Disclaimer: The template below has been drawn up by a solicitor (Dr. jur. Schwenke, LL.M. in Commercial Law (UoA), Certified Data Protection Auditor (DSA-TÜV), Certified Data Protection Officer (TÜV Süd)) has been drawn up in line with the typical requirements of an online shop. However, you should only use this template after carefully reviewing and adapting it to your specific business model. The template below therefore contains additional notes that you must take into account, as well as sections highlighted in red, which you must check particularly carefully and adapt where necessary. Please remove these notes once you have made the necessary changes. If in doubt, seek legal advice. Copyright: You may use the template within the domain/website for as long as your Marketpress licence remains valid for that domain/website. Distribution to third parties, including customers (e.g. as developers), is not permitted.

Privacy Policy

Introduction

The following privacy policy is intended to explain to you what types of your personal data (hereinafter also referred to simply as „data“) we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and, in particular, on our websites, on mobile devices, and within external online platforms, such as our social media profiles (hereinafter collectively referred to as the „online offering“).

The terms used are not gender-specific.

As at: XX.XX.20XX

Please state the status of the privacy policy.

Data controller

First name, surname / Company
Street, house number.
Postcode, Town/City
Country

Email address: Your email address

Telephone: Your telephone number (optional)

Legal notice: URL of your legal notice (optional, but recommended)

Notes: For sole traders, please use the term „owner“ rather than „managing director“.

Contact the Data Protection Officer

First name, surname / Company
Street, house number.
Postcode, Town/City
Country

Please note: Only the email address is compulsory; the other details are optional. Data protection officers need only be listed if they have been appointed. Under Section 38 of the New Federal Data Protection Act (BDSG-Neu), an appointment is required as soon as there are 20 or more employees processing personal data (for which, in practice, even a single email account is sufficient).

Overview of processing operations

The following overview summarises the types of data processed and the purposes for which they are processed, and identifies the data subjects.

Note: The following information sets out the typical categories of data processed and data subjects (both the categories themselves and the explanations in brackets are provided for illustrative purposes only and may be amended or deleted).

Types of data processed

Master data (e.g. names, addresses).
Content data (e.g. entries in online forms).
Contact details (e.g. email address, telephone numbers).
Meta/communication data (e.g. device information, IP addresses).
Usage data (e.g. websites visited, interest in content, times of access).
Location data (information relating to the geographical position of a device or a person).
Contract details (e.g. subject matter of the contract, term, customer category).
Payment details (e.g. bank details, invoices, payment history).

Categories of data subjects

Business and contractual partners.
Prospective customers.
Communication partners.
Customers.
Users (e.g. website visitors, users of online services).

Purposes of processing

Assessment of creditworthiness and credit rating.
Provision of our online services and user-friendliness.
Evaluation of the visitor campaign.
Office and organisational procedures.
Cross-device tracking (the processing of user data across devices for marketing purposes).
Direct marketing (e.g. by email or post).
Interest-based and behavioural marketing.
Enquiries and communication.
Conversion measurement (measuring the effectiveness of marketing activities).
Profiling (creating user profiles).
Remarketing.
Audience measurement (e.g. traffic statistics, identification of returning visitors).
Safety measures.
Tracking (e.g. interest-based or behavioural profiling, use of cookies).
Provision of contractual services and customer service.
Managing and responding to enquiries.
Target audience identification (identifying target audiences relevant for marketing purposes or other distribution of content).

Automated decisions in individual cases

Credit report (decision based on a credit check).

Relevant legal bases

Below, we set out the legal bases under the General Data Protection Regulation (GDPR) on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations in your country of residence or our country of incorporation may apply. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

Consent (Article 6(1), first sentence, point (a) of the GDPR) – The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes.
Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR) – The processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.
Legal obligation (Article 6(1), first sentence, point (c) of the GDPR) – The processing is necessary for compliance with a legal obligation to which the data controller is subject.
Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

Safety measures

We implement technical and organisational measures in accordance with the statutory requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input of, disclosure of, and safeguarding the availability and segregation of such data. Furthermore, we have established procedures to ensure that data subjects’ rights are upheld, that data is deleted and that appropriate action is taken in the event of a data breach. Furthermore, we take the protection of personal data into account right from the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design, through technical design and data protection-friendly default settings.

SSL encryption (https): To protect the data you submit via our online service, we use SSL encryption. You can recognise connections encrypted in this way by the prefix https:// in your browser’s address bar.

Note: Please remove the reference to encryption if your website is not encrypted. However, serving the website via HTTPS must be regarded as mandatory.

Transfer and disclosure of personal data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organisational units or individuals. Recipients of this data may include, for example, payment institutions in connection with payment transactions, service providers commissioned to carry out IT tasks, or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

Data processing in third countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other persons, bodies or organisations, this is done solely in accordance with the relevant legal requirements.

Subject to express consent or where the transfer is required by contract or by law, we shall only process or allow the processing of data in third countries with a recognised level of data protection, or where there is a contractual obligation through the so-called Standard Data Protection Clauses of the European Commission, where certifications are in place or where binding internal data protection regulations apply (Articles 44 to 49 of the GDPR, European Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de ).

Under the so-called „Data Privacy Framework” (DPF), the European Commission has also recognised the level of data protection provided by certain US companies as adequate under the adequacy decision of 10 July 2023. You can find the list of certified organisations, as well as further information on the DPF, on the US Department of Commerce’s website at https://www.dataprivacyframework.gov/ (in English). In our privacy policy, we set out which of the service providers we use are certified under the Data Privacy Framework.

Use of cookies

Cookies are small text files or other storage mechanisms that store information on end-user devices and retrieve information from them. For example, to store the login status in a user account, the contents of a shopping basket in an online shop, the content accessed or the functions used on an online service. Cookies may also be used for various other purposes, such as ensuring the functionality, security and user-friendliness of online services, as well as analysing visitor traffic.

Information regarding consent: We use cookies in accordance with the relevant legal provisions. We therefore obtain prior consent from users, unless this is not required by law. In particular, consent is not required if the storage and retrieval of information – including cookies – are strictly necessary to provide users with a telemedia service (i.e. our online offering) that they have expressly requested. The revocable consent is clearly communicated to users and includes information on the specific use of cookies.

Information on the legal basis for data protection: The legal basis under data protection law on which we process users’ personal data using cookies depends on whether we ask users for their consent. If users give their consent, the legal basis for the processing of their data is their explicit consent. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g. the business operation of our online service and improving its usability) or, where this takes place in the context of fulfilling our contractual obligations, if the use of cookies is necessary to fulfil our contractual obligations. We explain the purposes for which we process cookies in this privacy policy or as part of our consent and processing procedures.

Retention period: With regard to their storage duration, a distinction is made between the following types of cookies:

Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest once a user has left an online service and closed their device (e.g. browser or mobile application).
Persistent cookies: Persistent cookies remain stored even after the device has been switched off. This allows, for example, the user’s login status to be saved or their preferred content to be displayed immediately when they visit a website again. Similarly, the user data collected via cookies may be used to measure website reach. Unless we provide users with explicit information regarding the type and storage period of cookies (e.g. when seeking consent), users should assume that cookies are persistent and may be stored for up to two years.

General information on withdrawal and opting out: Depending on whether the processing is based on consent or statutory authorisation, you have the option at any time to withdraw any consent you have given or to object to the processing of your data via cookie technologies (collectively referred to as „opting out“). You can initially express your objection via your browser settings, for example by disabling the use of cookies (although this may also restrict the functionality of our website). You can also object to the use of cookies for online marketing purposes via a variety of services, particularly in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/ explained. You can also find further information on how to object in the details provided regarding the service providers used and cookies.

Processing of cookie data on the basis of consent: We use a cookie consent management procedure, under which users’ consent to the use of cookies – or, more specifically, to the processing activities and providers specified within the cookie consent management procedure – is obtained, and which allows users to manage and withdraw their consent. The declaration of consent is stored so that the user does not have to be asked for consent again and so that proof of consent can be provided in accordance with legal requirements. Storage may take place on the server and/or in a cookie (a so-called ‘opt-in’ cookie, or using comparable technologies) in order to be able to associate the consent with a user or their device. Subject to specific information provided by the providers of cookie management services, the following applies: Consent may be stored for up to two years. In this process, a pseudonymous user identifier is generated and stored together with the time of consent, details of the scope of consent (e.g. which categories of cookies and/or service providers) and the browser, operating system and device used.

Cookie settings / option to opt out:

If you use a cookie consent banner (which is recommended), you can enter the option to display it here (e.g. a link or a so-called [shortcode], which your software automatically converts into a button or link).

Notes on the processing of cookie data based on consent: You should only leave this option selected (and otherwise deselect it) if you have a „genuine“ opt-in, i.e. obtain users„ consent to the use of cookies (e.g. via so-called “cookie consent/opt-in banners’ or as part of a registration process).

As the European Court of Justice has ruled that a cookie opt-in is generally required when using marketing tools commonly employed in e-commerce (e.g. Google Analytics or Facebook Pixel), this option is pre-selected.

In other words, until users have given their consent, you must not set any cookies (nor use any third-party services on your websites that themselves set cookies). The only exception is the use of essential cookies that users would expect, such as a shopping basket function in an online shop or local audience measurement using the Matomo tool.

Business services

We process the personal data of our contractual and business partners, such as customers, clients, prospective customers, suppliers and other collaborative partners (collectively, „contractual partners“), for the purpose of establishing, implementing and managing contractual relationships and similar legal relationships. This also includes pre-contractual measures carried out on request, as well as communication relating to the respective contractual relationship.

The processing serves, in particular, to fulfil our principal and ancillary contractual obligations. These include the provision of the agreed services, any obligations to provide updates and information, the handling of warranty claims and other service disruptions, the processing of cancellations, terminations of continuing contractual relationships, reversals, refunds, and the processing of other contract-related declarations and enquiries. This covers both one-off contracts and ongoing contractual relationships.

In particular, we process master data such as name, address and, where applicable, company name; contact details such as email address and telephone number; contract and service data such as the subject matter of the contract, contract term, order or transaction number; usage and performance data; payment and billing data; as well as the content and history of communications. Where necessary, we also process data that is disclosed or provided to us in the course of carrying out an order.

Furthermore, we process the data to safeguard our rights and to fulfil legal obligations. This includes, in particular, retention requirements under commercial and tax law, documentation requirements and, where applicable, obligations to provide evidence and account for our actions. Furthermore, processing takes place on the basis of our legitimate interests in the proper conduct of business, internal administration, risk management and IT security, as well as in the protection of our business operations and our contractual partners against misuse and threats to data, confidential information and other legal interests. This may also involve the use of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisers or other agents, insofar as this is necessary for the performance of the contract or to fulfil legal obligations.

Personal data will only be disclosed to third parties insofar as this is necessary for the performance of a contract, for the implementation of pre-contractual measures, to safeguard legitimate interests or to fulfil legal obligations. We provide separate information regarding any further processing, in particular for marketing purposes, within this privacy policy.

We inform our contractual partners of the data required in each individual case as part of the data collection process, for example by clearly labelling online forms or through direct contact.

Data will be deleted as soon as it is no longer required for the aforementioned purposes and there are no statutory retention obligations preventing this. Statutory retention periods, in particular under commercial and tax law, may require data to be retained for a longer period. We will delete data transmitted in connection with a specific order once the order has been completed and any retention periods have expired, provided there are no further statutory or contractual obligations to retain the data.

The legal basis for the processing is Article 6(1)(b) of the GDPR for the purpose of taking steps prior to entering into a contract and for the performance of the relevant contractual relationship, as well as Article 6(1)(c) of the GDPR for the fulfilment of legal obligations. Where processing is based on legitimate interests, it is carried out in accordance with Article 6(1)(f) of the GDPR. Where processing is based on Article 6(1)(f) of the GDPR, it is carried out to safeguard our legitimate interests in the proper and efficient organisation of our business, the internal administration and documentation of business transactions, the enforcement and defence of legal claims, ensuring IT and data security, preventing misuse and fraud, and the economic management and further development of our business operations. These interests consist, in particular, of ensuring secure and legally compliant business operations and safeguarding our ability to act as a business.

Customer account: Contracting parties may create an account within our online service (e.g. a customer or user account, hereinafter referred to as a „customer account“). Where the registration of a customer account is required, contracting parties will be informed of this, as well as of the details required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of the registration process, as well as subsequent logins and use of the customer account, we store customers’ IP addresses along with the times of access in order to verify the registration and to prevent any misuse of the customer account.

If customers have closed their account, the data relating to that account will be deleted, unless retention is required for legal reasons. It is the customers’ responsibility to back up their data once the account has been closed.

Economic analysis and market research: For business reasons and in order to identify market trends and the preferences of contractual partners and users, we analyse the data we hold relating to business transactions, contracts, enquiries, etc., whereby the group of data subjects may include contractual partners, prospective customers, customers, visitors and users of our online services.

The analyses are carried out for the purposes of business analysis, marketing and market research (e.g. to identify customer groups with different characteristics). In doing so, we may take into account, where available, the profiles of registered users, including their details, e.g. regarding the services they have used. The analyses are used solely by us and are not disclosed externally, unless they are anonymous analyses based on aggregated, i.e. anonymised, data. Furthermore, we respect users’ privacy and process the data for analytical purposes in a pseudonymous manner wherever possible and, where feasible, anonymously (e.g. as aggregated data).

Shop and e-commerce: We process our customers’ data to enable them to select, purchase or order the chosen products, goods and related services, as well as to facilitate their payment, provision, delivery or fulfilment. Where necessary for the fulfilment of an order, we engage service providers, in particular postal, freight and courier companies, to carry out the delivery or fulfilment on behalf of our customers. We use the services of banks and payment service providers to process payment transactions. The required details are clearly identified as such during the ordering process or similar purchase procedure and include the information needed for delivery, provision and billing, as well as contact details to enable us to get in touch if necessary.

Types of data processed: Master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact details (e.g. email, telephone numbers), contract data (e.g. subject matter of the contract, term, customer category), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
People affected: Prospective clients, business and contractual partners, customers.
Purposes of processing: Provision of contractual services and customer service, contact enquiries and communication, office and organisational procedures, administration and responding to enquiries, security measures, analysis of visitor activity, interest-based and behavioural marketing, profiling (creation of user profiles).
Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR), legal obligation (Article 6(1), first sentence, point (c) of the GDPR), Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Note: Please remove the section on customer accounts or the analysis of customer data if you do not offer customer accounts or do not analyse your customers’ data as described.

Payment service provider

Within the framework of contractual and other legal relationships, in accordance with statutory obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, to this end, engage not only banks and credit institutions but also other payment service providers (collectively referred to as „payment service providers“).

The data processed by the payment service providers includes personal details, such as name and address; bank details, such as account numbers or credit card numbers; passwords, TANs and checksums; as well as information relating to the contract, the amount and the recipient. This information is required to carry out the transactions. However, the data entered is processed and stored solely by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information confirming or rejecting the payment. In some circumstances, the data may be transferred by the payment service providers to credit reference agencies. The purpose of this transfer is to verify identity and creditworthiness. In this regard, we refer you to the terms and conditions and privacy policies of the payment service providers.

Payment transactions are subject to the terms and conditions and privacy policies of the respective payment service providers, which are available on their respective websites or within the transaction applications. We also refer you to these documents for further information and for exercising your rights of withdrawal, access and other data subject rights.

Types of data processed: Master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contract data (e.g. subject matter of the contract, term, customer category), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
People affected: Customers, prospective customers.
Purposes of processing: Provision of contractual services and customer service.
Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Services used and service providers:

PayPal: Payment services and solutions (e.g. PayPal, PayPal Plus, Braintree); service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; website: https://www.paypal.com/de; Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full.

Otherwise, adjust the list of services and providers as required.

Credit check

Where we make advance payments or assume comparable financial risks (e.g. when ordering on account), we reserve the right, in order to safeguard our legitimate interests, to obtain identity and creditworthiness information for the purpose of assessing credit risk on the basis of mathematical and statistical methods from specialist service providers (credit reference agencies).

We process the information received from credit reference agencies regarding the statistical probability of default as part of a reasonable exercise of discretion regarding the establishment, performance and termination of the contractual relationship. We reserve the right to refuse payment on account or any other advance payment in the event of a negative credit check result.

The decision as to whether we will make an advance payment is made, in accordance with Article 22 of the GDPR, solely on the basis of an automated decision in each individual case, which our software carries out on the basis of the information provided by the credit reference agency.

Where we obtain explicit consent from contractual partners, the legal basis for the credit reference and the transfer of the customer’s data to credit reference agencies is that consent. If no consent is obtained, the credit check is carried out on the basis of our legitimate interests in safeguarding our payment claims against default.

Types of data processed: Master data (e.g. names, addresses), payment details (e.g. bank details, invoices, payment history), contact details (e.g. email, telephone numbers), contract details (e.g. subject matter of the contract, term, customer category).
People affected: Customers, prospective customers.
Purposes of processing: Assessment of creditworthiness and credit rating.
Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
Automated decisions in individual cases: Credit report (decision based on a credit check).

Services used and service providers:

Creditreform Association of Organisations e.V.: Credit reference agency; service provider: Verband der Vereine Creditreform e.V., Hammfelddamm 13, D-41460 Neuss, Germany; website: https://www.creditreform.de/; Privacy Policy: https://www.creditreform.de/datenschutz.

Note: Remove the section on credit checks if you do not carry out credit checks. Check and amend the list of service providers if necessary. Checking a customer’s creditworthiness is permissible where there is otherwise a risk of non-payment, i.e. where goods are delivered without payment having been received (i.e. where the customer chooses to pay on account). By contrast, there is no risk of non-payment if, for example, the customer chooses the ‘payment in advance’ option or makes the payment via a third-party provider such as PayPal.

It should also be noted that obtaining an automated credit reference constitutes an „automated individual decision“ within the meaning of Article 22 of the GDPR, i.e. a legal decision made without human intervention. This is permissible if the customer has given their consent or if this decision is necessary for the conclusion of the contract. Whether the decision is necessary has not yet been conclusively clarified, but is widely regarded as being the case, including by the author of this template.

However, if you wish to rule out any risk whatsoever, you should obtain consent. Consent is also required if the credit check is already being used to decide whether to display the „on account“ option in the first place. This is because the customer might well have opted for prepayment or PayPal anyway, in which case the credit check would not have been necessary. Such consent could, for example, read as follows:

? I consent to a credit check being carried out in order to determine, via an automated decision-making process (Article 22 of the GDPR), whether the option to purchase on account will be offered. Further information on the credit check, the credit reference agencies used, the procedure and your rights to object can be found in our [Link]Privacy Policy[/Link].

Provision of the online service and web hosting

In order to provide our online services securely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online services can be accessed. For these purposes, we may utilise infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance services.

The data processed in connection with the provision of the hosting service may include any information relating to users of our online service that is generated in the course of their use of the service and their communications. This typically includes the IP address, which is necessary to deliver the content of online services to browsers, and all data entered within our online service or on websites.

Email delivery and hosting: The web hosting services we use also include the sending, receiving and storage of emails. For these purposes, the addresses of the recipients and senders, as well as further information relating to the sending of emails (e.g. the providers involved) and the contents of the respective emails, are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent in encrypted form over the internet. Although emails are usually encrypted whilst in transit, they are not encrypted on the servers from which they are sent and received (unless a so-called end-to-end encryption method is used). We are therefore unable to accept any responsibility for the transmission of emails between the sender and our server.

Collection of access data and log files: We (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, the date and time of the request, the amount of data transferred, confirmation of successful retrieval, browser type and version, the user’s operating system, the referrer URL (the page visited previously) and, as a rule, IP addresses and the requesting provider.

The server log files can be used, on the one hand, for security purposes – for example, to prevent the servers from becoming overloaded (particularly in the event of malicious attacks, known as DDoS attacks) – and, on the other hand, to ensure the servers’ capacity utilisation and stability.

Types of data processed: Content data (e.g. information entered into online forms), usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
People affected: Users (e.g. website visitors, users of online services).
Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Please note: If you have not already done so, please ask your web hosting provider for a „Data Processing Agreement“. This is required by law, as the hosting provider collects personal data from website visitors on your behalf.

Getting in touch

When you contact us (e.g. via the contact form, by email, telephone or social media), the details provided by the enquirer will be processed to the extent necessary to respond to your enquiry and to take any requested action.

We respond to enquiries made in the context of contractual or pre-contractual relationships in order to fulfil our contractual obligations or to respond to (pre-)contractual enquiries, and otherwise on the basis of our legitimate interests in responding to such enquiries.

Types of data processed: Master data (e.g. names, addresses), contact details (e.g. email addresses, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
People affected: Communication partners, prospective clients.
Purposes of processing: Enquiries and communication; managing and responding to enquiries.
Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Services used and service providers:

Contact form: When users contact us via our contact form, by email or through other channels of communication, we process the data provided to us in this context in order to deal with the enquiry raised. To this end, we process personal data within the framework of pre-contractual and contractual business relationships, insofar as this is necessary for their fulfilment, and, in other respects, on the basis of our legitimate interests and the interests of our communication partners in responding to their enquiries, as well as our statutory retention obligations.
Help Scout: Management of contact enquiries and communication; service provider: Help Scout PBC, 100 City Hall Square, Suite 510, USA; website: https://www.helpscout.com; Privacy Policy: https://www.helpscout.com/company/legal/privacy/; Basis for transfers to third countries: Standard contractual clauses (https://www.helpscout.com/company/legal/dpa/); Data Processing Agreement: https://www.helpscout.com/company/legal/dpa/.

Note: Where third-party CRM systems are used, their providers should be named. Please amend this information or remove the service provider listed. Furthermore, data processing agreements must be concluded with the providers. If the providers process users„ data in a third country, specific safeguards must be in place (e.g. standard contractual clauses).

Newsletters and electronic notifications

We send out newsletters, emails and other electronic communications (hereinafter „newsletters“) only with the consent of the recipients or where permitted by law. Where the content of a newsletter is specifically described as part of the subscription process, this content forms the basis for the user’s consent. In addition, our newsletters contain information about our services and about us.

To subscribe to our newsletters, you generally only need to provide your email address. However, we may ask you to provide a name, so that we can address you personally in the newsletter, or further details if these are required for the purposes of the newsletter.

Double opt-in procedure: Subscription to our newsletter is generally carried out using a ‘double opt-in’ procedure. This means that, after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can subscribe using someone else’s email address. Subscriptions to the newsletter are logged so that we can provide evidence of the subscription process in accordance with legal requirements. This includes storing the time of subscription and confirmation, as well as the IP address. Any changes to your data stored with the mailing service provider are also logged.

Erasure and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to provide evidence of consent that was previously given. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for erasure may be made at any time, provided that the prior existence of consent is confirmed at the same time. In the event of obligations to permanently comply with objections, we reserve the right to store the email address solely for this purpose on a blacklist.

The registration process is logged on the basis of our legitimate interests for the purpose of providing evidence that it has been carried out correctly. Where we engage a service provider to send emails, this is done on the basis of our legitimate interests in having an efficient and secure mailing system.

Notes on the legal basis: Newsletters are sent on the basis of the recipients’ consent or, where consent is not required, on the basis of our legitimate interests in direct marketing, provided that this is permitted by law, e.g. in the case of marketing to existing customers. Where we engage a service provider to send emails, this is done on the basis of our legitimate interests. The registration process is recorded on the basis of our legitimate interests in order to demonstrate that it was carried out in accordance with the law.

Contents: Information about us, our services, promotions and offers.

Types of data processed: Master data (e.g. names, addresses), contact details (e.g. email, telephone numbers), meta/communication data (e.g. device information, IP addresses), usage data (e.g. websites visited, content interests, access times).
People affected: Communication partners.
Purposes of processing: Direct marketing (e.g. by email or post).
Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
Right to object (opt-out): You may unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to receiving further issues. You will find a link to unsubscribe from the newsletter either at the end of each newsletter, or you may use one of the contact details provided above – preferably by email – to do so.

Services used and service providers:

Measuring open and click-through rates: The newsletters contain what are known as „web beacons“, i.e. a pixel-sized file which is retrieved from our server – or from the server of the mailing service provider, if we use one – when the newsletter is opened. As part of this retrieval, technical information – such as details of your browser and system – as well as your IP address and the time of retrieval are initially collected. This information is used to improve our newsletter technically, based on the technical data or the target groups and their reading behaviour, determined by their location (which can be identified using the IP address) or the times at which the newsletter is accessed. This analysis also includes determining whether and when the newsletters are opened and which links are clicked. The information is assigned to individual newsletter recipients and stored in their profiles until it is deleted. The analyses serve to identify our users’ reading habits and to tailor our content to them, or to send different content in line with our users’ interests. The measurement of open and click-through rates, as well as the storage of the measurement results in users’ profiles and their further processing, are carried out on the basis of the users’ consent. Unfortunately, it is not possible to withdraw consent for performance measurement separately; in this case, the entire newsletter subscription must be cancelled or objected to. In that event, the stored profile information will be deleted; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR);
CleverReach: Email marketing platform; service provider: CleverReach GmbH & Co. KG, //CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany; website: https://www.cleverreach.com/de; Privacy Policy: https://www.cleverreach.com/de/datenschutz/; Data Processing Agreement: Concluded with the provider.
Mailchimp: Email delivery and email marketing platform; service provider: Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; website: https://mailchimp.com; Privacy Policy: https://mailchimp.com/legal/; Data Processing Agreement: https://mailchimp.com/legal/; Basis for transfers to third countries: Data Privacy Framework, Standard Contractual Clauses (incorporated into the data processing agreement); Further information: Specific security measures: https://mailchimp.com/help/Mailchimp-european-data-transfers/.

Please delete the section on newsletters if you do not send out any newsletters. Otherwise, please amend the list of services and providers, as well as the details regarding the newsletter’s content and performance measurement, as required.

Web analytics, monitoring and optimisation

Web analytics (also known as „reach measurement“) is used to analyse visitor traffic to our online platform and may include pseudonymised data on visitors’ behaviour, interests or demographic information, such as age or gender. With the help of audience measurement, we can, for example, identify at what times our online platform, its functions or content are most frequently used, or encourage visitors to return. We can also identify which areas require optimisation.

In addition to web analytics, we can also use testing methods to, for example, test and optimise different versions of our online offering or its individual components.

For these purposes, so-called user profiles may be created and stored in a file (known as a „cookie“), or similar methods may be used for the same purpose. This information may include, for example, content viewed, websites visited and elements used on those sites, as well as technical details such as the browser and computer system used, and information on usage times. Where users have consented to the collection of their location data, this may also be processed, depending on the provider.

Users’ IP addresses are also collected. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. Generally speaking, no personally identifiable data (such as email addresses or names) is stored as part of web analytics, A/B testing and optimisation; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective processes.

Notes on the legal basis: Where we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. our interest in providing efficient, cost-effective and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
People affected: Users (e.g. website visitors, users of online services).
Purposes of processing: Audience measurement (e.g. traffic statistics, identification of returning visitors), tracking (e.g. interest-based or behaviour-based profiling, use of cookies), analysis of visitor interactions, profiling (creation of user profiles).
Safety measures: IP masking (pseudonymisation of the IP address).
Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Services used and service providers:

etracker: Web analytics/audience measurement; service provider: etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany; website: https://www.etracker.com; Privacy Policy: https://www.etracker.com/datenschutz/; Data Processing Agreement: https://www.etracker.com/av-vertrag/.
Google Analytics: We use Google Analytics to measure and analyse the use of our online service on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to associate analytical information with a device in order to identify which content users have accessed during one or more sessions, which search terms they have used, whether they have revisited the site, or how they have interacted with our online service. The time of use and its duration are also stored, as well as the sources from which users have accessed our online service and technical details of their end devices and browsers.
In doing so, pseudonymous user profiles are created using information derived from the use of various devices, and cookies may be used for this purpose. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides approximate geographical location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based equivalents). For data traffic originating in the EU, the IP address data is used exclusively for this derivation of geolocation data before being deleted immediately. It is not logged, is not accessible and is not used for any other purposes. When Google Analytics collects measurement data, all IP queries are carried out on EU-based servers before the traffic is forwarded to Analytics servers for processing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymisation of the IP address); Privacy policy: https://business.safety.google/privacy/; Data Processing Agreement: https://business.safety.google/adsprocessorterms/; Basis for transfers to third countries: Data Privacy Framework (DPF); Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of adverts: https://myadcenter.google.com/personalizationoff; Further information: https://business.safety.google/adsservices/ (Types of processing and the data processed).
Google as the recipient of consent: The consent given by users as part of a consent dialogue (also known as „cookie opt-in/consent“, ‚cookie banner‘, etc.) serves several purposes. On the one hand, it enables us to fulfil our obligation to obtain consent for the storage and retrieval of information on and from users’ devices (in accordance with the ePrivacy Directive). On the other hand, it covers the processing of users’ personal data in accordance with data protection requirements. Furthermore, this consent also applies to Google, as the company is obliged under the Digital Markets Act to obtain consent for personalised services. We therefore share the status of the consents granted by users with Google. Our consent management software informs Google whether or not consent has been given. The aim is to ensure that users’ granted or withheld consents are taken into account when using Google Analytics and when integrating features and external services. This enables user consents and their withdrawals to be dynamically adjusted within the context of Google Analytics and other Google services on our website, depending on the user’s selections; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); Website: https://support.google.com/analytics/answer/9976101?hl=de; Privacy Policy: https://business.safety.google/privacy/.
Google Tag Manager: Google Tag Manager is a solution that enables us to manage so-called website tags via a user interface and thus integrate other services into our online offering (please refer to further details in this privacy policy). The Tag Manager itself (which implements the tags) therefore does not, for example, create user profiles or store cookies. Google merely receives the user’s IP address, which is necessary to run Google Tag Manager; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Data Processing Agreement:
https://business.safety.google/adsprocessorterms; Basis for transfers to third countries: Data Privacy Framework, Standard Contractual Clauses (https://business.safety.google/adsprocessorterms); Further information: https://privacy.google.com/businesses/adsservices (Types of processing and the data processed).
Matomo (without cookies): Matomo is a privacy-friendly web analytics programme that operates without cookies and identifies returning users by means of a so-called „digital fingerprint“, which is stored anonymously and changed every 24 hours; The „digital fingerprint“ captures users’ movements within our website using pseudonymised IP addresses in combination with the user’s browser settings in such a way that it is not possible to draw conclusions about the identity of individual users. The user data collected through the use of Matomo is processed solely by us and is not shared with third parties; Website: https://matomo.org/.
Matomo: Matomo is a piece of software used for web analytics and audience measurement. When Matomo is used, cookies are generated and stored on the user’s device. The user data collected through the use of Matomo is processed solely by us and is not shared with third parties. The cookies are stored for a maximum period of 13 months: https://matomo.org/faq/general/faq_146/; Deletion of data: Cookies are stored for a maximum of 13 months.

Please delete the section on ‘Web analytics, monitoring and optimisation’ if you do not use any web analytics, monitoring or optimisation tools on your website. Adjust the list of services and providers as required.

Online marketing

We process personal data for online marketing purposes, which may include, in particular, the marketing of advertising space or the display of advertising and other content (collectively referred to as „content“) based on users’ potential interests, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (known as a „cookie“), or similar methods are used to store information about the user that is relevant to the display of the aforementioned content. This information may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical details such as the browser used, the computer system used and information on usage times. Where users have consented to the collection of their location data, this may also be processed.

Users’ IP addresses are also collected. However, we use available IP masking methods (i.e. pseudonymisation by truncating the IP address) to protect users. Generally speaking, no users’ personal data (such as email addresses or names) is stored as part of the online marketing process; instead, pseudonyms are used. This means that neither we nor the providers of the online marketing processes know the actual identity of the users, but only the information stored in their profiles.

The information contained in the profiles is usually stored in cookies or using similar methods. These cookies can generally also be read later on other websites that use the same online marketing method; they may be analysed for the purpose of displaying content, supplemented with further data, and stored on the server of the online marketing provider.

In exceptional cases, personal data may be linked to profiles. This is the case, for example, where users are members of a social network whose online marketing methods we utilise, and the network links users’ profiles to the aforementioned information. Please note that users may enter into additional agreements with the providers, for example by giving their consent as part of the registration process.

As a general rule, we only have access to aggregated information regarding the success of our adverts. However, as part of what is known as conversion tracking, we can analyse which of our online marketing methods have led to a so-called conversion – i.e., for example, the conclusion of a contract with us. Conversion tracking is used solely to analyse the success of our marketing activities.

Unless otherwise stated, please assume that the cookies used will be stored for a period of two years.

Types of data processed: Usage data (e.g. websites visited, interest in content, times of access), meta/communication data (e.g. device information, IP addresses), location data (information regarding the geographical position of a device or a person).
People affected: Users (e.g. website visitors, users of online services), prospective customers.
Purposes of processing: Tracking (e.g. interest-based or behaviour-based profiling, use of cookies), remarketing, analysis of visitor engagement, interest-based and behavioural marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g. traffic statistics, identification of returning visitors), Target group identification (identification of target groups relevant for marketing purposes or other content delivery), cross-device tracking (cross-device processing of user data for marketing purposes).
Safety measures: IP masking (pseudonymisation of the IP address).
Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
Right to object (opt-out): Please refer to the privacy policies of the respective providers and the opt-out options specified by them. If no explicit opt-out option has been provided, you do have the option of disabling cookies in your browser settings. However, this may restrict certain functions of our website. We therefore also recommend the following opt-out options, which are summarised and organised by region: a) Europe: https://www.youronlinechoices.eu.
(b) Canada: https://www.youradchoices.ca/choices.
c) USA: https://www.aboutads.info/choices.
(d) Cross-regional: https://optout.aboutads.info.

Services used and service providers:

Meta-pixels and audience targeting (Custom Audiences): With the help of the Meta Pixel (or similar functions for transmitting event data or contact information via interfaces within apps), Meta is able, on the one hand, to identify visitors to our website as a target audience for the display of adverts (known as „Meta Ads“). Accordingly, we use the Meta Pixel to ensure that the Meta Ads we place are shown only to such users on Meta’s platforms and within the services of Meta’s partner organisations (the so-called „Audience Network“)“ https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offering or who display certain characteristics (e.g. an interest in specific topics or products, as indicated by the webpages they have visited), which we transmit to Meta (so-called „Custom Audiences“). We also use the Meta pixel to ensure that our Meta adverts are tailored to users„ potential interests and do not come across as intrusive. Furthermore, the Meta pixel enables us to track the effectiveness of Meta adverts for statistical and market research purposes by determining whether users were redirected to our website after clicking on a Meta advert (so-called “conversion tracking’); Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for transfers to third countries: Data Privacy Framework (DPF); Further information: Users„ event data, i.e. behavioural and interest data, is used for the purposes of targeted advertising and audience targeting on the basis of the joint controller agreement (“Addendum for Controllers’, https://www.facebook.com/legal/controller_addendum) is processed. Joint controllership is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company, Meta Platforms, Inc., in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
Google Ad Manager: We use the „Google Ad Manager“ service to place adverts on the Google Display Network (e.g. in search results, in videos, on websites, etc.). Google Ad Manager is characterised by the fact that adverts are displayed in real time based on users’ presumed interests. This enables us to show adverts for our online offering to users who may have a potential interest in our offering or who have previously shown an interest in it, as well as to measure the success of the adverts; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Basis for transfers to third countries: Data Privacy Framework (DPF); Further information: Types of processing and the data processed: https://business.safety.google/adsservices/; Data processing terms for Google advertising products: Information on the services, data processing terms between data controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms; where Google acts as a data processor, data processing terms for Google advertising products and standard contractual clauses for data transfers to third countries: https://business.safety.google/adsprocessorterms.
Google Ads and conversion tracking: Online marketing methods used to place content and adverts within the service provider’s advertising network (e.g. in search results, in videos, on websites, etc.), so that they are displayed to users who are likely to be interested in the adverts. In addition, we measure the conversion rate of the adverts, i.e. whether users have taken the opportunity to interact with the adverts and make use of the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Basis for transfers to third countries: Data Privacy Framework (DPF); Further information: Types of processing and the data processed: https://business.safety.google/adsservices/; Data processing agreements between data controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms.

Please delete the section on online marketing if you do not use any online marketing tools on your website. Adjust the list of services and providers as required. Please bear in mind that the use of marketing services on a website usually requires a cookie opt-in.

Social media presence

We maintain an online presence on social media platforms and, in this context, process users’ data in order to communicate with users active on those platforms or to provide information about us.

We would like to point out that this may involve the processing of users’ data outside the European Union. This may entail risks for users, as it could, for example, make it more difficult for them to enforce their rights.

Furthermore, users’ data within social networks is generally processed for market research and advertising purposes. For example, user profiles can be created on the basis of users’ behaviour and the interests derived therefrom. These user profiles can in turn be used, for example, to display advertisements both within and outside the networks that are presumed to correspond to users’ interests. For these purposes, cookies are usually stored on users’ computers, in which their usage behaviour and interests are recorded. Furthermore, data may also be stored in the usage profiles regardless of the devices used by users (in particular, if users are members of the respective platforms and are logged in to them).

For a detailed description of the respective methods of data processing and the options for objecting (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

We would also like to point out that, in the case of requests for information and the exercise of data subjects’ rights, these can most effectively be exercised by contacting the service providers directly. Only the service providers have access to users’ data and can take appropriate action and provide information directly. Should you nevertheless require assistance, please do not hesitate to contact us.

Types of data processed: Master data (e.g. names, addresses), contact details (e.g. email addresses, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
People affected: Users (e.g. website visitors, users of online services).
Purposes of processing: Contact enquiries and communication, tracking (e.g. interest-based or behavioural profiling, use of cookies), remarketing, audience measurement (e.g. traffic statistics, identification of returning visitors).
Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Services used and service providers:

Instagram: Social network that allows users to share photos and videos, comment on and like posts, send messages, and follow profiles and pages; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/; Basis for transfers to third countries: Data Privacy Framework (DPF).
Facebook pages: Profiles on the Facebook social network – The data controller is jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data relating to visitors to our Facebook page („fan page“). This includes, in particular, information on user behaviour (e.g. content viewed or interacted with, actions taken) as well as device information (e.g. IP address, operating system, browser type, language settings, cookie data). Further details can be found in the Facebook Data Policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical analyses via the „Page Insights“ service, which give us an understanding of how people interact with our page and its content. This is based on an agreement with Facebook („Information about Page Insights“: https://www.facebook.com/legal/terms/page_controller_addendum), which sets out, amongst other things, security measures and the exercise of data subjects’ rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users may therefore submit requests for access or erasure directly to Facebook. Users’ rights (in particular the right to access, erasure, objection and to lodge a complaint with a supervisory authority) remain unaffected by this. Joint responsibility is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for any further processing, including any possible transfer to Meta Platforms Inc. in the USA; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/; Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
LinkedIn: Social network – Together with LinkedIn Ireland Unlimited Company, we are responsible for the collection (but not the further processing) of visitor data used to generate the „Page Insights“ (statistics) for our LinkedIn profiles. This data includes information about the types of content that users view or interact with, as well as the actions they take. In addition, details of the devices used are collected, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles, such as job title, country, industry, hierarchical level, company size and employment status. Information regarding the processing of user data by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.
We have entered into a specific agreement with LinkedIn Ireland („Page Insights Joint Controller Addendum“, https://legal.linkedin.com/pages-joint-controller-addendum), which sets out, in particular, the security measures LinkedIn must observe and in which LinkedIn has agreed to uphold the rights of data subjects (i.e. users may, for example, submit requests for access or erasure directly to LinkedIn). Users’ rights (in particular the right to access, erasure, objection and to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection and transfer of data to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular with regard to the transfer of data to the parent company, LinkedIn Corporation, in the USA; service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/privacy-policy); Right to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Pinterest: Social network enabling users to share photos, comment on, favourite and curate posts, send messages and follow profiles; service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.pinterest.com; Privacy Policy: https://policy.pinterest.com/de/privacy-policy.
TikTok: Social network, enabling users to share photos and videos, comment on and favourite posts, send messages and follow accounts; Service providers: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.tiktok.com; Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de; Data Processing Agreement: Provided by the service provider.
X: Social network; Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://x.com; Privacy Policy: https://x.com/de/privacy.
YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Privacy Policy:https://business.safety.google/privacy/; GrundlRegarding transfers to third countries: Data Privacy Framework (DPF); Right to object (opt-out): https://myadcenter.google.com/.
Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.xing.com/; Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

Adjust the list of social networks as required.

Plugins, embedded functions and content

We incorporate functional and content elements into our online offering which are sourced from the servers of their respective providers (hereinafter referred to as „third-party providers”). These may include, for example, graphics, videos or social media buttons, as well as posts (hereinafter collectively referred to as „content”).

This integration always requires the third-party providers of this content to process users„ IP addresses, as they would be unable to send the content to users“ browsers without them. The IP address is therefore necessary for the display of this content or these functions. We endeavour to use only content where the respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as „web beacons“) for statistical or marketing purposes. These ‘pixel tags’ enable information, such as visitor traffic on the pages of this website, to be analysed. This pseudonymous information may also be stored in cookies on the user’s device and may include, amongst other things, technical information about the browser and operating system, referring websites, the time of the visit and further details regarding the use of our online service; it may also be linked to such information from other sources.

Types of data processed: Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), location data (information on the geographical position of a device or a person), content data (e.g. entries in online forms), master data (e.g. names, addresses), contact details (e.g. email, telephone numbers).
People affected: Users (e.g. website visitors, users of online services), communication partners.
Purposes of processing: Provision of our online services and user-friendliness, delivery of contractual services and customer service, contact enquiries and communication, tracking (e.g. interest-based/behavioural profiling, use of cookies), interest-based and behavioural marketing, profiling (creation of user profiles), security measures, administration and responding to enquiries.
Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR), Consent (Article 6(1), first sentence, point (a) of the GDPR), performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR).

Services used and service providers:

Facebook plugins and content: Facebook Social Plugins and content – This may include, for example, content such as images, videos or text, as well as buttons that allow users to share content from this website on Facebook. The list and appearance of the Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/ – We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt, as part of a transfer (but not the subsequent processing), of „event data“, which Facebook collects via the Facebook social plugins (and content embedding functions) running on our website, or which it receives as part of a transfer, for the following purposes: a) displaying content and advertising information tailored to users„ presumed interests; b) delivering commercial and transaction-related messages (e.g. contacting users via Facebook Messenger); c) improving ad delivery and the personalisation of features and content (e.g. improving the identification of which content or advertising information is likely to correspond to users“ interests). We have entered into a specific agreement with Facebook (‘Addendum for Controllers’, https://www.facebook.com/legal/controller_addendum), which sets out, in particular, the security measures that Facebook must comply with (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to fulfil the rights of data subjects (i.e. users can, for example, submit requests for information or erasure directly to Facebook). Note: Where Facebook provides us with metrics, analyses and reports (which are aggregated, i.e. contain no information on individual users and are anonymous to us), this processing does not take place within the framework of joint controllership, but on the basis of a data processing agreement („Data Processing Terms„, https://www.facebook.com/legal/terms/dataprocessing), the „Data Security Conditions“ (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of standard contractual clauses („Facebook–EU Data Transfer Addendum’, https://www.facebook.com/legal/EU_data_transfer_addendum). Users’ rights (in particular the right to access, erasure, objection and the right to lodge a complaint with the relevant supervisory authority) are not restricted by the agreements with Facebook; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/; Basis for transfers to third countries: Data Privacy Framework (DPF).
Google Fonts (loaded from the Google server): Retrieval of fonts (and symbols) for the purpose of ensuring the technically secure, maintenance-free and efficient use of fonts and symbols, taking into account their up-to-date status and loading times, their consistent display, and any licence restrictions. The font provider is provided with the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for the provision of the fonts depending on the devices used and the technical environment. This data may be processed on a server belonging to the font provider in the USA – when visiting our website, users„ browsers send HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving the fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) from Google Fonts and, subsequently, the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the User-Agent, which describes the browser and operating system versions of the website visitors, as well as the referrer URL (i.e. the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google’s servers, and they are not analysed. The Google Fonts Web API logs details of the HTTP requests (requested URL, User-Agent and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wishes to load fonts. This data is logged so that Google can determine how often a particular font family is requested. With the Google Fonts Web API, the user-agent must match the font generated for the respective browser type. The User-Agent is primarily logged for debugging purposes and used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the “Analytics’ page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and to generate an aggregated report on the top integrations based on the number of font requests. According to Google’s own information, Google does not use any of the information collected by Google Fonts to create profiles of end users or to serve targeted adverts; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://fonts.google.com/; Privacy Policy: https://business.safety.google/privacy/; Basis for transfers to third countries: Data Privacy Framework (DPF); Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
Google Maps: We embed maps from the „Google Maps“ service provided by Google. The data processed may include, in particular, users’ IP addresses and location data; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://business.safety.google/privacy/; Basis for transfers to third countries: Data Privacy Framework (DPF).
YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); Website: https://www.youtube.com; Privacy Policy: https://business.safety.google/privacy/; Basis for transfers to third countries: Data Privacy Framework (DPF); Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of adverts: https://myadcenter.google.com/personalizationoff.
Vimeo video player: Integration of a video player; service provider: Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://vimeo.com; Privacy Policy: https://vimeo.com/privacy; Data Processing Agreement: https://vimeo.com/legal/enterprise-terms/dpa; Basis for transfers to third countries: Standard contractual clauses (https://vimeo.com/legal/enterprise-terms/dpa).

Please delete the section on plugins and embedded functions and content if you do not use any plugins or embedded functions and content on your website. Otherwise, please amend the list of services and providers as required.

Deletion of data

We delete the personal data we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or there is no longer any legal basis for the processing. This applies to cases where the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule apply where legal obligations or specific interests require the data to be retained or archived for a longer period.

In particular, data which must be retained for commercial or tax law reasons, or where storage is necessary for the purposes of legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and erasure of data, which applies specifically to certain data processing operations.

Where there are several specifications regarding the retention period or deletion deadlines for a particular piece of data, the longest period shall always apply. We process data which is no longer retained for its originally intended purpose, but rather due to legal requirements or other reasons, exclusively for the purposes that justify its retention.

Please select this section on the retention and deletion of data if your registered office is in Germany:

Data retention and erasure under German law: The following general time limits apply to the retention and archiving of documents under German law:

10 years – retention period for books and records, annual accounts, inventories, management reports, opening balance sheets, as well as the working instructions and other organisational documents necessary for their understanding (Section 147(1)(1) in conjunction with (3) of the German Fiscal Code (AO), Section 14b(1) of the Value Added Tax Act (UStG), Section 257(1)(1) in conjunction with (4) of the Commercial Code (HGB)).
8 years – accounting documents, such as invoices and expense receipts (Section 147(1)(4) and (4a) in conjunction with paragraph 3, first sentence, of the German Fiscal Code (AO) and Section 257(1)(4) in conjunction with paragraph 4 of the German Commercial Code (HGB)).
6 years – Other business records: incoming commercial or business correspondence, copies of outgoing commercial or business correspondence, and other documents insofar as they are relevant for tax purposes, e.g. hourly pay slips, company accounting sheets, cost calculation documents, price labels, as well as payroll records, insofar as they are not already accounting vouchers, and till receipts (Section 147(1)(2), 3, 5 in conjunction with para. 3 of the General Tax Code (AO), Section 257(1)(2) and (3) in conjunction with para. 4 of the Commercial Code (HGB)).
3 years – data required to take into account potential warranty and compensation claims or similar contractual claims and rights, and to process related enquiries, based on previous business experience and standard industry practices, are stored for the duration of the standard statutory limitation period of three years (Sections 195 and 199 of the German Civil Code (BGB)).

Please select this section on the retention and deletion of data if your registered office is in Austria:

Data retention and erasure under Austrian law: The following general time limits apply under Austrian law to the retention and archiving of personal data, insofar as this is necessary to fulfil legal obligations or to safeguard legitimate interests:

7 years – Personal data processed in connection with tax-relevant business records is retained for a period of seven years in accordance with Section 132 of the Federal Tax Code (BAO) and Sections 190–212 of the Austrian Commercial Code (UGB). This includes, in particular, books and records, annual accounts, inventories, management reports, opening balance sheets, accounting vouchers, invoices, as well as commercial or business correspondence received and sent, and other documents relevant to tax collection. The period begins at the end of the calendar year for which the last entry was made and, where applicable, is extended for as long as the documents are relevant to pending tax proceedings.
3 years – Data required to assert, exercise or defend warranty claims, claims for damages or other contractual claims is stored for the duration of the applicable statutory limitation period. This is generally three years in accordance with Section 1489 of the Austrian Civil Code (ABGB), unless longer statutory retention obligations apply.

Changes to and updates of the privacy policy

We would ask you to check the content of our privacy policy regularly. We will update the privacy policy as soon as changes to our data processing activities make this necessary. We will inform you as soon as the changes require any action on your part (e.g. consent) or any other individual notification.

Where we provide addresses and contact details for companies and organisations in this privacy policy, please note that these details may change over time, including at short notice, and we ask that you check the details before making contact.

Rights of data subjects

As data subjects, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
Right of access: You have the right to request confirmation as to whether the data in question is being processed, and to request access to this data, as well as further information and a copy of the data, in accordance with the statutory requirements.
Right to rectification: In accordance with the statutory provisions, you have the right to request that the data relating to you be completed or that any inaccurate data relating to you be rectified.
Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to request that data relating to you be erased without delay or, alternatively, in accordance with the statutory provisions, to request that the processing of such data be restricted.
Right to data portability: You have the right to receive the personal data concerning you that you have provided to us, in accordance with the relevant legal provisions, in a structured, commonly used and machine-readable format, or to request that it be transferred to another data controller.
Complaint to the supervisory authority: You also have the right, in accordance with the statutory provisions, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place where the alleged infringement occurred, if you consider that the processing of your personal data infringes the GDPR.

Definitions of terms

This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from legislation and are defined, in particular, in Article 4 of the GDPR. The legal definitions are binding. The explanations below, however, are primarily intended to aid understanding. The terms are listed in alphabetical order.

Evaluation of the visitor campaign: „Conversion tracking“ refers to a method used to determine the effectiveness of marketing measures. To this end, a cookie is usually stored on users„ devices whilst they are on the websites where the marketing measures are carried out, and is then retrieved again on the target website. For example, this enables us to track whether the adverts we have placed on other websites have been successful.
Credit report: Automated decisions are based on automatic data processing without human intervention (e.g. in the case of the automatic rejection of a purchase on account, an online credit application or an online recruitment process without any human intervention). Under Article 22 of the GDPR, such automated decisions are only permitted if data subjects give their consent, if they are necessary for the performance of a contract, or if national laws permit such decisions.
Cross-device tracking: Cross-device tracking is a form of tracking in which information about users’ behaviour and interests is recorded across different devices in so-called profiles by assigning users an online identifier. This enables user information to be analysed, usually for marketing purposes, regardless of the browsers or devices used (e.g. mobile phones or desktop computers). With most providers, the online identifier is not linked to personally identifiable data, such as names, postal addresses or email addresses.
IP masking: The term „IP masking” refers to a method whereby the last octet – that is, the last two digits of an IP address – is deleted, so that the IP address can no longer be used to uniquely identify an individual. IP masking is therefore a means of pseudonymising data processing operations, particularly in online marketing.
Interest-based and behavioural marketing: Interest-based and/or behavioural marketing refers to the practice of predicting, as accurately as possible, users’ potential interests in adverts and other content. This is done on the basis of information about their previous behaviour (e.g. visiting and spending time on specific websites, purchasing behaviour or interaction with other users), which is stored in what is known as a profile. Cookies are generally used for these purposes.
Conversion tracking: Conversion tracking is a method used to determine the effectiveness of marketing activities. To do this, a cookie is usually stored on users’ devices whilst they are on the websites where the marketing activities take place, and is then retrieved again on the target website. For example, this enables us to track whether the adverts we have placed on other websites have been successful.
Personal data: „Personal data“ means any information relating to an identified or identifiable natural person (hereinafter referred to as the „data subject“); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Profiling: „Profiling“ refers to any form of automated processing of personal data which consists of using such personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the nature of the profiling, this may include information concerning age, gender, location data and movement data, interaction with websites and their content, purchasing behaviour, and social interactions with other people), or to predict them (e.g. interests in specific content or products, clicking behaviour on a website, or whereabouts). Cookies and web beacons are frequently used for profiling purposes.
Range measurement: Audience measurement (also known as web analytics) is used to analyse visitor traffic to an online service and may include the behaviour or interests of visitors in relation to specific information, such as website content. With the help of reach analysis, website owners can, for example, identify at what times visitors access their website and what content they are interested in. This enables them, for example, to better tailor the website’s content to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are frequently used to recognise returning visitors and thus obtain more accurate analyses of how an online service is used.
Remarketing: The terms „remarketing“ or „retargeting“ are used when, for example, a website records which products a user has shown an interest in for advertising purposes, in order to remind the user of those products on other websites, for example through adverts.
Location details: Location data is generated when a mobile device (or any other device with the technical capability to determine its location) connects to a mobile network cell, a Wi-Fi network or similar technical means and location-determination functions. Location data is used to indicate the geographically identifiable position on Earth at which the device in question is located. Location data can be used, for example, to display map functions or other location-dependent information.
Tracking: The term „tracking“ is used when users’ behaviour can be tracked across multiple online services. As a rule, information relating to behaviour and interests in connection with the online services used is stored in cookies or on the servers of the providers of tracking technologies (known as ‘profiling’). This information can then be used, for example, to display adverts to users that are likely to match their interests.
Data controller: The term „controller“ refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing: „Processing“ means any operation or set of operations which is carried out on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, whether it be collection, analysis, storage, transmission or erasure.
Target group identification: The term „target audience creation“ (or „Custom Audiences“) is used when target audiences are defined for advertising purposes, such as the display of adverts. For example, based on a user’s interest in specific products or topics on the internet, it can be inferred that this user would be interested in adverts for similar products or the online shop where they viewed those products. The term ‘Lookalike Audiences’ (or similar target groups) is used, on the other hand, when content deemed suitable is displayed to users whose profiles or interests are presumed to correspond to those of the users on whose profiles the Lookalike Audiences were based. Cookies and web beacons are generally used for the purpose of creating custom audiences and lookalike audiences.

Privacy policy

Privacy Policy

Introduction

Table of Contents

Data controller

Contact the Data Protection Officer

Overview of processing operations

Types of data processed

Categories of data subjects

Purposes of processing

Automated decisions in individual cases

Relevant legal bases

Safety measures

Transfer and disclosure of personal data

Data processing in third countries

Use of cookies

Business services

Payment service provider

Credit check

Provision of the online service and web hosting

Getting in touch

Newsletters and electronic notifications

Web analytics, monitoring and optimisation

Online marketing

Social media presence

Plugins, embedded functions and content

Deletion of data

Changes to and updates of the privacy policy

Rights of data subjects

Definitions of terms

Opening hours

Customer service

Legal information

Search

Company and contact details

Privacy Policy

Introduction

Table of Contents

Data controller

Contact the Data Protection Officer

Overview of processing operations

Types of data processed

Categories of data subjects

Purposes of processing

Automated decisions in individual cases

Relevant legal bases

Safety measures

Transfer and disclosure of personal data

Data processing in third countries

Use of cookies

Business services

Payment service provider

Credit check

Provision of the online service and web hosting

Getting in touch

Newsletters and electronic notifications

Web analytics, monitoring and optimisation

Online marketing

Social media presence

Plugins, embedded functions and content

Deletion of data

Changes to and updates of the privacy policy

Rights of data subjects

Definitions of terms

Login

Register

Company and contact details