Last updated: 17 September 2026 (translation of the German original, see notice below)
The controller within the meaning of the General Data Protection Regulation (GDPR) is Ludwig Wagner, GAP Optimizer, Brahestraße 38, 10589 Berlin, Germany, email: [email protected]. Further details can be found in the legal notice.
We process in particular the following categories of data, each explained in more detail in the following sections:
For registration we collect your name, email address and a password of your choosing, which is stored exclusively as a hash value, as well as, optionally, the name of your advisory firm. When logging in, we check your email address and password. For password resets, we send a time-limited link by email (see Section 6).
Retention period: until your account is deleted (see Section 12). Legal basis: Art. 6(1)(b) GDPR (performance of the terms-of-use contract).
The farm, field, crop and measure data you enter, along with the calculations and review reports generated from them, are stored so that you can view, compare and document your plans. This data is used exclusively for your own account or, for advisers, for the farms you manage.
Retention period: until your account, or the individual plan, is deleted. Legal basis: Art. 6(1)(b) GDPR.
When importing land data, the uploaded file is used exclusively for processing in a temporary file and is then automatically deleted, regardless of whether the import was successful. The preview generated from it is stored as preliminary data so that you can review it before accepting it.
If you confirm the preview, the data becomes part of your regular farm data (see Section 4). If you discard the preview, the preliminary data is deleted immediately. An unconfirmed preview can no longer be accepted once the displayed validity window has expired; the underlying data is then deleted on request. Legal basis: Art. 6(1)(b) GDPR.
Messages via the contact form and via the internal message area are stored in order to process and answer your request. When using the contact form, your name and email address are transmitted together with your message.
To send emails (for example, password-reset links), we use the service provider MailerSend. In doing so, the recipient address, subject and content of the email are transmitted to MailerSend.
Retention period: internal account messages until the relevant account is deleted. Contact-form requests are deleted on request. Legal basis: Art. 6(1)(b) GDPR (processing your request) or Art. 6(1)(f) GDPR (technical email dispatch).
Advisers can upload their own firm logo, which is then displayed in their review reports. The logo is technically checked (permitted format, size limit) and stored as an image file in your account.
Retention period: until the logo is deleted or replaced, or until your account is deleted. Legal basis: Art. 6(1)(b) GDPR.
We use exclusively a technically necessary session cookie to keep you logged in during your visit. It is deleted as soon as you close your browser or log out. We do not use any further cookies, in particular not for marketing or tracking purposes.
Legal basis: § 25(2) no. 2 TDDDG (German Telecommunications and Digital Services Data Protection Act — technically strictly necessary to provide the service you expressly requested) as well as Art. 6(1)(b) GDPR.
If the destination URL of an ad click contains the parameter "gclid" (Google Click ID), we read this value when the page is accessed and carry it, during your visit, within this same, already-described session cookie — no additional cookie is set for this purpose. If you register, we store the gclid together with the timestamp on your account in order to match registrations to the advertisement previously clicked; no disclosure to third parties takes place in the course of this collection itself. For the purpose of measuring advertising effectiveness, we transmit the stored gclid values together with the timestamp of registration, at irregular intervals, to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that the registration can be matched there to the ad that triggered it. Only the gclid, the timestamp and a fixed numeric value are transmitted; your name, email address and business data are not transmitted. Google Ireland Limited may transfer data to Google LLC in the USA; this is based on the EU Standard Contractual Clauses under Art. 46 GDPR entered into by Google. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our advertising).
To provide our services securely, we record technical usage data on page views. This includes the page accessed, the time, information about the browser and device used, and a pseudonymized identifier. For logged-in users, the page view can be linked to the user account.
We use this data to detect technical errors and abusive access, and to evaluate the use of our features. This data is not used for personalized advertising and is not sold. The data is automatically deleted after the periods stated below.
Specifically: your IP address is hashed with SHA-256 without an additional salt before storage and truncated to 16 characters. This is pseudonymization, not anonymization, since repeated visits from the same address remain recognizable within our system. This technical log data is automatically deleted after 90 days at the latest; the deletion is technically executed each time our internal analytics area is accessed.
In the event of technical errors, the service Sentry may additionally be used for error diagnostics, provided it is activated on the relevant server; as a rule, no cookies or IP addresses are automatically collected by it. For a single, older import path, your internal user identifier is additionally transmitted to Sentry in the event of an error. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical security and further development).
We do not pass on your data to third parties for our own advertising purposes. However, the following service providers are technically involved as recipients or processors in operating this application:
Data processing agreements pursuant to Art. 28 GDPR are in place, or will be concluded before any corresponding use, with all processors. Fonts and the program libraries used are delivered from our own server; accessing the page therefore does not establish any separate connection to a further third-party provider.
We aim to process your data within the European Union or the European Economic Area. Should a service provider we use exceptionally also process data outside the EU or the EEA, we ensure that the data-protection safeguards required by law are in place, in particular EU standard contractual clauses pursuant to Art. 46 GDPR or an adequacy decision of the European Commission. Further details on the respective service provider are available on request via the contact details given in the legal notice.
Unless stated otherwise in the sections above, the following applies:
If you delete your account entirely (see the account area), your account data, farms, calculations and messages are irrevocably removed. Pseudonymized technical log data already generated before the account deletion is deleted independently of this, after the period stated in Section 9.
Depending on the purpose, processing is based on Art. 6(1)(b) GDPR (performance of the terms-of-use contract, in particular account, farm data, calculations, review reports, imports, white-label content), Art. 6(1)(f) GDPR (legitimate interest in technical security, error diagnostics and product analysis), and § 25(2) no. 2 TDDDG (technically necessary cookies). Optional, voluntary consents (for example, for the newsletter) are based on Art. 6(1)(a) GDPR and can be withdrawn at any time with effect for the future.
This also includes the optional reminder for the 2027 claim season offered at registration: if you tick the corresponding checkbox, we notify you by email as soon as the rules and amounts for the 2027 claim year are available in GAP-Optimizer. Participation is voluntary and not a precondition for registration; you can withdraw the reminder at any time in your account settings. The legal basis is Art. 6(1)(a) GDPR. We store the time of your consent and an identifier of the consent text shown to you, as evidence of the wording you agreed to.
Providing your name, email address and password on registration, as well as the farm and land data required for the calculation, is necessary in order to use GAP Optimizer. Without this information, we cannot provide the respective service. All other information, in particular advisory firm, white-label logo and newsletter sign-up, is voluntary.
We do not use any processing based solely on automated means, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). The results calculated by GAP-Optimizer are professional decision support; the decision on granting funding is made exclusively by the competent authority.
You have the right to:
Please direct requests to: [email protected]
You have the right to lodge a complaint with a data-protection supervisory authority. The competent authority for our registered office in Berlin is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Farms and advisers can, without registration and without a password, voluntarily provide a real-world case for the professional quality assurance and regression testing of GAP-Optimizer. Providing such data is voluntary and is not a prerequisite for using GAP-Optimizer. The sole recipient is the controller (see Section 1); the technical service providers named in Section 10 are involved as with any other page view — no separate, dedicated processor is used for the uploaded files (see below).
The following data is processed: your email address (required), optionally your name and your farm (both voluntary), the dataset type you selected, the files you upload together with a sanitized version of the original filename, file size and SHA-256 checksum per file, an automatically generated reference number, the time of receipt, and a salted, truncated hash of your IP address, using a secret key.
By submitting the form, you expressly consent to the data you provide being used for professional quality assurance. This is distinct from possible free access to the features of claim year 2027: this access does not arise from submission itself, but only after a separate, explicit acceptance by the operator, and requires suitability and sufficient completeness of the dataset. Submitting a request alone does not create an entitlement. Both matters — consent to data use and possible access in 2027 — are documented separately for the respective submission. A documented approval is purely an internal administrative matter and does not automatically link your submission to any future user account; an actual activation of features, should it occur, would be carried out separately and manually.
Retention period: we delete a submission that has not yet been decided (status "new" or "under review") no later than 180 days after receipt, unless a decision has been made by then. We delete a submission classified as unsuitable or rejected no later than 60 days after that decision. An accepted submission is not subject to a fixed deletion period; it is retained for the duration of its actual professional use for quality assurance. Complete deletion by us remains possible at any time in addition.
Upon deletion — after the stated period has expired, at your request, or initiated by us — the uploaded files and their file metadata are completely removed; name, farm, any internal note and the IP hash on the submission are cleared. Your email address is replaced with a fixed, technically undeliverable placeholder value. Only the reference number, the dataset type, the time of receipt, and a log entry recording that and when the deletion took place are retained — as evidence, without allowing the deleted content to be reconstructed. On its own, without access to the otherwise deleted or cleared information, the reference number can then no longer be attributed to a specific person.
Uploaded files are technically checked before acceptance for permitted format and actual file type; no automatic malware or virus scan takes place. The files are never automatically executed, embedded or rendered server-side; access is possible only as a deliberate, individual action by an administrator. The files do not leave our server — no external processor is used for the uploads.
After submission, you do not receive an automatic confirmation email. Your reference number is shown only once, on the confirmation page — please make a note of it.
The data-subject rights named in Section 16 apply unchanged to you as the sender of a real-world-data submission, as soon as you are identifiable via your stated email address — in particular the right to erasure (Art. 17 GDPR) on request via the contact details given in the legal notice.
Legal basis: for the substantive processing of your dataset, Art. 6(1)(a) GDPR (your express consent); for the technical IP hash, additionally Art. 6(1)(f) GDPR (legitimate interest in detecting misuse, comparable to Section 9).
This privacy policy is dated 17 September 2026. We update it whenever data processing, the service providers used, or legal requirements change. The current version is always available on this page.