systeme.io is a US-based provider. Ensure that an appropriate data protection agreement (Standard Contractual Clauses) or other transfer mechanism under the GDPR is in place — this should be included in your contract with Systeme.io.

7.2 Meta Ads (Facebook/Instagram Advertising)

Purpose: We use Meta Ads to promote our products and measure campaign performance. The Meta Pixel helps us define website visitors as ad target audiences (retargeting) and track user actions after interacting with an ad (conversion tracking).

Processed data: Usage data (e.g. pages visited, purchases), IP address, device info.

Legal basis: Art. 6(1)(a) GDPR (consent) via our CMP. Without your consent, the pixel will not be loaded.

Privacy Policy: [Link to Meta Privacy Policy]

Note: Meta Platforms Inc. is based in the USA. Data transfers to the US are based on Standard Contractual Clauses or an adequacy decision, if available.

7.3 Google Ads (Google Advertising)

Purpose: We use Google Ads to promote our products via Google Search and partner networks. Conversion tracking helps us understand user interactions and actions (e.g. purchases).

Processed data: Usage data (e.g. ad clicks, pages visited, purchases), IP address, device info.

Legal basis: Art. 6(1)(a) GDPR (consent) via our CMP. Without your consent, tracking will not be activated.

Privacy Policy: [Link to Google Privacy Policy]

Note: Google Ireland Limited is based in Ireland. Data transfers to the USA are based on Standard Contractual Clauses or an adequacy decision.

7.4 Google Analytics (Website Analytics)

Purpose: We use Google Analytics to analyze and improve website usage. The statistics help us optimize our offerings and make them more appealing.

Processed data: Usage data (e.g. visitor numbers, session duration, origin), IP address (anonymized).

Legal basis: Art. 6(1)(a) GDPR (consent) via our CMP. Without consent, no data will be collected.

Privacy Policy: [Link to Google Privacy Policy]

Anonymization: We configured Google Analytics so that your IP address is anonymized before storage.

Opt-out: You can prevent cookies by adjusting your browser settings. You can also block Google Analytics data collection using this browser add-on:

https://tools.google.com/dlpage/gaoptout?hl=en

7.5 Umami Analytics (Privacy-Friendly Website Analytics)

Purpose: Umami Analytics is a privacy-friendly, open-source web analytics tool that helps us understand website usage. Unlike Google Analytics, Umami does not use cookies and does not store personal identifiers such as IP addresses (these are anonymized). Only aggregated statistics are generated.

Processed data: Anonymized usage data (e.g. page views, referrers). No personal data is stored that could directly identify you.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest), as no cookies are used and all data is fully anonymized. Thus, a CMP consent is generally not required.

Privacy Policy: [Link to your Umami Analytics Privacy Policy or the Umami project page]

8. Data Retention

We store personal data only as long as necessary to achieve the stated purposes or comply with statutory retention periods. Once these purposes or periods expire, the respective data will be deleted.

9. Your Rights as a Data Subject

You have the right at any time to:

• Request access to your personal data (Art. 15 GDPR).

• Request correction of inaccurate data (Art. 16 GDPR).

• Request deletion of your stored data (Art. 17 GDPR), unless legal obligations prevent this.

• Request restriction of processing (Art. 18 GDPR).

• Receive data portability (Art. 20 GDPR).

• Object to processing (Art. 21 GDPR), especially when based on Art. 6(1)(f) GDPR (legitimate interest).

• Withdraw consent at any time (Art. 7(3) GDPR).

• Lodge a complaint with a supervisory authority (Art. 77 GDPR) if you believe your data is being processed unlawfully. The competent authority is the one of your residence or our company’s location.

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy as needed to comply with legal requirements or reflect changes to our services. The updated policy applies to your next visit.