Privacy Policy
Privacy Policy
Personal data (usually referred to just as „data“ below) will only be processed by us to the extent necessary and for the purpose of providing a functional and user-friendly website, including its contents, and the services offered there.
Per Art. 4 No. 1 of Regulation (EU) 2016/679, i.e. the General Data Protection Regulation (hereinafter referred to as the „GDPR“), „processing“ refers to any operation or set of operations such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or combination, restriction, erasure, or destruction performed on personal data, whether by automated means or not.
The following privacy policy is intended to inform you in particular about the type, scope, purpose, duration, and legal basis for the processing of such data either under our own control or in conjunction with others. We also inform you below about the third-party components we use to optimize our website and improve the user experience which may result in said third parties also processing data they collect and control.
Our privacy policy is structured as follows:
I. Information about us as controllers of your data
II. The rights of users and data subjects
III. Information about the data processing
I. Information about us as controllers of your data
The party responsible for this website (the „controller“) for purposes of data protection law is:
Cloudtone GmbH
Am Ruhestein 2
60529 Frankfurt am Main
Germany
Telephone: +49 (0)69 2475258 80
E-Mail: info@cloudtone.de
II. The rights of users and data subjects
With regard to the data processing to be described in more detail below, users and data subjects have the right to confirmation of whether data concerning them is being processed, information about the data being processed, further information about the nature of the data processing, and copies of the data (cf. also Art. 15 GDPR); to correct or complete incorrect or incomplete data (cf. also Art. 16 GDPR); to the immediate deletion of data concerning them (cf. also Art. 17 DSGVO), or, alternatively, if further processing is necessary as stipulated in Art. 17 Para. 3 GDPR, to restrict said processing per Art. 18 GDPR; to receive copies of the data concerning them and/or provided by them and to have the same transmitted to other providers/controllers (cf. also Art. 20 GDPR); to file complaints with the supervisory authority if they believe that data concerning them is being processed by the controller in breach of data protection provisions (see also Art. 77 GDPR).
In addition, the controller is obliged to inform all recipients to whom it discloses data of any such corrections, deletions, or restrictions placed on processing the same per Art. 16, 17 Para. 1, 18 GDPR. However, this obligation does not apply if such notification is impossible or involves a disproportionate effort. Nevertheless, users have a right to information about these recipients.
Likewise, under Art. 21 GDPR, users and data subjects have the right to object to the controller’s future processing of their data pursuant to Art. 6 Para. 1 lit. f) GDPR. In particular, an objection to data processing for the purpose of direct advertising is permissible.
III. Information about the data processing
Your data processed when using our website will be deleted or blocked as soon as the purpose for its storage ceases to apply, provided the deletion of the same is not in breach of any statutory storage obligations or unless otherwise stipulated below.
Cookie Manager
To obtain consent for the use of technically unnecessary cookies on the website, the provider uses a cookie manager.
When the website is called up, a cookie with the settings information is stored on the end device of the user so that the request for consent does not have to be made on a subsequent visit.
The cookie is required to obtain legally compliant user consent.
You can prevent cookies from being installed by adjusting the settings on your internet browser.
Cookies
a) Session cookies
We use cookies on our website. Cookies are small text files or other storage technologies stored on your computer by your browser. These cookies process certain specific information about you, such as your browser, location data, or IP address.
This processing makes our website more user-friendly, efficient, and secure, allowing us, for example, to display our website in different languages or to offer a shopping cart function.
The legal basis for such processing is Art. 6 Para. 1 lit. b) GDPR, insofar as these cookies are used to collect data to initiate or process contractual relationships.
If the processing does not serve to initiate or process a contract, our legitimate interest lies in improving the functionality of our website. The legal basis is then Art. 6 Para. 1 lit. f) GDPR.
When you close your browser, these session cookies are deleted.
b) Third-party cookies
If necessary, our website may also use cookies from companies with whom we cooperate for the purpose of advertising, analyzing, or improving the features of our website.
Please refer to the following information for details, in particular for the legal basis and purpose of such third-party collection and processing of data collected through cookies.
c) Disabling cookies
You can refuse the use of cookies by changing the settings on your browser. Likewise, you can use the browser to delete cookies that have already been stored. However, the steps and measures required vary, depending on the browser you use. If you have any questions, please use the help function or consult the documentation for your browser or contact its maker for support. Browser settings cannot prevent so-called flash cookies from being set. Instead, you will need to change the setting of your Flash player. The steps and measures required for this also depend on the Flash player you are using. If you have any questions, please use the help function or consult the documentation for your Flash player or contact its maker for support.
If you prevent or restrict the installation of cookies, not all of the functions on our site may be fully usable.
Contact
If you contact us via email or the contact form, the data you provide will be used for the purpose of processing your request. We must have this data in order to process and answer your inquiry; otherwise we will not be able to answer it in full or at all.
The legal basis for this data processing is Art. 6 Para. 1 lit. b) GDPR.
Your data will be deleted once we have fully answered your inquiry and there is no further legal obligation to store your data, such as if an order or contract resulted therefrom.
Account Registration
If you create a customer account with us via our website, we will collect and store the data you enter during registration (e.g., your name, address, or email address) exclusively for pre-contractual services, contract fulfillment, or customer care purposes (e.g., to provide you with an overview of your previous orders with us or to offer you the so-called notepad function). At the same time, we store the IP address and the date of your registration along with the time. This data will not be passed on to third parties.
During the further registration process, your consent to this processing will be obtained and reference will be made to this privacy policy. The data collected by us will only be used for the provision of the customer account.
If you consent to this processing, Article 6 (1) lit. a) GDPR is the legal basis for the processing.
If the opening of the customer account also serves pre-contractual measures or contract fulfillment, the legal basis for this processing is also Article 6 (1) lit. b) GDPR.
According to Article 7 (3) GDPR, you can revoke your consent to the opening and maintenance of the customer account at any time with effect for the future. You just need to inform us about your revocation.
The data collected in this respect will be deleted as soon as the processing is no longer necessary. However, we must observe tax and commercial law retention periods.
Google Calendar Sync Function
On botomat.de, you have the opportunity to create an automated appointment booking service via WhatsApp Business. For this purpose, you can link your Google Calendar with your botomat.de account and your WhatsApp phone number registered on botomat.de. In this section, we describe how botomat.de collects and uses the information you provide in your Google Calendar account via the botomat.de “Google Calendar Sync” application. We also explain the options available to you regarding our use of your information and how you can access and update this information.
a) Google API Data Policy
The use and transfer of information received from Google APIs by botomat.de to other apps are subject to the User Data Policy for Google API Services, including the requirements for limited use.
b) Collection and Use
For the purpose of linking your botomat.de account with your Google Calendar, botomat.de collects the following personal information from your Google Calendar account:
Event name Event date Event time Event description (inserted as a note) Event location (inserted as a note)
Depending on the respective application area of our service, we add/import the following personal information, which end users provide to you via the botomat.de WhatsApp appointment booking service for order processing, to your Google Calendar:
Event name Event date Event time Event description End user’s name End user’s email address End user’s WhatsApp phone number End user’s organization End user’s postal address End user’s birthday End user’s gender We use this information to:
Identify free time slots in your Google Calendar and deposit them in your WhatsApp appointment booking service provided via botomat.de Deposit appointments booked via the botomat.de WhatsApp appointment booking service in your Google Calendar Keep your Google Calendar synchronized with your botomat.de WhatsApp appointment booking service and vice versa Send booking confirmation emails, booking cancellation emails, booking update emails, or booking reminder messages to the end users of your botomat.de WhatsApp appointment booking service - consent of the end user is obtained each time before sending such emails. We will use this information only for the specific purpose for which it was provided to us.
c) Disclosure to Third Parties
We do not share or sell your personal information to third parties.
We only disclose information in the following cases:
As required by law, e.g., to comply with a subpoena or similar legal process When we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request If we are involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a clear notice on the botomat.de app about any change in ownership or uses of your personal information, and any choices you may have regarding your personal information If you directly and personally instruct us to do so before the disclosure
d) Security
The security of your personal information from Google Calendar is important to us. We take commercially reasonable measures and follow generally accepted standards to protect the information you provide, both during transmission and once we receive it. For example, the information you provide is encrypted during transmission using technologies such as Secure Socket Layer technology (SSL).
No method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee the absolute security of your information.
e) Access to Your Information
We retain the synchronized/imported information as long as your botomat.de account is active or as long as you keep it synchronized with your Google Calendar.
If you wish for us to no longer use the information from your Google Calendar, you can terminate the Google Calendar integration at https://dashboard.botomat.de/calendar by clicking on the “Disconnect” button.
Newsletter Subscription
If you sign up for our free newsletter, the data requested from you for this purpose, i.e., your email address and, optionally, your name and address, will be sent to us. At the same time, we store the IP address of the internet connection from which you access our website as well as the date and time of your registration. During the further registration process, we will obtain your consent to send the newsletter, describe the content specifically, and refer to this privacy policy. The data collected is used exclusively for the newsletter distribution - therefore, it is not passed on to third parties.
The legal basis for this is Article 6 (1) lit. a) GDPR.
You can revoke your consent to the newsletter dispatch at any time with effect for the future according to Article 7 (3) GDPR. You just need to inform us about your revocation or click on the unsubscribe link included in every newsletter.
Server Data
For technical reasons, especially to ensure a secure and stable internet presence, data is transmitted to us or to our web space provider via your internet browser. With these so-called server log files, among other things, the type and version of your internet browser, the operating system, the website from which you switched to our internet presence (referrer URL), the website(s) of our internet presence that you visit, the date and time of each access, as well as the IP address of the internet connection from which the use of our internet presence is made, are collected.
This data is temporarily stored, but not in conjunction with any other of your data.
This storage is based on the legal basis of Article 6 (1) lit. f) GDPR. Our legitimate interest lies in the improvement, stability, functionality, and security of our internet presence.
The data will be deleted after seven days at the latest, unless further storage is required for evidence purposes. Otherwise, the data are excluded from deletion until the incident is finally clarified, either in whole or in part.
Contract Execution
The data transmitted by you for the purpose of using our goods and/or services will be processed by us for the purpose of contract execution and are therefore necessary. Contract conclusion and execution are not possible without providing your data.
The legal basis for processing is Article 6 (1) lit. b) GDPR.
We delete the data after complete contract processing, but we must observe the tax and commercial law retention periods.
As part of the contract execution, we pass on your data to the transport company commissioned with the goods delivery or to the financial service provider, insofar as the transfer is necessary for the delivery of goods or for payment purposes.
The legal basis for the transfer of data is then Article 6 (1) lit. b) GDPR.
To promote our products and services and to communicate with interested parties or customers, we operate a company presence on the platform Facebook.
On this social media platform, we are jointly responsible with Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
The data protection officer of Facebook can be reached via a contact form:
https://www.facebook.com/help/contact/540977946302970
We have regulated the joint responsibility in an agreement regarding the respective obligations within the meaning of the GDPR. This agreement, from which the mutual obligations arise, can be found under the following link:
https://www.facebook.com/legal/terms/page_controller_addendum
The legal basis for the processing of personal data that takes place in this context and is subsequently reproduced is Article 6 (1) lit. f GDPR. Our legitimate interest lies in the analysis, communication, sales, and promotion of our products and services.
The legal basis may also be the user’s consent pursuant to Art. 6 (1) lit. a GDPR to the platform operator. The user can revoke this consent at any time for the future according to Art. 7 (3) GDPR by notifying the platform operator.
When our online presence on the Facebook platform is called up, data of the user (e.g., personal information, IP address, etc.) is processed by Facebook Ireland Ltd. as the operator of the platform in the EU.
This user data serves statistical information about the use of our company presence on Facebook. Facebook Ireland Ltd. uses this data for market research and advertising purposes and to create user profiles. Based on these profiles, Facebook Ireland Ltd. can, for example, advertise users inside and outside of Facebook based on their interests. If the user is logged into their account on Facebook at the time of the call, Facebook Ireland Ltd. can also link the data to the respective user account.
In the event of a user contacting us via Facebook, the personal data of the user entered on this occasion is used to process the request. The user’s data will be deleted by us once the user’s request has been finally answered and no legal retention obligations, such as in the case of subsequent contract execution, oppose deletion.
For the processing of data, cookies may also be set by Facebook Ireland Ltd.
If the user does not agree with this processing, there is the option to prevent the installation of cookies by setting the browser accordingly. Already stored cookies can also be deleted at any time. The settings for this depend on the respective browser. In the case of Flash cookies, processing cannot be prevented via the browser settings, but by the appropriate setting of the Flash player. If the user prevents or restricts the installation of cookies, this may result in not all functions of Facebook being fully usable.
More information on the processing activities, their prevention, and the deletion of the data processed by Facebook can be found in Facebook’s data policy:
https://www.facebook.com/privacy/explanation
It is not excluded that the processing by Meta Platforms Ireland Limited also takes place via Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025 in the USA.
YouTube
We maintain an online presence on YouTube to showcase our company and our services, and to communicate with customers and prospects. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA.
In this regard, we point out that there is a possibility that user data may be processed outside the European Union, particularly in the USA. This may pose increased risks for users in that, for example, later access to user data may be difficult. We also do not have access to this user data. The access possibility is exclusively with YouTube.
YouTube’s privacy policy can be found at
https://policies.google.com/privacy
General linking to profiles on third-party providers
The provider uses a link to the following social networks on the website.
The legal basis for this is Art. 6 para. 1 lit. f DSGVO. The provider’s legitimate interest lies in improving the quality of use of the website.
The integration of the plugins is done via a linked graphic. Only by clicking on the corresponding graphic is the user redirected to the service of the respective social network.
After the customer is redirected, the respective network collects information about the user. These are initially data such as IP address, date, time, and visited page. If the user is logged into his user account of the respective network at the same time, the network operator may possibly assign the collected information of the specific visit of the user to the user’s personal account. If the user interacts via a “Share” button of the respective network, this information can be stored in the user’s personal user account and possibly published. If the user wants to prevent the collected information from being directly assigned to his user account, the user must log out before clicking on the graphic. There is also the possibility to configure the respective user account accordingly.
The following social networks are linked by the provider:
facebook/Meta
Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Privacy policy: https://www.facebook.com/policy.php
We maintain an online presence on LinkedIn to present our company and our services and to communicate with customers/prospects. LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Irland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.
We would like to point out that this might cause user data to be processed outside the European Union, particularly in the United States. This may increase risks for users that, for example, may make subsequent access to the user data more difficult. We also do not have access to this user data. Access is only available to LinkedIn.
The LinkedIn privacy policy can be found here:
https://www.linkedin.com/legal/privacy-policy
Google Calendar
This site uses the Google Calendar service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
To use the features of Google Calendar, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence over this data transfer.
The use of Google Calendar is in the interest of an appealing presentation of our online offers and an easy findability of the dates and events we offer. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO.
You can find more information on how user data is handled in Google’s privacy policy, which can be accessed at this link: https://policies.google.com/privacy.
Social media links via graphics
We also integrate the following social media sites into our website. The integration takes place via a linked graphic of the respective site. The use of these graphics stored on our own servers prevents the automatic connection to the servers of these networks for their display. Only by clicking on the corresponding graphic will you be forwarded to the service of the respective social network.
Once you click, that network may record information about you and your visit to our site. It cannot be ruled out that such data will be processed in the United States.
Initially, this data includes such things as your IP address, the date and time of your visit, and the page visited. If you are logged into your user account on that network, however, the network operator might assign the information collected about your visit to our site to your personal account. If you interact by clicking Like, Share, etc., this information can be stored your personal user account and possibly posted on the respective network. To prevent this, you need to log out of your social media account before clicking on the graphic. The various social media networks also offer settings that you can configure accordingly.
The following social networks are integrated into our site by linked graphics:
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Irland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085 USA.
Privacy Policy: https://www.linkedin.com/legal/privacy-policy
Google Analytics
We use Google Analytics on our website. This is a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (hereinafter: Google).
The Google Analytics service is used to analyze how our website is used. The legal basis is Art. 6 Para. 1 lit. f) GDPR. Our legitimate interest lies in the analysis, optimization, and economic operation of our site.
Usage and user-related information, such as IP address, place, time, or frequency of your visits to our website will be transmitted to a Google server in the United States and stored there. However, we use Google Analytics with the so-called anonymization function, whereby Google truncates the IP address within the EU or the EEA before it is transmitted to the US.
The data collected in this way is in turn used by Google to provide us with an evaluation of visits to our website and what visitors do once there. This data can also be used to provide other services related to the use of our website and of the internet in general.
Google states that it will not connect your IP address to other data. In addition, Google provides further information with regard to its data protection practices at
https://www.google.com/intl/de/policies/privacy/partners,
including options you can exercise to prevent such use of your data.
In addition, Google offers an opt-out add-on at
https://tools.google.com/dlpage/gaoptout?hl=en
in addition with further information. This add-on can be installed on the most popular browsers and offers you further control over the data that Google collects when you visit our website. The add-on informs Google Analytics‘ JavaScript (ga.js) that no information about the website visit should be transmitted to Google Analytics. However, this does not prevent information from being transmitted to us or to other web analytics services we may use as detailed herein.
Google AdSense
We use Google AdSense on our website to integrate advertisements. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (hereinafter: Google).
Google AdSense stores cookies and web beacons on your device via your browser. This enables Google to analyze how you use our website. In addition to your IP address and the advertising formats displayed, the information thus collected will be transmitted to Google in the USA and stored there. Google may also share this information with third parties. Google states that it will not connect your IP address to other data.
In case you have granted your consent to this processing the legal basis is Article 6 para. 1 lit. a GDPR. The legal basis can also be Article 6 para. 1 lit. f GDPR. Our legitimate interest lies in the analysis, optimization, and economic operation of our site.
If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings in your browser. Further details can be found in the section about cookies above.
In addition, Google offers an opt-out add-on at
https://policies.google.com/privacy
https://adssettings.google.com/authenticated
in particular on options for preventing the use of data.
Google AdWords with Conversion Tracking
Our website uses Google AdWords and conversion tracking. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (hereinafter: Google).
We use conversion tracking to provide targeted promotion of our site. In case you have granted your consent to this processing the legal basis is Article 6 para. 1 lit. a GDPR. The legal basis can also be Article 6 para. 1 lit. f GDPR. Our legitimate interest lies in the analysis, optimization, and economic operation of our site.
If you click on an ad placed by Google, the conversion tracking we use stores a cookie on your device. These so-called conversion cookies expire after 30 days and do not otherwise identify you personally.
If the cookie is still valid and you visit a specific page of our website, both we and Google can evaluate that you clicked on one of our ads placed on Google and that you were then forwarded to our website.
The data collected in this way is in turn used by Google to provide us with an evaluation of visits to our website and what visitors do once there. In addition, we receive information about the number of users who clicked on our advertisement(s) as well as about the pages on our site that are subsequently visited. Neither we nor third parties who also use Google AdWords will be able to identify you from this conversion tracking.
You can also prevent or restrict the installation of cookies by making the appropriate settings in your browser. Likewise, you can use the browser to delete cookies that have already been stored. However, the steps and measures required vary, depending on the browser you use. If you have any questions, please use the help function or consult the documentation for your browser or contact its maker for support.
In addition, Google provides further information with regard to its data protection practices at
https://services.google.com/sitestats/de.html
https://www.google.com/policies/technologies/ads/
http://www.google.de/policies/privacy/
in particular information on how you can prevent the use of your data.
Google Remarketing or “Similar Audiences” component from Google
We use the Remarketing or “Similar Audiences” feature on our website. This is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as “Google.”
We use this feature to display interest-based, personalized advertising on third-party websites that also participate in Google’s advertising network.
If you have given your consent to this processing, the legal basis is Art. 6 para. 1 lit. a DSGVO. The legal basis can also be Art. 6 para. 1 lit. f DSGVO. Our legitimate interest lies in the analysis, optimization, and economic operation of our website.
To enable this advertising service, Google stores a cookie with a sequence of numbers on your device via your internet browser during your visit to our website. This cookie collects your visit and the use of our website in an anonymized form. However, personal data is not passed on. If you subsequently visit a third-party website that also uses Google’s advertising network, advertisements may appear that relate to our website or our offers there.
For permanent deactivation of this function, Google offers a browser plugin for the most common internet browsers at
https://www.google.com/settings/ads/plugin
Also, the use of cookies from certain providers can be deactivated by opt-out, for example, through
http://www.youronlinechoices.com/uk/your-ad-choices
or
http://www.networkadvertising.org/choices/
Through so-called cross-device marketing, Google may track your usage behavior across multiple devices, so that you may still see interest-based, personalized advertising, even if you change the device. However, this requires that you have agreed to link your browser histories with your existing Google account.
Google provides further information on Google Remarketing at
https://www.google.com/privacy/ads/
Newsletter via WhatsApp
You can also receive our free newsletter via the instant messaging service WhatsApp. WhatsApp is a service of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of WhatsApp Inc., 1601 Willow Road, Menlo Park, California 94025, USA, both hereinafter referred to as “WhatsApp”. Some of the processing of user data is carried out on WhatsApp servers in the USA. WhatsApp also offers further privacy information at
https://www.whatsapp.com/legal/#privacy-policy
To be able to receive our newsletter via WhatsApp, you need a WhatsApp user account. Details of what data WhatsApp collects during registration can be found in the aforementioned privacy information from WhatsApp.
If you then sign up for our newsletter distribution via WhatsApp, the mobile phone number you entered during the registration process is processed by WhatsApp. In addition, your IP address and the date of your registration along with the time are stored. During the further registration process, your consent to the sending of the newsletter is obtained, the content is described in concrete terms, and reference is made to this privacy policy.
The legal basis for sending the newsletter and the analysis is Art. 6 para. 1 lit. a.) DSGVO.
You can revoke your consent to the newsletter dispatch at any time with effect for the future according to Art. 7 para. 3 DSGVO. To do this, you just need to inform us about your revocation. You can also block the receipt of the newsletter by setting it in the WhatsApp software on your device.
WhatsApp Contact
The provider offers the customer, among other things, the possibility of contacting via the messenger service WhatsApp. WhatsApp is a service of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, hereafter WhatsApp, a subsidiary of Facebook.
Through the user’s communication with the provider via WhatsApp, both the provider and WhatsApp receive the user’s mobile phone number and the information that the user has contacted the provider.
The aforementioned data is also forwarded by WhatsApp to servers of Facebook in the USA and processed by WhatsApp and Facebook according to the WhatsApp privacy policy, which also includes processing for their own purposes, such as improving the WhatsApp service.
Currently, according to the data protection supervisory authorities, the USA does not have an adequate level of data protection. However, there are so-called standard contractual clauses:
https://faq.whatsapp.com/general/about-standard-contractual-clauses
However, these are private law agreements and therefore do not have a direct impact on the access possibilities of the authorities in the USA.
Further details on the purpose and scope of data collection and the further processing of this data by WhatsApp and Facebook, as well as related rights and setting options for protecting privacy, are included in the WhatsApp privacy policy:
https://www.whatsapp.com/legal/#privacy-policy.
The legal basis for these processing and the transmission to WhatsApp is Art. 6 para. 1 sentence 1 b. DSGVO, insofar as the contact is related to an existing contractual relationship or serves to initiate such a contractual relationship. If the contact is not made for the aforementioned purposes, the legal basis is Art. 6 para. 1 lit. f DSGVO. The legitimate interest of the provider lies in improving the quality of service.
Model Data Protection Statement from Anwaltskanzlei Weiß & Partner
https://www.xn--generator-datenschutzerklrung-pqc.de/
https://www.ratgeberrecht.eu/datenschutz/datenschutzerklaerung-generator-dsgvo.html