Big Pictury – So that everyone understands what matters 1. Generalinformation The following information provides an overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally. This privacy policy applies to the website www.big-pictury.com as well as the content, forms, and integrated services offered there. 2. Responsiblebody Responsible body within the meaning of the GDPR (Art. 4 (7) GDPR): Big Pictury GmbH Gerhofstraße 1–3 20354 Hamburg, Germany Managing Director: Wolf Wienecke Phone: +49 40 46898008-0 Email: contact@big-pictury.com

3. Contactingus If you contact us by email, contact form, telephone, or other means of communication, your details will be processed for the purpose of handling your inquiry and in case of follow-up questions. Legal basis: • Art. 6 (1) (b) GDPR (pre-contractual measures/contract) • Art. 6 (1) (f) GDPR (legitimate interest in efficient communication) The data will be deleted as soon as it is no longer required for the purpose of processing and there are no legal retention obligations. 4. Definitions Personal data is any information relating to an identified or identifiable natural person (Art. 4 GDPR). "Processing" means any operation or set of operations performed on personal data, such as collection, storage, use, transmission, or deletion. 5. Data security & SSL encryption We take technical and organizational security measures to protect your data against manipulation, loss, or unauthorized access. Our website uses SSL or TLS encryption. You can recognize an encrypted connection by the "https://" in the address bar of your browser. 6. Server log files (technically necessary data) When you visit our website, information is automatically transmitted by your browser to our server and temporarily stored in log files. This includes, among other things: • IP address • Date and time of access • Page accessed • Referrer URL • Browser type and operating system This data is technically necessary to ensure the stable and secure operation of the website. Legal basis: Art. 6 (1) (f) GDPR Storage period: max. 7 days (security-related) 7. Cookie & consent management We use cookie and consent management to manage cookies and similar technologies. • Technically necessary cookies are set without consent. • Statistics, analysis, and marketing services are only activated after you have given your consent. You can revoke or adjust your consent at any time via the cookie settings. 8. Google Tag Manager We use Google Tag Manager to centrally manage website tags. Google Tag Manager itself does not process any personal data, but it does enable the integration of other services. Services that require consent are only activated via Tag Manager after consent has been given. 9. Google Analytics (GA4) If you have given your consent, we use Google Analytics 4 to analyze the use of our website and improve our offering. The following data is processed, among other things: • Usage data (page views, interactions) • Technical information (browser, device type) Legal basis: Art. 6 (1) (a) GDPR (consent) Data may be transferred to third countries (e.g., the US). Appropriate safeguards are used (e.g., adequacy decision or standard contractual clauses). 10. Meta Pixel (Facebook/Instagram) If you have given your consent, we use the Meta Pixel to: • measure the effectiveness of advertisements • deliver content in a more targeted manner Information about page views and interactions may be processed in this process. Legal basis: Art. 6 (1) (a) GDPR 11. LinkedIn InsightTag If you have given your consent, we use the LinkedIn Insight Tag to: • analyze the reach and success of our content • improve our communication on LinkedIn Legal basis: Art. 6 (1) (a) GDPR

12.Hotjar If you have given your consent, we use Hotjar to better understand how our website is used (e.g., heat maps, scrolling behavior). Hotjar is configured so that personal data is not recorded or masked wherever possible. Legal basis: Art. 6 (1) (a) GDPR 13. Pipedrive (CRM) We use a CRM system (Pipedrive) to process inquiries, book appointments, and initiate contracts. The data that you actively submit to us (e.g., name, email, message) is processed. Legal basis: Art. 6 (1) (b) GDPR 14. Pipedrive LeadBooster (chat & forms) If we use Pipedrive's chat or form functions, the data you enter will be processed in order to respond to your inquiry. If cookies or similar technologies are used, this will only be done with your consent. 15. Newsletter (via Pipedrive) If you subscribe to our newsletter, we will process your email address in order to send you information about our topics and offers. The newsletter is sent via our CRM system Pipedrive. Legal basis: Art. 6 (1) (a) GDPR You can unsubscribe from the newsletter at any time via the unsubscribe link or by sending us a message. 16. Integration of YouTube & Vimeo Videos from YouTube and Vimeo are integrated into our website. When the videos are played, data may be transferred to the respective providers. The integration only takes place with your consent and, as far as possible, in extended data protection mode. Legal basis: Art. 6 (1) (a) GDPR 17. Transfer of data Personal data will only be transferred: • with your consent • for the fulfillment of a contract • if there is a legal obligation • to carefully selected processors 18. Storageperiod Personal data will be deleted as soon as the purpose of processing no longer applies, provided that there are no legal retention obligations. 19. Yourrights You have the right at any time to: • information (Art. 15 GDPR) • Rectification (Art. 16 GDPR) • Erasure (Art. 17 GDPR) • Restriction of processing (Art. 18 GDPR) • Data portability (Art. 20 GDPR) • Withdrawal of consent (Art. 7(3) GDPR) • Complaint to a supervisory authority (Art. 77 GDPR) To exercise your rights, simply send an informal message to the above contact address. 20. Status & changes This privacy policy is current as of 12/2025. We reserve the right to amend it in the event of legal or technical changes.