Privacy Notice for ultido.com — versions

Every change to the text creates a new version with its own checksum. This list shows which text applied when.

Full texts of early working versions containing internal review notes are available on request from max@ultido.com; their checksum is shown in the list.

Version 6.2.0 · as of 28.09.2026

Checksum: sha256-01586385f100658c18bfb0c55b26073cfd38a92efa7461d80d9c2bf1d57983b3

1. Controller

ULTIDO GmbH, Rommerskirchener Straße 21, 50259 Pulheim, Germany, represented by Managing Director Maximilian Lucas Arbeiter. Local Court of Cologne, HRB 128940. Email: max@ultido.com · Phone: +49 221 16535560. Data Protection Officer: Maximilian Lucas Arbeiter, max@ultido.com.

2. Hosting (Framer)

This website is provided by Framer B.V. (Netherlands); content is delivered via the Framer CDN (framerusercontent.com). On each request the host processes technically necessary data (IP address, timestamp, requested resource, user agent, referrer) in server logs. Legal basis: Art. 6(1)(f) (legitimate interest in secure, performant delivery). Framer engages its own sub-processors – for delivery essentially AWS, Google Cloud and Cloudflare, all processing in the USA. Framer maintains the full, continuously updated list in its Trust Center (trust.framer.com). Fonts are also delivered through the Framer CDN; no connection is made to any external font provider. A data processing agreement is in place (Framer Data Processing Addendum version 2.0 of 16 June 2026), incorporated by reference into the Terms of Service. Third-country transfers rely on an adequacy decision or the EU-US Data Privacy Framework where the recipient is certified, otherwise on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Modules 2 and 3).

3. Cookies and consent management

Cookies and storage access that are not strictly necessary are used only with your consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR). Strictly necessary access relies on § 25(2) TDDDG. Consent is managed through CCM19 (Papoo Software & Media GmbH, Germany). Nothing requiring consent loads before your decision. You can change or withdraw your choice at any time via "Cookie Settings" in the footer; withdrawal is as easy as giving consent (Art. 7(3)). As at 22 September 2026 we set no consent-requiring cookies and embed no consent-requiring services; the consent banner is in place but currently has nothing to unlock. Details and the cookie table: Cookie Policy.

4. No reach measurement

We use no analytics or tracking tool – no Google Analytics, no Google Tag Manager, no statistics or marketing cookies. The reach measurement that our host Framer includes by default has been technically disabled on this website: its measurement script is not executed and sends no data. Your browser may still fetch the script file from Framer when a page loads; this involves only the connection data that arises whenever the website is delivered (§ 2).

5. Embedded media (Cloudinary)

Product and demo videos and website images are delivered via Cloudinary. Loading a media asset transmits your IP address to the delivering host, where technically necessary connection data (timestamp, requested resource, user agent) is processed. Legal basis: Art. 6(1)(f) (legitimate interest in performant media delivery). Media are served from the Cloudinary tenant of SnapNext GmbH + Co. KG, which acts as our processor for this purpose; an Art. 28 GDPR agreement is in place with SnapNext that covers Cloudinary as a further processor. Processing takes place in the EU. This applies to the ultido.com website only, not to the guest applications of the parks.

6. Contact (form, email)

When you contact us we process the data you provide (name, email, company, message) to handle your enquiry. Legal basis: Art. 6(1)(b) (pre-contractual) or Art. 6(1)(f). Form data is captured via Framer Forms (Framer B.V., Netherlands) and forwarded to our mailbox; no separate form or booking tool is embedded. Appointment requests are handled by email to hey@ultido.com. Our email runs on Google Workspace (Google Ireland Limited / Google LLC – EU-US DPF and SCCs; the tenant is operated by SnapNext GmbH + Co. KG as a processor, with a dedicated Ultido organisational unit). Retention: enquiries are deleted once handled, at the latest after 12 months, subject to statutory retention.

7. Recipients

Processors and recipients for this website: Framer (hosting, form delivery), SnapNext GmbH + Co. KG (media delivery via its Cloudinary tenant, EU), Google Ireland Limited / Google LLC (Google Workspace for our email only). No analytics or tag management services, no external font providers. The sub-processors of the platform – a different set – are listed in the Subprocessor Register.

8. International transfers

Where the providers named above process data in third countries (in particular the USA), this is based on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and/or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Copies of the safeguards are available on request.

9. Your rights

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) – in particular against processing based on Art. 6(1)(f); withdrawal of consent (Art. 7(3)) at any time, for example via the cookie settings. Requests: max@ultido.com. You may lodge a complaint with a supervisory authority, for example the LDI NRW (North Rhine-Westphalia).

10. Retention

Server logs: Framer states no fixed retention period in its data processing agreement; it processes for the term of the agreement and deletes on written instruction (DPA 2.0, Annex I.5 and clause 10.1). We therefore give no figure. Contact enquiries: see § 6; cookies: per the Cookie Policy; statutory periods otherwise.

11. Changes

The published version, with its version number and date at the end of the page, governs. The change history is there as well.

Version 6.1.2 · as of 26.09.2026

Checksum: sha256-dbb18c4f64c943cef5c558b05454b301315e3ce73409c9027d381dcd3a3b8665

1. Controller

ULTIDO GmbH, Rommerskirchener Straße 21, 50259 Pulheim, Germany, represented by Managing Director Maximilian Lucas Arbeiter. Local Court of Cologne, HRB 128940. Email: max@ultido.com · Phone: +49 221 16535560. Data Protection Officer: Maximilian Lucas Arbeiter, max@ultido.com.

2. Hosting (Framer)

This website is provided by Framer B.V. (Netherlands); content is delivered via the Framer CDN (framerusercontent.com). On each request the host processes technically necessary data (IP address, timestamp, requested resource, user agent, referrer) in server logs. Legal basis: Art. 6(1)(f) (legitimate interest in secure, performant delivery). Framer engages its own sub-processors – for delivery essentially AWS, Google Cloud and Cloudflare, all processing in the USA. Framer maintains the full, continuously updated list in its Trust Center (trust.framer.com). Fonts are also delivered through the Framer CDN; no connection is made to any external font provider. A data processing agreement is in place (Framer Data Processing Addendum version 2.0 of 16 June 2026), incorporated by reference into the Terms of Service. Third-country transfers rely on an adequacy decision or the EU-US Data Privacy Framework where the recipient is certified, otherwise on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Modules 2 and 3).

3. Cookies and consent management

Cookies and storage access that are not strictly necessary are used only with your consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR). Strictly necessary access relies on § 25(2) TDDDG. Consent is managed through CCM19 (Papoo Software & Media GmbH, Germany). Nothing requiring consent loads before your decision. You can change or withdraw your choice at any time via "Cookie Settings" in the footer; withdrawal is as easy as giving consent (Art. 7(3)). As at 22 September 2026 we set no consent-requiring cookies and embed no consent-requiring services; the consent banner is in place but currently has nothing to unlock. Details and the cookie table: Cookie Policy.

4. Reach measurement

No Google Analytics, no Google Tag Manager, no comparable third-party tool. No statistics or marketing cookies are set and no data is passed to third parties for analytics.

Our host Framer measures reach with its own cookieless function. On page load a script is fetched from events.framer.com and reports the page view. Processed are the page requested, referrer, approximate origin, device and browser. Nothing is stored on your device and nothing is read from it – no cookies, no local storage. IP address and user agent are hashed with a daily rotating salt before evaluation, so no persistent identifier is created. Legal basis: Art. 6(1)(f) (legitimate interest in aggregate reach measurement). You may object under Art. 21 GDPR: max@ultido.com.

5. Embedded media (Cloudinary)

Product and demo videos and website images are delivered via Cloudinary. Loading a media asset transmits your IP address to the delivering host, where technically necessary connection data (timestamp, requested resource, user agent) is processed. Legal basis: Art. 6(1)(f) (legitimate interest in performant media delivery). Media are served from the Cloudinary tenant of SnapNext GmbH + Co. KG, which acts as our processor for this purpose; an Art. 28 GDPR agreement is in place with SnapNext that covers Cloudinary as a further processor. Processing takes place in the EU. This applies to the ultido.com website only, not to the guest applications of the parks.

6. Contact (form, email)

When you contact us we process the data you provide (name, email, company, message) to handle your enquiry. Legal basis: Art. 6(1)(b) (pre-contractual) or Art. 6(1)(f). Form data is captured via Framer Forms (Framer B.V., Netherlands) and forwarded to our mailbox; no separate form or booking tool is embedded. Appointment requests are handled by email to hey@ultido.com. Our email runs on Google Workspace (Google Ireland Limited / Google LLC – EU-US DPF and SCCs; the tenant is operated by SnapNext GmbH + Co. KG as a processor, with a dedicated Ultido organisational unit). Retention: enquiries are deleted once handled, at the latest after 12 months, subject to statutory retention.

7. Recipients

Processors and recipients for this website: Framer (hosting, form delivery, cookieless reach measurement), SnapNext GmbH + Co. KG (media delivery via its Cloudinary tenant, EU), Google Ireland Limited / Google LLC (Google Workspace for our email only). No analytics or tag management services, no external font providers. The sub-processors of the platform – a different set – are listed in the Subprocessor Register.

8. International transfers

Where the providers named above process data in third countries (in particular the USA), this is based on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and/or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Copies of the safeguards are available on request.

9. Your rights

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) – in particular against processing based on Art. 6(1)(f); withdrawal of consent (Art. 7(3)) at any time, for example via the cookie settings. Requests: max@ultido.com. You may lodge a complaint with a supervisory authority, for example the LDI NRW (North Rhine-Westphalia).

10. Retention

Server logs: Framer states no fixed retention period in its data processing agreement; it processes for the term of the agreement and deletes on written instruction (DPA 2.0, Annex I.5 and clause 10.1). We therefore give no figure. Contact enquiries: see § 6; cookies: per the Cookie Policy; statutory periods otherwise.

11. Changes

The published version, with its version number and date at the end of the page, governs. The change history is there as well.

Version 6.1.1 · as of 25.09.2026

Checksum: sha256-5f3116548cde6ec8a56f7ba6b3c91963e7be6f74ad1a1d53bb015d4975a9f77b

1. Controller

ULTIDO GmbH, Rommerskirchener Straße 21, 50259 Pulheim, Germany, represented by Managing Director Maximilian Lucas Arbeiter. Local Court of Cologne, HRB 128940. Email: max@ultido.com · Phone: +49 221 16535560. Data Protection Officer: Maximilian Lucas Arbeiter, max@ultido.com.

2. Hosting (Framer)

This website is provided by Framer B.V. (Netherlands); content is delivered via the Framer CDN (framerusercontent.com). On each request the host processes technically necessary data (IP address, timestamp, requested resource, user agent, referrer) in server logs. Legal basis: Art. 6(1)(f) (legitimate interest in secure, performant delivery). Framer engages its own sub-processors – for delivery essentially AWS, Google Cloud and Cloudflare, all processing in the USA. Framer maintains the full, continuously updated list in its Trust Center (trust.framer.com). Fonts are also delivered through the Framer CDN; no connection is made to any external font provider. A data processing agreement is in place (Framer Data Processing Addendum version 2.0 of 16 June 2026), incorporated by reference into the Terms of Service. Third-country transfers rely on an adequacy decision or the EU-US Data Privacy Framework where the recipient is certified, otherwise on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Modules 2 and 3).

3. Cookies and consent management

Cookies and storage access that are not strictly necessary are used only with your consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR). Strictly necessary access relies on § 25(2) TDDDG. Consent is managed through CCM19 (Papoo Software & Media GmbH, Germany). Nothing requiring consent loads before your decision. You can change or withdraw your choice at any time via "Cookie Settings" in the footer; withdrawal is as easy as giving consent (Art. 7(3)). As at 22 September 2026 we set no consent-requiring cookies and embed no consent-requiring services; the consent banner is in place but currently has nothing to unlock. Details and the cookie table: Cookie Policy.

4. Reach measurement

No Google Analytics, no Google Tag Manager, no comparable third-party tool. No statistics or marketing cookies are set and no data is passed to third parties for analytics.

Our host Framer measures reach with its own cookieless function. On page load a script is fetched from events.framer.com and reports the page view. Processed are the page requested, referrer, approximate origin, device and browser. Nothing is stored on your device and nothing is read from it – no cookies, no local storage. IP address and user agent are hashed with a daily rotating salt before evaluation, so no persistent identifier is created. Legal basis: Art. 6(1)(f) (legitimate interest in aggregate reach measurement). You may object under Art. 21 GDPR: max@ultido.com.

5. Embedded media (Cloudinary)

Product and demo videos and website images are delivered via Cloudinary. Loading a media asset transmits your IP address to the delivering host, where technically necessary connection data (timestamp, requested resource, user agent) is processed. Legal basis: Art. 6(1)(f) (legitimate interest in performant media delivery). Media are served from the Cloudinary tenant of SnapNext GmbH + Co. KG, which acts as our processor for this purpose; an Art. 28 GDPR agreement is in place with SnapNext that covers Cloudinary as a further processor. Processing takes place in the EU. This applies to the ultido.com website only, not to the guest applications of the parks.

6. Contact (form, email)

When you contact us we process the data you provide (name, email, company, message) to handle your enquiry. Legal basis: Art. 6(1)(b) (pre-contractual) or Art. 6(1)(f). Form data is captured via Framer Forms (Framer B.V., Netherlands) and forwarded to our mailbox; no separate form or booking tool is embedded. Appointment requests are handled by email to hey@ultido.com. Our email runs on Google Workspace (Google Ireland Limited / Google LLC – EU-US DPF and SCCs; the tenant is operated by SnapNext GmbH + Co. KG as a processor, with a dedicated Ultido organisational unit). Retention: enquiries are deleted once handled, at the latest after 12 months, subject to statutory retention.

7. Recipients

Processors and recipients for this website: Framer (hosting, form delivery, cookieless reach measurement), SnapNext GmbH + Co. KG (media delivery via its Cloudinary tenant, EU), Google Ireland Limited / Google LLC (Google Workspace for our email only). No analytics or tag management services, no external font providers. The sub-processors of the platform – a different set – are listed in the Subprocessor Register.

8. International transfers

Where the providers named above process data in third countries (in particular the USA), this is based on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and/or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Copies of the safeguards are available on request.

9. Your rights

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) – in particular against processing based on Art. 6(1)(f); withdrawal of consent (Art. 7(3)) at any time, for example via the cookie settings. Requests: max@ultido.com. You may lodge a complaint with a supervisory authority, for example the LDI NRW (North Rhine-Westphalia).

10. Retention

Server logs: Framer states no fixed retention period in its data processing agreement; it processes for the term of the agreement and deletes on written instruction (DPA 2.0, Annex I.5 and clause 10.1). We therefore give no figure. Contact enquiries: see § 7; cookies: per the Cookie Policy; statutory periods otherwise.

11. Changes

The published version, with its version number and date at the end of the page, governs. The change history is there as well.

Version 6.1.0 · as of 25.09.2026

Checksum: sha256-b7ada3daa69b2d8a1ba3c8ddc4079513a0f2d00bce34d7bd6f5a4086aef1cc4d

1. Controller

ULTIDO GmbH, Rommerskirchener Straße 21, 50259 Pulheim, Germany, represented by Managing Director Maximilian Lucas Arbeiter. Local Court of Cologne, HRB 128940. Email: max@ultido.com · Phone: +49 221 16535560. Data Protection Officer: Maximilian Lucas Arbeiter, max@ultido.com.

2. Hosting (Framer)

This website is provided by Framer B.V. (Netherlands); content is delivered via the Framer CDN (framerusercontent.com). On each request the host processes technically necessary data (IP address, timestamp, requested resource, user agent, referrer) in server logs. Legal basis: Art. 6(1)(f) (legitimate interest in secure, performant delivery). Framer engages its own sub-processors – for delivery essentially AWS, Google Cloud and Cloudflare, all processing in the USA. Framer maintains the full, continuously updated list in its Trust Center (trust.framer.com). Fonts are also delivered through the Framer CDN; no connection is made to any external font provider. A data processing agreement is in place (Framer Data Processing Addendum version 2.0 of 16 June 2026), incorporated by reference into the Terms of Service. Third-country transfers rely on an adequacy decision or the EU-US Data Privacy Framework where the recipient is certified, otherwise on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Modules 2 and 3).

3. Cookies and consent management

Cookies and storage access that are not strictly necessary are used only with your consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR). Strictly necessary access relies on § 25(2) TDDDG. Consent is managed through CCM19 (Papoo Software & Media GmbH, Germany). Nothing requiring consent loads before your decision. You can change or withdraw your choice at any time via "Cookie Settings" in the footer; withdrawal is as easy as giving consent (Art. 7(3)). As at 22 September 2026 we set no consent-requiring cookies and embed no consent-requiring services; the consent banner is in place but currently has nothing to unlock. Details and the cookie table: Cookie Policy.

4. Reach measurement

No Google Analytics, no Google Tag Manager, no comparable third-party tool. No statistics or marketing cookies are set and no data is passed to third parties for analytics.

Our host Framer measures reach with its own cookieless function. On page load a script is fetched from events.framer.com and reports the page view. Processed are the page requested, referrer, approximate origin, device and browser. Nothing is stored on your device and nothing is read from it – no cookies, no local storage. IP address and user agent are hashed with a daily rotating salt before evaluation, so no persistent identifier is created. Legal basis: Art. 6(1)(f) (legitimate interest in aggregate reach measurement). You may object under Art. 21 GDPR: max@ultido.com.

5. Embedded media (Cloudinary)

Product and demo videos and website images are delivered via Cloudinary. Loading a media asset transmits your IP address to the delivering host, where technically necessary connection data (timestamp, requested resource, user agent) is processed. Legal basis: Art. 6(1)(f) (legitimate interest in performant media delivery). Media are served from the Cloudinary tenant of SnapNext GmbH + Co. KG, which acts as our processor for this purpose; an Art. 28 GDPR agreement is in place with SnapNext that covers Cloudinary as a further processor. Processing takes place in the EU. This applies to the ultido.com website only, not to the guest applications of the parks.

6. Contact (form, email)

When you contact us we process the data you provide (name, email, company, message) to handle your enquiry. Legal basis: Art. 6(1)(b) (pre-contractual) or Art. 6(1)(f). Form data is captured via Framer Forms (Framer B.V., Netherlands) and forwarded to our mailbox; no separate form or booking tool is embedded. Appointment requests are handled by email to hey@ultido.com. Our email runs on Google Workspace (Google Ireland Limited / Google LLC – EU-US DPF and SCCs; the tenant is operated by SnapNext GmbH + Co. KG as a processor, with a dedicated Ultido organisational unit). Retention: enquiries are deleted once handled, at the latest after 12 months, subject to statutory retention.

7. Recipients

Processors and recipients for this website: Framer (hosting, form delivery, cookieless reach measurement), SnapNext GmbH + Co. KG (media delivery via its Cloudinary tenant, EU), Google Ireland Limited / Google LLC (Google Workspace for our email only). No analytics or tag management services, no external font providers. The sub-processors of the platform – a different set – are listed in the Subprocessor Register.

8. International transfers

Where the providers named above process data in third countries (in particular the USA), this is based on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and/or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Copies of the safeguards are available on request.

9. Your rights

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) – in particular against processing based on Art. 6(1)(f); withdrawal of consent (Art. 7(3)) at any time, for example via the cookie settings. Requests: max@ultido.com. You may lodge a complaint with a supervisory authority, for example the LDI NRW (North Rhine-Westphalia).

10. Retention

Server logs: Framer states no fixed retention period in its data processing agreement; it processes for the term of the agreement and deletes on written instruction (DPA 2.0, Annex I.5 and clause 10.1). We therefore give no figure. Contact enquiries: see § 7; cookies: per the Cookie Policy; statutory periods otherwise.

11. Changes

The published, versioned copy governs ("Version X.Y.Z · Stand DD.MM.YYYY"). Change history at the end of the page.