Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the provision of our services and especially on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offerings”).

The terms used are not gender-specific.

As of: September 19, 2023

Table of Contents

• Preamble
• Controller
• Overview of Processing Activities
• Relevant Legal Bases
• Security Measures
• Transfer of Personal Data
• International Data Transfers
• Data Deletion
• Rights of Data Subjects
• Use of Cookies
• Business Services
• Provision of Online Offerings and Web Hosting
• Community Functions
• Blogs and Publication Media
• Contact and Inquiry Management
• Communication via Messengers
• Newsletters and Electronic Notifications
• Advertising Communication via Email, Mail, Fax, or Telephone
• Contests and Competitions
• Surveys and Questionnaires
• Web Analysis, Monitoring, and Optimization
• Online Marketing
• Affiliate Programs and Affiliate Links
• Customer Reviews and Rating Processes
• Presence on Social Networks (Social Media)
• Plugins and Embedded Features and Content
• Changes and Updates to the Privacy Policy
• Definition of Terms

Controller

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of Processed Data

• Inventory data.
• Payment data.
• Location data.
• Contact details.
• Content data.
• Contract data.
• Usage data.
• Meta, communication, and process data.
• Event data (Facebook).

Categories of Data Subjects Customers

• Prospective customers.
• Communication partners.
• Users.
• Contest and competition participants.
• Business and contractual partners.
• Participants.

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.
• Contact inquiries and communication.
• Security measures. Direct marketing.
• Reach measurement.
• Tracking. Office and organizational procedures. Conversion tracking.
• Affiliate tracking.
• Management and response to inquiries.
• Conducting contests and competitions.
• Feedback.
• Marketing.
• Profiles with user-related information.
• Provision of our online offerings and user-friendliness.
• Information technology infrastructure.

Relevant Legal Bases

Relevant legal bases under the GDPR:

Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or domicile. Furthermore, specific legal bases may apply in individual cases, which we will inform you about in the privacy policy.

• Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures requested by the data subject.
• Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection in Germany apply. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special provisions regarding the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transmission as well as automated individual decision-making, including profiling. In addition, data protection laws of individual German states may apply.

Reference to the applicability of the GDPR and the Swiss Data Protection Act: These data protection notices serve both the information requirements of the Swiss Federal Data Protection Act (Schweizer DSG) and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that, due to the broader geographical scope and comprehensibility, the terms of the GDPR are used. In particular, the terms “processing” of “personal data,” “legitimate interest,” and “special categories of data,” used in the GDPR, are used instead of the terms “processing” of “personal data,” “overriding legitimate interest,” and “particularly sensitive personal data” used in the Swiss DSG. However, the legal significance of the terms is still determined in accordance with the Swiss DSG within the scope of the applicability of the Swiss DSG.

Security measures

We implement suitable technical and organizational measures, taking into account legal requirements, the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as the access, input, transmission, availability, and separation thereof. Furthermore, we have established procedures to ensure the exercise of data subject rights, the erasure of data, and responses to data breaches. We also consider the protection of personal data during the development or selection of hardware, software, and procedures in accordance with the principle of data protection, by design, and by default privacy settings.

IP Address Anonymization: If IP addresses are processed by us or by the service providers and technologies we use, and processing the full IP address is not required, the IP address is anonymized (also known as “IP masking”). This involves removing the last two digits or the last part of the IP address after a dot, or replacing them with placeholders. The anonymization of the IP address is intended to prevent or significantly hinder the identification of a person based on their IP address.

TLS Encryption (https): To protect data transmitted via our online services, we use TLS encryption. You can recognize such encrypted connections by the “https://” prefix in your browser’s address bar.

Transmission of Personal Data

In the course of our processing of personal data, it may be necessary to transmit or disclose data to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, IT service providers or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with data recipients to protect your data.

International Data Transfers

Data Processing in Third Countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if data processing occurs as part of the use of third-party services or the disclosure or transmission of data to other individuals, entities, or companies, this is only done in accordance with legal requirements. If the data protection level in the third country has been recognized through an adequacy decision (Art. 45 GDPR), this serves as the basis for data transfer. Otherwise, data transfers are only made when the data protection level is otherwise guaranteed, especially through standard contractual clauses (Art. 46(2)(c) GDPR), explicit consent, or in the case of contractual or legally required data transfer (Art. 49(1) GDPR). We will inform you about the basis for third-country data transfers with specific providers from the third country, with adequacy decisions being the primary basis. Information on third-country transfers and existing adequacy decisions can be found in the European Commission’s information portal: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en.

EU-US Trans-Atlantic Data Privacy Framework: As part of the “Data Privacy Framework” (DPF), the EU Commission has also recognized the data protection level for certain companies in the USA in the context of the adequacy decision of July 10, 2023, as safe. The list of certified companies as well as further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/. We will inform you in our data protection notices about which service providers certified under the Data Privacy Framework we use.

Data Deletion

The data processed by us will be deleted in accordance with legal requirements as soon as the consents for processing that are required for processing are revoked or other permissions are no longer applicable (e.g., if the purpose of processing this data no longer applies or they are not necessary for the purpose). If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons or whose storage is necessary to assert, exercise, or defend legal claims or to protect the rights of another natural or legal person. Our data protection notices may also provide further information on the storage and deletion of data that is primarily applicable to the respective processing.

Rights of Data Subjects

Rights of data subjects under the GDPR: You have various rights as data subjects under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

• Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to Withdraw Consent: You have the right to withdraw your consent at any time.
• Right of Access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, access to the personal data and additional information as required by law.
• Right to Rectification: You have the right to obtain the rectification of inaccurate personal data concerning you. Right to Erasure and Restriction of Processing: You have the right to request the erasure of personal data concerning you under the conditions laid down by law or to request the restriction of processing of your personal data.
• Right to Data Portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, or to request its transmission to another controller, in accordance with the law.
• Right to Lodge a Complaint with a Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Use of Cookies

Cookies are small text files or other storage methods that store information on end devices and retrieve information from end devices. For example, they can be used to store login status in a user account, shopping cart contents in an online shop, accessed content, or functions used in an online service. Cookies can also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as for analyzing visitor traffic.

Information on Consent: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users unless it is not legally required. Consent is not typically required when storing and retrieving information, including cookies, is absolutely necessary to provide users with a telemedia service they explicitly requested (i.e., our online offering). Typically, strictly necessary cookies include cookies with functions related to displaying and ensuring the functionality of the online offering, load balancing, security, storing user preferences, and choices or similar purposes related to providing the main and ancillary functions of the online offering requested by users. The revocable consent is clearly communicated to users and contains information about the respective cookie usage.

Information on Legal Basis for Data Processing: The legal basis for processing users’ personal data using cookies depends on whether we ask for user consent. If users consent, the legal basis for processing their data is the consent provided. Otherwise, data processed using cookies is based on our legitimate interests (e.g., in the economic operation of our online offering and improving its usability) or, if cookies are necessary to fulfill our contractual obligations, on the necessity of using cookies to fulfill our contractual obligations. We clarify the purposes for which cookies are processed during this privacy policy or as part of our consent and processing procedures.

Storage Duration: Regarding the storage duration, the following types of cookies are distinguished:

• Temporary Cookies (also known as session or session cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes their end device (e.g., browser or mobile application).
• Persistent Cookies: Persistent cookies remain stored even after closing the end device. For example, login status can be saved, or preferred content can be displayed directly when a user revisits a website. Data collected from users through cookies can also be used for reach measurement. If we do not provide explicit information about the type and storage duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are permanent and can have a storage duration of up to two years.

General Information on Revocation and Objection (Opt-Out): Users can revoke their given consent at any time and object to data processing in accordance with legal requirements. To do so, users can restrict the use of cookies in their browser settings (although this may also limit the functionality of our online offering). Users can also object to the use of cookies for online marketing purposes through the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional Information on Processing Procedures, Methods, and Services:

• BorlabsCookie: Cookie consent management; Service provider: Hosted locally on our server, no data sharing with third parties; Website: https://de.borlabs.io/borlabs-cookie/. Additional Information: An individual user ID, language, types of consents, and the time of their submission are stored server-side and in the cookie on users’ devices.

Please note that this translation is provided for informational purposes, and for legal or compliance purposes, it’s advisable to consult with a legal expert or attorney familiar with data protection laws in your jurisdiction to ensure that your cookie policy complies with applicable regulations.

Business Services

We process data of our contractual and business partners, e.g., customers and prospects (collectively referred to as “contractual partners”), as part of contractual and similar legal relationships, as well as related measures and in the context of communication with contractual partners (or pre-contractually), for example, to respond to inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, the obligations to provide the agreed-upon services, any obligations for updates, and remedies for warranty and other performance disruptions. Furthermore, we process the data to protect our rights and for the purpose of administrative tasks associated with these obligations and company organization. Additionally, we process the data based on our legitimate interests in proper and efficient business management, as well as security measures to protect our contractual partners and our business operations from misuse, data exposure, secrets, information, and rights (e.g., for the involvement of telecommunications, transportation, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers, or financial authorities). Under applicable law, we only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about other forms of processing, such as for marketing purposes, as part of this privacy policy.

We share with contractual partners which data is necessary for the aforementioned purposes before or during data collection, e.g., in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks), or in person.

We delete the data after the expiration of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account or must be retained for legal archiving reasons. The statutory retention period is ten years for documents relevant to tax law and for commercial books, inventories, opening balances, annual financial statements, the documents required for understanding these documents, and organizational documents, as well as booking vouchers. The retention period for received commercial and business letters and copies of outgoing commercial and business letters is six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance, the annual financial statement, or the management report was prepared, the commercial or business letter was received, or the commercial or business letter was sent, or the booking voucher was created, and the recording was made, or the other documents were created.

If we use third-party providers or platforms to provide our services, the terms and privacy policies of the respective third-party providers or platforms apply in the relationship between users and providers.

• Processed Data Types: Inventory data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., email, telephone numbers); Contract data (e.g., contract object, term, customer category); Usage data (e.g., visited websites, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Data Subjects: Prospects; Business and contractual partners; Customers.
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Contact inquiries and communication; Office and organizational procedures; Management and response to inquiries; Conversion measurement (measurement of the effectiveness of marketing measures); Profiles with user-related information (creation of user profiles).
• Legal Bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legal obligation (Art. 6(1)(c) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Additional Information on Processing Procedures, Methods, and Services:

• Economic analyses and market research: For business reasons and to identify market trends, the wishes of contractual partners and users, we analyze the data we have on business transactions, contracts, inquiries, etc., which may include contractual partners, prospects, customers, visitors, and users of our online offering in the group of data subjects. The analyses are carried out for the purpose of business evaluations, marketing, and market research (e.g., to determine customer groups with different characteristics). We may consider the profiles of registered users, including their information, e.g., on services used. The analyses are solely for our benefit and are not disclosed externally, unless they are anonymous analyses with aggregated, thus anonymized values. Furthermore, we respect the privacy of users and process the data for analytical purposes as pseudonymous and, if possible, anonymously (e.g., as aggregated data); Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
• Agency services: We process the data of our customers as part of our contractual services, which may include conceptual and strategic consulting, campaign planning, software and design development/consulting or maintenance, campaign implementation, process handling, server administration, data analysis/consulting services, and training services; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).
• Project and development services: We process the data of our customers and clients (collectively referred to as “customers”) to enable them to select, purchase or commission the chosen services or works, as well as related activities, and to provide them for payment and provision or execution; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Provision of Online Services and Web Hosting

We process user data in order to provide them with our online services. To achieve this, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Processed Data Types: Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status); Content data (e.g., entries in online forms).
• Data Subjects: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices such as computers, servers, etc.); Security measures; Provision of contractual services and fulfillment of contractual obligations.
• Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional Information on Processing Procedures, Methods, and Services:

• Provision of online services on rented storage space: For the provision of our online offering, we use storage space, computing capacity, and software that we rent or otherwise obtain from an appropriate server provider (also referred to as “web hoster”); Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
• Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files.” Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transmitted, message about successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure the utilization and stability of the servers; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that must be retained for evidence purposes is exempt from deletion until the respective incident is finally clarified.
• Email dispatch and hosting: The web hosting services we use also include the sending, receiving, and storage of emails. For these purposes, the addresses of recipients and senders, as well as other information concerning email transmission (e.g., the participating providers) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not encrypted when sent over the internet. While emails are usually encrypted during transport, they are not encrypted on the servers from which they are sent and received unless end-to-end encryption is used. Therefore, we cannot assume responsibility for the transmission of emails between the sender and our server; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
• 1&1 IONOS: Services in the field of information technology infrastructure provision and related services (e.g., storage space and/or computing capacity); Service provider: 1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.ionos.de; Privacy Policy: https://www.ionos.de/terms-gtc/terms-privacy. Data Processing Agreement: https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/auftragsverarbeitung/.

Community Functions

The community functions provided by us allow users to engage in conversations or exchange information with each other. Please note that the use of community functions is only permitted in compliance with applicable laws, our terms and policies, and the rights of other users and third parties.

• Processed Data Types: Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Data Subjects: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Security measures.
• Legal Basis: Contractual performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Blogs and Publishing Media

We use blogs or similar means of online communication and publication (hereinafter referred to as “publishing media”). Reader data is processed for the purposes of the publishing medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For further information on the processing of visitors to our publishing medium, please refer to the information in these privacy notices.

• Processed Data Types: Inventory data (e.g., names, addresses); Contact data (e.g., email, telephone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Data Subjects: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Feedback (e.g., collecting feedback via online form); Provision of our online offering and user-friendliness; Security measures; Management and response to inquiries.
• Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional Information on Processing Procedures, Methods, and Services:

Comments and Contributions: When users leave comments or other contributions, their IP addresses may be stored on the basis of our legitimate interests. This is done for our protection in case someone leaves unlawful content in comments and contributions (e.g., insults, prohibited political propaganda). In this case, we may be held responsible for the comment or contribution and are therefore interested in the identity of the author.

Furthermore, we reserve the right to process user information for spam detection based on our legitimate interests.

On the same legal basis, we reserve the right to store users’ IP addresses for the duration of surveys and to use cookies to prevent multiple votes. The information provided by users in comments and contributions, such as personal information, contact information, website information, as well as content information, is permanently stored by us until users object.

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Contact and Inquiry Management

When contacting us (e.g., by post, contact form, email, telephone, or via social media) as well as within the scope of existing user and business relationships, the information provided by the inquiring individuals is processed to the extent necessary to respond to the contact inquiries and any requested actions.

• Processed Data Types: Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Data Subjects: Communication partners.
• Purposes of Processing: Contact inquiries and communication; Management and response to inquiries; Feedback (e.g., collecting feedback via online form); Provision of our online offering and user-friendliness.
• Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR); Contractual performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Additional Information on Processing Procedures, Methods, and Services:

• Contact Form: When users contact us via our contact form, email, or other communication methods, we process the data provided in this context to handle the stated request. Legal bases: Contractual performance and pre-contractual inquiries (Art. 6(1)(b) GDPR), Legitimate interests (Art. 6(1)(f) GDPR).

Communication via Messengers

We use messengers for communication purposes, and therefore, we kindly ask you to consider the following information regarding the functionality of messengers, encryption, the use of metadata in communication, and your options for objection.

You can also contact us through alternative means, such as by phone or email. Please use the contact information provided to you or the contact options specified within our online offering.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we would like to point out that communication contents (i.e., the content of the message and attached images) are encrypted end-to-end. This means that the content of the messages is not visible, not even by the messenger providers themselves. You should always use an up-to-date version of the messenger with encryption enabled to ensure the encryption of message contents.

However, we also inform our communication partners that messenger providers may not be able to view the content but can determine whether and when communication partners communicate with us and process technical information about the communication partner’s device and, depending on the settings of their device, location information (metadata).

Legal Bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for processing their data is their consent. Otherwise, if we do not request consent and communication partners contact us, we use messengers in relation to our contractual partners and within the framework of contract initiation as a contractual measure, and in the case of other interested parties and communication partners, based on our legitimate interests in fast and efficient communication and meeting the communication needs of our communication partners. Furthermore, we would like to point out that we do not transmit contact data to messengers without your consent.

• Processed Data Types: Contact data (e.g., email, phone numbers); Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers).
• Data Subjects: Communication partners.
• Purposes of Processing: Contact inquiries and communication; Direct marketing (e.g., via email or postal mail).
• Legal Bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Newsletter and Electronic Notifications