PRIVACY POLICY
StarDev SE – www.stardev.se
Version: 19 August 2026
This is a translation of our German privacy policy. In the event of any discrepancy, the German version prevails.
1. CONTROLLER
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
StarDev SE
Mehlbeerenstrasse 2
82024 Taufkirchen
Germany
Phone: +49 89 6659079-0
E-mail: info@stardev.se
Represented by the Managing Director Christian Türcke.
Commercial register: Local Court of Munich, HRB 280431
VAT identification number: DE360871576
Further details about our company can be found in our legal notice (Impressum).
Contact for data protection matters
For all questions relating to data protection and to exercise your rights, please contact:
Mr Armin Pacher
E-mail: data_protection_contact@stardev.se
Phone: +49 89 6659079-0
2. PRINCIPLES OF OUR PROCESSING
We process personal data exclusively on the basis of statutory provisions, in particular the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
Personal data means any information relating to an identified or identifiable natural person.
You can use our website without actively providing us with personal data. For technical reasons, however, certain data such as your IP address will be processed; further details can be found under section 5. Where we collect personal data beyond this, we do so on a voluntary basis or on one of the legal bases set out below.
Data transmission over the internet may have security gaps. Complete protection of data against access by third parties is not possible. Our website uses TLS encryption, recognisable by "https://" in your browser's address bar.
3. YOUR RIGHTS AS A DATA SUBJECT
You have the following rights in relation to the personal data concerning you:
- Access to the data we process (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of the data stored by us (Art. 17 GDPR)
- Restriction of processing, where we are not yet permitted to erase your data due to legal obligations (Art. 18 GDPR)
- Data portability, where processing is based on consent or a contract and is carried out by automated means (Art. 20 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) GDPR. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Where your personal data are processed for direct marketing purposes, you have the right to object at any time to such processing; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
www.lda.bayern.de
You may also contact the supervisory authority of your habitual residence or place of work.
4. HOSTING OF OUR WEBSITE
Our website is operated on the Wix.com platform. The provider is Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel, represented for users in the European Economic Area by Wix Online Platform Limited, 1 Grant's Row, Dublin 2, Ireland.
Wix provides the technical infrastructure and processes all data arising from the use of our website, in particular IP addresses, access times, browser information and content submitted via forms.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and secure operation of our website. Where processing takes place in the context of pre-contractual measures, Art. 6(1)(b) GDPR applies in addition.
Processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Wix.com.
Third country transfers: An adequacy decision of the European Commission exists for Israel. Where Wix.com transfers data to further third countries, in particular the United States, this takes place on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR and, where applicable, on the basis of the recipient's certification under the EU-US Data Privacy Framework.
Further information: https://www.wix.com/about/privacy
4.1 Error logging
To detect and resolve technical faults, Wix operates its own error logging service connected via the domain sentry-next.wixpress.com. In the event of an error, technical details such as the page accessed, browser and device information and the error trace are transmitted. This processing is necessary for the proper operation of the website.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the stability and security of our website.
4.2 Fonts, images and videos
Fonts, images and scripts on our website are delivered via Wix's own infrastructure, including static.parastorage.com and static.wixstatic.com. No external third-party font libraries, such as Google Fonts, are integrated.
Videos on our website are stored with our hosting provider and played via its player. No third-party video platforms such as YouTube or Vimeo are integrated. No data is transmitted to third parties when a video is played.
5. SERVER LOG FILES
Each time our website is accessed, information transmitted by your browser is automatically recorded. This comprises:
- browser type and version
- operating system used
- referrer URL
- host name of the accessing device
- time of the server request
- IP address
This data is not combined with other data sources and is used exclusively for technical delivery, system security and error analysis.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation and the protection of our systems against attacks.
Retention period: 30 days.
6. COOKIES AND CONSENT MANAGEMENT
6.1 What cookies are
Cookies are small text files stored on your device. Some cookies are technically necessary for the website to function; others serve further purposes. The same applies to other methods of storing information on your device, such as your browser's local storage.
Under Section 25(1) TDDDG, storing information on your device and accessing information already stored generally require your consent. An exception applies under Section 25(2) no. 2 TDDDG for cookies that are strictly necessary to provide you with a service you have expressly requested.
6.2 Categories
We distinguish between the following categories:
Necessary
These cookies and comparable technologies are required for the operation of the website and are set without your consent. They serve session management, protection against cross-site request forgery, load balancing and the delivery of page content, as well as storing your privacy settings so that the banner is not displayed again on subsequent visits.
Legal basis: Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.
Analytics
We use this category to control the integration of Google Maps, see section 8. The map is loaded only after you have given your consent; until then you will see a placeholder in its place.
Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
Advertising
We use this category to control services that evaluate your usage behaviour for advertising purposes. We do not currently use any services in this category. Should we use such services in future, they will be loaded only after your consent and will be described in this policy.
Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
The audience measurement using Plausible Analytics described under section 7 does not fall into these categories, as it operates without cookies and neither stores information on your device nor accesses information stored there.
A breakdown by name, provider, purpose and retention period of all cookies and comparable technologies used on this website is available at any time in its current form in our privacy settings. You can access these via the permanently displayed icon on every page of our website.
6.3 Consent management (Usercentrics)
To obtain, manage and document your consent, we use the consent management solution provided by Usercentrics GmbH, Sendlinger Strasse 7, 80331 Munich, Germany.
When our website is accessed, a connection to Usercentrics servers is established. In this process, your IP address, details of your browser and device, the time of your visit and your consent decision are recorded and stored. This storage serves to demonstrate that we comply with our accountability obligation under Art. 7(1) GDPR.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR; storing the consent decision on your device is permitted without consent under Section 25(2) no. 2 TDDDG.
Retention period: Consent data is stored until you request its erasure, until you delete the stored consent decision in your browser, or until the purpose of storage ceases to apply. Mandatory statutory retention obligations remain unaffected.
Further information: https://usercentrics.com/privacy-policy/
6.4 Withdrawing your consent
You may withdraw your consent or change your selection at any time with effect for the future. To do so, open the privacy settings via the permanently displayed icon on our website.
Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
7. AUDIENCE MEASUREMENT WITH PLAUSIBLE ANALYTICS
On individual pages of our website we use Plausible Analytics. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.
Plausible is a privacy-friendly analytics service that operates without cookies and neither stores information on your device nor accesses information stored there. No cross-device or cross-site profiles are created and no data is passed on to third parties.
The data processed comprises the page accessed, the referrer URL, the country based on an IP evaluation that is not stored, device type, browser and operating system. To distinguish returning visits within a single day, Plausible generates an irreversible hash value that changes daily and does not permit any conclusions to be drawn about you personally. The IP address is not stored.
All processing takes place on servers within the European Union. No transfer to third countries takes place.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical evaluation of usage behaviour in order to design our offering according to demand. As Plausible neither stores information on your device nor accesses information stored there, Section 25(1) TDDDG does not apply and no consent is required.
Your right to object: You may object to this processing at any time under Art. 21 GDPR on grounds relating to your particular situation. Please send your objection informally to the contact address given under section 1.
Processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Plausible.
Further information: https://plausible.io/data-policy
8. GOOGLE MAPS
To display locations, we integrate map material from Google Maps on individual pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The map is loaded only after you have given your consent via our cookie banner in the corresponding category. Until then you will see a placeholder with a corresponding notice in its place.
If you give your consent, your IP address, details of your browser and device and information about your interaction with the map will be transmitted to Google. Transmission of the IP address is technically essential for delivering the map data. Google may set cookies and may transfer and process this data in the United States. If you are logged in to your Google account, Google may associate the access with your account.
Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG. You may withdraw your consent at any time via the privacy settings.
Third country transfers: Google Ireland Limited bases transfers to the United States on standard contractual clauses pursuant to Art. 46(2)(c) GDPR and on the certification of Google LLC under the EU-US Data Privacy Framework.
Google privacy policy: https://policies.google.com/privacy
9. CONTACTING US
9.1 Contact forms
Several forms are available on our website, including forms for general enquiries, franchise prospects, property offers and job applications.
If you contact us using one of these forms, we process the information you provide. Mandatory fields are marked as such; all further details are voluntary. We use this data exclusively to process your enquiry and for any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract. In all other cases Art. 6(1)(f) GDPR, based on our legitimate interest in processing incoming enquiries. Where you have expressly consented to further use, Art. 6(1)(a) GDPR is the legal basis.
Retention period: We erase the data once your matter has been conclusively dealt with and no statutory retention obligations apply. Commercial and tax retention periods of six and ten years respectively remain unaffected.
9.2 Enquiries by e-mail or telephone
If you contact us by e-mail or telephone, we process the information you provide in order to deal with your matter. The legal bases and erasure periods set out under 9.1 apply accordingly.
10. MANAGEMENT OF PROSPECT AND CONTACT DATA (PODIO)
To manage enquiries, prospects and business contacts we use the Podio application. The provider is Progress Software Corporation, 15 Wayside Road, Suite 400, Burlington, MA 01803, USA.
In Podio we store and process in particular:
- name, form of address and function
- contact details such as e-mail address, telephone number and postal address
- details of the company and professional situation
- information from your enquiry, such as interest in a particular franchise brand, preferred region, investment range and intended timing
- the history of our communication with you as well as internal notes on the status of processing
Purpose: Handling your enquiry, initiating and performing a franchise or business relationship, and following up on open matters.
Legal basis: Art. 6(1)(b) GDPR for pre-contractual measures and contract performance. Where we retain contacts beyond a specific enquiry for the purpose of initiating future business relationships, this is based on Art. 6(1)(f) GDPR; our legitimate interest lies in the orderly development of our franchise network. You may object to this processing under Art. 21 GDPR.
Processing on our behalf: The provider processes the data exclusively on our instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Server location and third country transfers: According to the provider, the data is stored in data centres within the European Union, namely in Dublin, Ireland. Where access from third countries, in particular the United States, takes place in the context of support or maintenance services, this occurs on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
Retention period: We erase prospect records once it is established that no cooperation will come about and no retention obligations apply, but at the latest three years after the last contact. For data from concluded contractual relationships, the statutory retention periods of six and ten years respectively apply.
11. DISCLOSURE TO THE FRANCHISORS
We operate as a franchise development company for several franchise concepts. If you pursue your interest in a franchise partnership beyond the initial information stage, we transfer your data to the relevant franchisor.
When the transfer takes place: Not upon your initial enquiry. The transfer occurs only once you actively continue the selection process and enter the phase in which a non-disclosure agreement (NDA) is concluded. That agreement is concluded not with us but directly between you and the franchisor. Without transferring your data to the franchisor, the further course of the selection procedure is therefore not possible.
What data is transferred: Name, contact details, information on your professional background, your preferred region and the information required to assess your application as a franchise partner, such as your intended investment range and timing.
Recipients: Depending on the concept you have enquired about, one of the following franchisors:
- fit20, Netherlands
- SONNENTOR, Austria
- Waffle Factory, Belgium
- Fat Monk, Austria
All of the recipients named are established within the European Union. No transfer to third countries takes place in this context.
Responsibility: With regard to the data transferred to them, the franchisors are independent controllers within the meaning of the GDPR. This constitutes neither processing on our behalf nor joint controllership. The franchisor's own privacy policy governs its further processing; you should assert your rights directly with the franchisor in that respect. We will gladly provide you with the relevant contact point on request.
Legal basis: Art. 6(1)(b) GDPR. The transfer takes place at your request in order to take steps prior to entering into a contract, as the non-disclosure agreement and the subsequent franchise agreement are concluded between you and the franchisor.
Before the first transfer, we inform you which franchisor your data will be passed on to.
12. NEWSLETTER
You can subscribe to our newsletter via our website. It contains information on the concept you have enquired about as well as on further franchise concepts we support, on webinars, events and location offers.
Subscription procedure: Subscription uses the double opt-in procedure. After signing up, you will receive an e-mail asking you to confirm your subscription. This confirmation e-mail contains no advertising. Only after your confirmation will we add you to the distribution list. This ensures that nobody can subscribe you without your knowledge.
What data we process: Your e-mail address and, where provided, your name. To demonstrate your consent, we additionally log the time of subscription, the time of confirmation, the IP address used and the exact wording of the declaration of consent.
Legal basis: Art. 6(1)(a) GDPR for sending the newsletter. Logging your consent is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and on our legitimate interest in defending against potential claims pursuant to Art. 6(1)(f) GDPR.
Dispatch and technical infrastructure: Dispatch takes place via an application developed by us in-house, operated on a server located on our own business premises in Munich, Germany. The server hardware is our property and is operated exclusively by us; no external data centre or hosting service provider is involved. For e-mail delivery we use the infrastructure of noris network AG, Nuremberg, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with this provider. Your data does not leave the Federal Republic of Germany in the course of the newsletter dispatch. No newsletter service provider established outside the European Union is used.
Performance measurement: We do not evaluate the opening or click behaviour of our newsletters. No tracking pixels are used and no personalised links are used for tracking purposes.
Withdrawal: You may withdraw your consent at any time with effect for the future. Please use the unsubscribe link at the end of every newsletter e-mail or send us an informal message to info@stardev.se. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
Retention period: We store your data for the purpose of sending the newsletter until you unsubscribe. After you unsubscribe, we retain your e-mail address on a suppression list to ensure that you receive no further newsletters. We retain the records of your consent until the expiry of the limitation periods, at the latest three years after the end of the year in which you unsubscribed.
13. JOB APPLICATIONS
If you apply to us, we process the application documents you submit, including your covering letter, CV, references and contact details, in order to carry out the application procedure.
Legal basis: Section 26(1) BDSG in conjunction with Art. 88 GDPR and Art. 6(1)(b) GDPR for the decision on establishing an employment relationship. Where you have consented to longer-term inclusion in our talent pool, this is based on Art. 6(1)(a) GDPR.
Retention period: If no appointment is made, we erase your documents six months after the conclusion of the procedure. This period serves to defend against potential claims under the German General Equal Treatment Act. Where you have consented to longer storage, we erase the data after twelve months.
14. OUR BLOG
We operate a blog on our website based on the Wix blog function. When blog posts are accessed, the provisions on hosting and server log files apply accordingly.
15. LINKEDIN
We use the professional network LinkedIn to present our company, to approach franchise prospects and to acquire business contacts. The provider for users in the European Economic Area is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
LinkedIn is a subsidiary of Microsoft Corporation, based in the United States. Where personal data is transferred to the United States, LinkedIn bases this on standard contractual clauses pursuant to Art. 46(2)(c) GDPR and on its certification under the EU-US Data Privacy Framework.
LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy
We do not use any LinkedIn analytics or advertising technologies on our website itself.
15.1 Our company profile on LinkedIn
We maintain a company profile on LinkedIn. If you visit this profile or interact with our posts, LinkedIn processes your personal data under its own responsibility in accordance with its privacy policy.
From these interactions, LinkedIn provides us with aggregated statistics known as Page Insights. These give us evaluations of reach and interactions as well as the composition of our followers by criteria such as industry, function, company size and region. We receive these evaluations exclusively in aggregated form; we are unable to draw conclusions about individual persons.
With regard to the processing underlying the creation of these statistics, we are joint controllers with LinkedIn within the meaning of Art. 26 GDPR. The joint controller arrangement is available at:
https://legal.linkedin.com/pages-joint-controller-addendum
Under this arrangement, LinkedIn bears primary responsibility for processing the Insights data and handles the fulfilment of data subject rights. You may assert your rights both against LinkedIn and against us; we will forward requests to LinkedIn where necessary.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in presenting our company externally, approaching potential franchise partners and applicants, and evaluating the effectiveness of our communication.
15.2 LinkedIn Lead Gen Forms and transfer to us via the LinkedIn API
We run advertisements on LinkedIn that may contain a Lead Gen Form. If you complete such a form, LinkedIn transfers the information you have released to us.
What data we receive: Name, business e-mail address, company, position, location and the answers to additional questions we ask, for example regarding your interest in a particular franchise brand, your preferred region or your intended investment range. Most of these fields are pre-filled by LinkedIn from your profile; you can change the details before submitting.
How the transfer takes place: The transfer is carried out automatically via the LinkedIn Marketing API directly into our contact management system Podio. From the point of receipt by us, the provisions under section 10 of this policy apply.
Responsibility: LinkedIn is responsible for collecting your data within the form. From the point of transfer to us, we are the independent controller for further processing.
Legal basis: The consent you give to LinkedIn is decisive for the transfer of your data to us, Art. 6(1)(a) GDPR. For the subsequent handling of your enquiry we rely on Art. 6(1)(b) GDPR.
Contact by us: We use the transferred data to contact you regarding the subject of your enquiry. Any use beyond this for advertising relating to other brands or topics takes place only where you have separately consented or where the conditions of Section 7(3) of the German Act Against Unfair Competition (UWG) are met.
15.3 Direct outreach via LinkedIn
If we contact you directly via LinkedIn, for example when approaching potential franchise partners, we process your publicly visible LinkedIn profile data and the history of our communication for this purpose.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in initiating business contacts within the scope of our franchise development activities. You may object to this processing at any time under Art. 21 GDPR.
16. RECIPIENTS AND PROCESSORS AT A GLANCE
Wix – Wix.com Ltd. and Wix Online Platform Ltd.
Purpose: Hosting, operation, video delivery and error logging
Server location: EU, Israel, USA
Usercentrics – Usercentrics GmbH, Munich, Germany
Purpose: Consent management
Server location: EU
Plausible Analytics – Plausible Insights OÜ, Estonia
Purpose: Audience measurement
Server location: EU
Google Maps – Google Ireland Limited, Ireland
Purpose: Display of map material
Server location: EU, USA
Podio – Progress Software Corporation, USA
Purpose: Management of contacts and prospects
Server location: EU (Ireland)
LinkedIn – LinkedIn Ireland Unlimited Company, Ireland
Purpose: Company profile, advertising, lead transfer
Server location: EU, USA
noris network AG, Nuremberg, Germany
Purpose: E-mail infrastructure for sending our newsletter
Server location: Germany
In addition, we transfer data of franchise prospects to the franchisors listed in section 11, subject to the conditions set out there. Those franchisors are independent controllers and not processors.
Beyond this, we pass on your data to third parties only where you have consented, where it is necessary for the performance of a contract, where a legal obligation exists, or where disclosure is necessary to safeguard legitimate interests and no overriding interests of yours warranting protection stand in the way.
Tax advisers, lawyers and IT service providers receive data only to the extent necessary and are themselves bound to confidentiality.
17. TRANSFERS TO THIRD COUNTRIES
Where personal data is transferred to countries outside the European Economic Area in the course of the processing described above, we ensure an adequate level of data protection through:
- an adequacy decision of the European Commission pursuant to Art. 45 GDPR, for example for Israel,
- standard contractual clauses pursuant to Art. 46(2)(c) GDPR,
- or, where applicable, the recipient's certification under the EU-US Data Privacy Framework.
We point out that authorities in the United States may under certain conditions access personal data, and that data subjects may not have the same legal remedies available to them as within the European Union.
18. RETENTION PERIODS
Unless an express retention period is stated in this policy, we erase personal data as soon as the purpose of processing ceases to apply and no statutory retention obligations stand in the way.
Commercial retention obligations under Section 257 of the German Commercial Code (HGB) and tax retention obligations under Section 147 of the German Fiscal Code (AO) are six or ten years depending on the type of document. During this period, processing is restricted to fulfilling these obligations.
19. NO AUTOMATED DECISION-MAKING
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
20. CHANGES TO THIS PRIVACY POLICY
We update this privacy policy as soon as changes to our processing activities or to the legal situation make this necessary. The version available at the time of your next visit shall apply.
Version: 19 August 2026