Privacy Policy

Version: September 2026

1. General Information

Introduction

We appreciate your interest in our website. Protecting your personal data is important to us. Below, we explain what data we process when you visit our website, for what purpose this is done, and what rights you have in this regard.

Data processing is always carried out in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection regulations (in particular the BDSG and TDDDG). In general, our website can be used without providing personal data; however, certain functions—such as contacting us or submitting a job application—require data processing. If there is no legal basis for this, we will obtain your consent.

Data Controller

The data controller within the meaning of the GDPR is:

CPTx GmbH
Semmelweisstr. 1
82152 Planegg, Germany

Represented by: Dr. Christian Sigl and Prof. Dr. Hendrik Dietz

Data Protection Officer

If you have any questions or suggestions regarding data protection, you can contact our Data Protection Officer as follows:

Stephan Krischke, datenschutz@cptx.bio

Definitions

This Privacy Policy uses the terms of the GDPR, including “personal data,” “processing,” “controller,” “processor,” and “consent,” as legally defined in Article 4 of the GDPR. A detailed explanation of these terms can be found in the text of the GDPR.

Your Rights as a Data Subject

Subject to the statutory requirements, you have the following rights: the right to access the personal data stored about you (Article 15 of the GDPR), the right to rectification of inaccurate data (Article 16 of the GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing based on a balancing of interests, in particular to processing for direct marketing purposes (Art. 21 GDPR). You may revoke any consent you have given at any time with future effect.

You also have the right to lodge a complaint with a data protection supervisory authority.

Legal Bases for Processing

We process personal data on the following legal bases: with your consent (Art. 6(1)(a) GDPR in conjunction with § 25 TDDDG), to fulfill or initiate a contract or employment relationship (Art. 6(1)(b) GDPR, § 26 BDSG), to comply with legal obligations (Art. 6(1)(c) GDPR), and to protect legitimate interests (Art. 6(1)(f) GDPR), provided that your interests do not override these in individual cases.

Our services are intended for adults. Persons under the age of 16 may not provide us with any personal data without the consent of their legal guardians.

Disclosure of Data to Third Parties

Your data will only be disclosed to third parties to the extent permitted by law, if you have given your consent, if it is necessary for the performance of a contract, or if we have a legitimate interest in doing so. In connection with the services described below, data may also be transferred to countries outside the EU/EEA, in particular to the United States. To the extent possible, we base such transfers on an adequacy decision by the European Commission (e.g., the EU-U.S. Data Privacy Framework) or on EU Standard Contractual Clauses pursuant to Article 46 of the GDPR.

Retention Period and Deletion

We store personal data only for as long as is necessary for the respective processing purpose or as required by statutory retention obligations. If the purpose for storage no longer applies or a statutory retention period expires, the relevant data is routinely deleted or blocked.

2. Technology

Hosting

Our website is hosted by an external service provider. When you visit our website, your data (including your IP address in server log files) is processed on that provider’s servers.

The legal basis is our legitimate interest in the reliable, secure, and high-performance provision of our website (Art. 6(1)(f) GDPR).

Content Delivery Network (Cloudflare)

Our website is front-ended by Cloudflare’s Content Delivery Network, which accelerates the delivery of our content and protects the website from automated attacks. The provider is Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C – 8th Floor, 81671 Munich, Germany (parent company: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). In this process, technical connection data such as your IP address, as well as browser and device information, are processed; in addition, cookies are set for bot detection and access control (including __cf_bm and cf_clearance).

The legal basis is our legitimate interest in providing our website in a high-performance and secure manner (Art. 6(1)(f) GDPR) or, to the extent that cookies not strictly necessary for this purpose are set, your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.

Further information: https://www.cloudflare.com/de-de/privacypolicy/

Server Log Files

Every time you visit our website, our system automatically collects data transmitted by your browser: browser type and version, operating system used, referrer URL, subpages accessed, date and time of access, and IP address. This data is used to ensure the website functions without technical errors, to secure the website, and, if necessary, for law enforcement purposes in the event of a cyberattack. This data cannot be used to identify you personally; the log file data is stored separately from other data.

The legal basis is our legitimate interest in system security and stability (Art. 6(1)(f) GDPR).

Content Management System (WordPress)

We operate our website using the open-source software WordPress, which is installed on our own web space (self-hosting). No visitor data is transmitted to the software manufacturer Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland (parent company: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA) does not take place, as we do not use any Automattic services (e.g., Jetpack statistics). For technical operation, only strictly necessary cookies are set (e.g., session cookies).

The legal basis is our legitimate interest in ensuring the website functions properly and securely (Art. 6(1)(f) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.

Further information: https://automattic.com/de/privacy/

Cookies and Consent Management

Cookies are small files that your browser stores on your device. We use technically necessary cookies to enable the operation of our website, as well as—with your consent—additional cookies to improve user-friendliness and for analysis.

To obtain and document your consent, we use the “CookieYes” cookie consent tool. The provider is CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. Among other things, your consent(s) or their revocation, your IP address, and the time of your visit are processed and stored in a cookie on your device (cookieyes-consent).

The legal basis for technically necessary cookies is Article 6(1)(f) of the GDPR; for all other cookies, it is your consent pursuant to Article 6(1)(a) of the GDPR. The collection of consent itself is carried out to fulfill our legal obligation under Article 7 of the GDPR in conjunction with Section 25 of the TDDDG. For the United Kingdom, there is an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, ensuring an adequate level of data protection. You may revoke your consent at any time with future effect via the cookie banner.

You can also delete cookies or restrict their storage at any time via your browser settings (e.g., via the help pages for Chrome, Safari, Firefox, or Microsoft Edge).

Further information: https://www.cookieyes.com/privacy-policy/

3. Additional Content

Contact Form

When you contact us via our contact form, we process the data you provide (e.g., name, email address, inquiry) solely for the purpose of handling your request. Required fields are marked as such; additional information is provided voluntarily.

The legal basis is our legitimate interest in responding to your inquiry (Art. 6(1)(f) GDPR) or, if your inquiry is aimed at entering into a contract, Art. 6(1)(b) GDPR. Your data will be deleted as soon as your inquiry has been fully processed and there are no legal retention requirements to the contrary.

Handling of Applicant Data

We collect and process the personal data of job applicants. Such data processing may also take place electronically, for example, when applicants submit their application materials to us via email or through a web form on our website.

We use the applicant tracking system “Personio” to manage and conduct our hiring processes. The provider is Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany. Your application data is stored on servers within the EU and processed exclusively for the purpose of handling the application process.

Your data will only be stored in an applicant database beyond the scope of the current application process if you have given us your separate consent to do so.

The legal basis for the processing of your personal data in this application process is primarily Article 6(1)(b) of the GDPR in conjunction with Section 26(1) of the BDSG. According to these provisions, the processing of data necessary in connection with the decision regarding the establishment of an employment relationship is permitted. If special categories of personal data within the meaning of Article 9 of the GDPR are processed (e.g., health data), the legal basis is Section 26(3) of the BDSG or Article 9(2)(b) of the GDPR. In the event that your application documents are disclosed to third parties or your data is stored beyond the scope of the current application process, the processing is based on Article 6(1), first sentence, subparagraph (a) of the GDPR in conjunction with Section 26(2) of the BDSG. There is no legal or contractual obligation to provide your data; however, processing your application is not possible without the provision of this information.

Data from applicants will be deleted 6 months after a rejection. If you have consented to the continued storage of your personal data, we will transfer your data to our applicant pool. There, the data will be deleted after 24 months.

Further information: https://www.personio.de/datenschutzerklaerung/

4. Plug-ins and Services

Google Tag Manager

We use Google Tag Manager to centrally manage various analytics and marketing tags on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a company of the Google Group (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Tag Manager itself does not set any cookies, but it transmits data to Google and may load additional services that, in turn, process data.

The legal basis is your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.

Further information: https://policies.google.com/privacy?hl=de

Google Analytics

We use the web analytics service Google Analytics to evaluate the use of our website and improve our offerings. The provider is Google Ireland Limited (see above for address, “Google Tag Manager”). In the process, cookies are set (including _ga) and usage data such as pages visited, duration of visit, approximate location, and browser and device information are processed; the IP address is truncated. Google may also analyze this data for its own purposes and combine it into usage profiles.

The legal basis is your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place. You may revoke your consent at any time with future effect via the cookie banner.

Further information: https://policies.google.com/privacy?hl=de

5. Social Media Presence

To enable us to communicate with you via social media and keep you informed about our company, we maintain our own profiles on these platforms. When you visit one of these profiles, we are jointly responsible with the respective platform provider for the processing operations triggered thereby, within the meaning of Article 26 of the GDPR; we are not the original provider of these pages, but merely use them within the scope of the options offered by the providers.

As a precaution, we would like to point out that your data may also be processed outside the EU/EEA and that the providers regularly analyze usage behavior for their own advertising or analytical purposes without us having any influence over this. Since we do not have access to the providers’ data sets, we recommend that you exercise rights such as the right to access, rectification, or erasure directly with the respective provider.

LinkedIn

The (joint) controller for data processing in Europe is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA).

The legal basis is our legitimate interest in maintaining up-to-date communication with you, as well as the provider’s legitimate interest (Art. 6(1)(f) GDPR). If you are required to provide separate consent to LinkedIn, the legal basis in this regard is Art. 6(1)(a) GDPR in conjunction with Art. 7 GDPR. The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Article 45 of the GDPR is in place.

Further information: https://www.linkedin.com/legal/privacy-policy