Data Protection

Legal bases for the processing of personal data

Below, we provide information on the legal bases for the processing of personal data:

1. Where we have obtained your consent to the processing of personal data, Article 6(1), sentence 1, point (a) of the GDPR forms the legal basis.

2. If the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures taken at your request, the legal basis is Article 6(1), first sentence, point (b) of the GDPR.

3. If the processing is necessary to comply with a legal obligation to which we are subject (e.g. statutory retention obligations), the legal basis is Article 6(1), first sentence, point (c) of the GDPR.

4. Where processing is necessary to protect the vital interests of the data subject or of another natural person, the legal basis is Article 6(1), first sentence, point (d) of the GDPR.

5. If the processing is necessary to safeguard our legitimate interests or those of a third party, and your interests or fundamental rights and freedoms do not override those interests, then Article 6( 1), first sentence, point (f) of the GDPR is the legal basis.

Disclosure of personal data to third parties and data processors

As a general rule, we do not disclose any data to third parties without your consent. Should this nevertheless be the case, the disclosure shall take place on the basis of the aforementioned legal grounds, e.g. when data is disclosed to online payment providers for the fulfilment of a contract, or pursuant to a court order, or due to a legal obligation to disclose the data for the purposes of criminal prosecution, to avert danger, or to enforce intellectual property rights.

We also engage data processors (external service providers, e.g. for the web hosting of our websites and databases) to process your data. Where data is disclosed to data processors under a data processing agreement, this is always done in accordance with Article 28 of the GDPR. We select our data processors carefully, monitor them regularly and have secured the right to issue instructions regarding the data. Furthermore, the data processors must have implemented appropriate technical and organisational measures and must comply with data protection regulations in accordance with the BDSG (as amended) and the GDPR.

Data transfers to third countries

The adoption of the European General Data Protection Regulation (GDPR) has created a uniform framework for data protection in Europe. Your data is therefore primarily processed by organisations to which the GDPR applies. Should processing nevertheless take place via third-party services outside the European Union or the European Economic Area, these must fulfil the specific requirements of Articles 44 et seq. of the GDPR. This means that processing takes place on the basis of specific safeguards, such as the EU Commission’s official recognition of a level of data protection equivalent to that of the EU, or compliance with officially recognised specific contractual obligations, known as ‘standard contractual clauses’.

Insofar as, due to the invalidity of the so-called ‘Privacy Shield’, pursuant to Article 49(1), first sentence, point (a) of the GDPR, we draw your attention to the risk of covert access by US authorities and the use of the data for surveillance purposes, possibly without any means of redress for EU citizens.

Deletion of data and retention period

Unless expressly stated in this privacy policy, your personal data will be erased or restricted as soon as you withdraw the consent you have given for processing, or the purpose for which the data is stored no longer applies, or the data is no longer required for that purpose, unless its continued retention is necessary for evidential purposes or is precluded by statutory retention obligations. This includes, for example, commercial law retention obligations for business correspondence under Section 257(1) of the German Commercial Code (H GB (6 years) as well as tax law retention obligations under Section 147(1) of the AO for supporting documents (10 years). Once the prescribed retention period expires, your data will be blocked or deleted, unless storage is still required for the conclusion of a contract or for the performance of a contract.

Use of automated decision-making

We do not use automated decision-making or profiling.

Provision of our website and creation of log files

If you use our website purely for information purposes (i.e. without registering or otherwise submitting any information), we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data:

This data serves the purpose of providing you with a user-friendly, functional and secure website, including its features and content, as well as optimising the site and carrying out statistical analysis.

The legal basis for this is our legitimate interest in data processing, which is also based on the purposes set out above, in accordance with Article 6(1), first sentence, point (f) of the GDPR.

For security reasons, we store this data in server log files for a period of 70 days. Once this period has expired, the data is automatically deleted, unless we need to retain it for evidential purposes in the event of attacks on the server infrastructure or other legal infringements.

digitalocean.com for cloud hosting  

We use DigitalOcean.com for cloud hosting to provide a reliable and scalable server infrastructure. It enables the secure hosting and management of websites, applications and databases in the cloud. This service ensures that data is stored and processed efficiently whilst guaranteeing high availability and performance. Detailed information can be found in DigitalOcean.com’s Security and Privacy Policy: https://www.digitalocean.com/legal/privacy-policy

Cookies

We use so-called cookies when you visit our website. Cookies are small text files that your internet browser places and stores on your computer. When you visit our website again, these cookies transmit information to automatically recognise you. Cookies also include so-called ‘user IDs’, where user details are stored using pseudonymised profiles . When you visit our website, we inform you about the use of cookies for the aforementioned purposes and how you can object to this or prevent them from being stored (‘opt-out’) by means of a notice referring to our privacy policy.

A distinction is made between the following types of cookies:

• Necessary, essential cookies: Essential cookies are those that are absolutely necessary for the website to function in order to store certain website functions such as logins, shopping baskets or user preferences, e.g. regarding the website’s language.
• Session cookies: Session cookies are required to recognise repeated use of a service by the same user (e.g. if you have logged in, to determine your login status). When you visit our site again, these cookies provide information to automatically recognise you. The information obtained in this way is used to optimise our services and to make it easier for you to access our site. When you close your browser or log out, the session cookies are deleted.
• Persistent cookies: These cookies remain stored even after you close your browser. They are used to store your login details , measure website reach and for marketing purposes. These are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time via your browser’s security settings.
• Third-party cookies (particularly from advertisers): You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. However, we would like to point out at this stage that you may then be unable to use all the features of this website. Please refer to the respective privacy policies of the third-party providers for further details on these cookies.

1. Data categories: User data, cookies, user ID (in particular, pages visited, device information, access times and IP addresses).

2. Purposes of processing: The information obtained in this way serves to optimise our web services both technically and economically and to enable you to access our website more easily and securely.

3. Legal bases: If we process your personal data using cookies on the basis of your consent (‘opt-in’), then Article 6(1), first sentence, point (a) of the GDPR is the legal basis. Otherwise, we have a legitimate interest in the effective functionality, improvement and economic operation of the website, in which case Article 6(1), first sentence, point (f) of the GDPR applies. The legal basis is also Article 6(1), first sentence, point (b) of the GDPR if the cookies are set for the purpose of entering into a contract, e.g. when placing orders.

4. Retention period/deletion: The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case once the relevant session has ended. 

Chrome: https://support.google.com/chrome/ answer/95647

Safari: https:/ /support.apple.com/de-at/guide/safari/sfri11471/mac

Firefox: https://support.mozilla.org /de/kb/cookies-und-website-daten-in-firefox-loschen

Internet Explorer: h ttps://support.microsoft.com/de-at/help/17442/windows-internet-explorer-delete-m anage-cookies

Microsoft Edge: https://support.microsoft.com/de-at/help/4027947/windows-delete-c ookies

5. Objection and ‘opt-out’: You can generally prevent cookies from being stored on your hard drive, regardless of consent or legal authorisation, by selecting ‘do not accept cookies’ in your browser settings. However, this may result in a restriction of the functionality of our services. You can object to the use of third-party cookies for advertising purposes via an ‘opt-out’ on this US website (https://optout.aboutads.info) or this European website (http://www.youronlinechoices.com/de/praferenzmanagement/).

Edit cookie settings or opt out:

Link

Contract processing

1. We process master data (e.g. company, title/academic degree, names and addresses, as well as users’ contact details and email addresses), contract data (e.g. services used , names of contact persons) and payment data (e.g. bank details, payment history) for the purpose of fulfilling our contractual obligations (identifying the contracting party; establishing the grounds for, the substance of and the execution of the contract; checking the plausibility of the data) and the provision of services (e.g. contacting customer service) in accordance with Article 6(1), first sentence, point (b) of the GDPR. The fields marked as mandatory in online forms are required for the conclusion of the contract.

2. As a general rule, this data is not disclosed to third parties, unless it is necessary to pursue our claims (e.g. transfer to a solicitor for debt collection) or to fulfil the contract (e.g. transfer of data to a payment provider), or unless there is a legal obligation to do so in accordance with Article 6(1), first sentence, point (c) of the GDPR.

3. We may also process the data you have provided in order to inform you about other interesting products from our portfolio or to send you emails containing technical information.

4. The data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected. This applies to customer and contract data when the data is no longer required for the performance of the contract and no further claims arising from the contract can be asserted because they are time-barred (warranty: two years / standard limitation period: three years). We are obliged under commercial and tax law to store your address, payment and order details for a period of ten years. However, upon termination of the contract, we restrict the processing of your data after three years, i.e. your data will only be used to comply with legal obligations. Information in your user account remains there until it is deleted.

Online payment providers

1. When paying via “PayPal”, billing is handled by PayPal (Europe) S.àr.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, website: paypal.de, https://www.paypal.com/de/webapps/m pp/ua/privacy-full. 

2. For payments by credit card and bank transfer, billing is handled via “Mollie.de”, Mollie B.V, Keizersgracht 126, 1015CW Amsterdam, Netherlands, website: https://www.mollie.com/de/privacy.

2. The legal basis is Article 6(1) (b) of the GDPR, as the processing is necessary for the performance of a contract by the data controller. Furthermore, external online payment providers are used on the basis of Article 6(1)(f) of the GDPR, based on the legitimate interests of the data controller, in order to offer you payment options that are as secure, simple and varied as possible.

3. With regard to the retention period, the right to withdraw consent, the right to access data and the rights of data subjects, please refer to the online payment providers’ privacy policies set out above.

Contact via contact form / email / fax / post

1. When you contact us via the contact form, by fax, post or email, your details will be processed for the purpose of handling the enquiry.

2. The legal basis for processing the data, where you have given your consent, is Article 6(1), sentence 1(a) of the GDPR. The legal basis for processing data transmitted in the course of a contact enquiry or via email, letter or fax is Article 6(1), first sentence, point (f) of the GDPR. The data controller has a legitimate interest in processing and storing the data in order to respond to users’ enquiries, to preserve evidence for liability purposes and, where applicable, to comply with its statutory retention obligations regarding business correspondence. If the purpose of the contact is to conclude a contract, the additional legal basis for the processing is Article 6(1), first sentence, point (b) of the GDPR.

3. We may store your details and contact enquiry in our Customer Relationship Management system (‘CRM system’) or a comparable system.

4. The data will be erased as soon as it is no longer necessary for the purpose for which it was collected. For personal data entered via the contact form and that sent by email, this is the case once the relevant conversation with you has been concluded. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved. We store enquiries from users who have an account or a contract with us for a period of two years following the termination of the contract. In the case of statutory archiving obligations, deletion takes place once these have expired: at the end of the retention periods under commercial law (6 years) and tax law (10 years).

5. You may at any time withdraw your consent under Article 6 (1), first sentence, point (a) of the GDPR to the processing of personal data. If you contact us by email, you may object to the storage of your personal data at any time.

Contacting us by telephone

1. When you contact us by telephone, your telephone number will be processed for the purpose of handling your enquiry and its resolution, and will be temporarily stored or displayed in the RAM/cache of the telephone device/display. This storage is carried out for liability and security reasons, to provide evidence of the call, as well as for commercial reasons, to enable a call-back. In the case of unauthorised marketing calls, we will block the telephone numbers.

2. The legal basis for the processing of the telephone number is Article 6(1), first sentence, point (f) of the GDPR. If the purpose of the contact is to conclude a contract, the additional legal basis for the processing is Article 6(1), point (b) of the GDPR.

3. The device cache stores calls for 30 days and gradually overwrites or deletes old data; when the device is disposed of, all data is deleted and the storage medium is destroyed where necessary. Blocked telephone numbers are reviewed annually to assess whether the block is still necessary.

4. You can prevent your telephone number from being displayed by calling with your number withheld.

Newsletter

1. You can subscribe to our newsletter with your voluntary consent by entering your email address. Only this is mandatory. The provision of any further data is voluntary and serves only to enable us to address you personally. We use the so-called ‘double opt-in procedure’ for registration. After registering with your email address, you will receive an email from us containing a confirmation link to confirm your registration. If you click on this confirmation link, your email address will be added to the newsletter distribution list and stored for the purpose of sending emails. Should you fail to click on the confirmation link within 24 hours, your registration details will be blocked and automatically deleted after 30 days.

2. We also log the IP address you used during registration as well as the date and time of the double opt-in (registration and confirmation). The purpose of this storage is to fulfil legal requirements regarding proof of your registration and to prevent misuse of your email address.

3. As part of your declaration of consent, the content (e.g. advertised products/services, offers, advertising and topics) of the newsletter is described in detail.

4. We use the following email service provider to send emails: Mailchimp (Intuit Mailch imp, 405 N Angier Ave. NE, Atlanta, GA 30308, USA); their privacy policy can be found here: https://www.intuit.com/privacy/statement/. We have entered into a data processing agreement with the email service provider in accordance with Article 28 of the GDPR.

5. When sending the newsletter, we analyse your user behaviour. To this end, the newsletters contain so-called ‘web beacons’ or ‘tracking pixels’, which are activated when you open the newsletter. For the purposes of analysis, we link the web beacons to your email address and a unique ID. Links in the newsletter also contain this ID. The data is collected exclusively in pseudonymised form; the IDs are therefore not linked to your other personal data, and direct personal identification is ruled out. This data enables us to determine whether and when you have opened the newsletter and which links within the newsletter have been clicked. This serves the purpose of optimising and statistically analysing our newsletter.

6. The legal basis for sending the newsletter, measuring its effectiveness and storing the email address is your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR in conjunction with Section 7(2)(3) of the German Unfair Competition Act (UWG), and for the recording of your consent, Article 6( 1(1)(f) of the GDPR, as this serves our legitimate interest in legal verifiability.

7. You may object to tracking at any time by clicking the unsubscribe link at the end of the newsletter. In that case, however, you will also cease to receive the newsletter. If you disable the display of images in your email software, tracking is also not possible. This may, however, result in restrictions on the newsletter’s functionality, and any images it contains will then not be displayed.

8. You may withdraw your consent to receiving the newsletter at any time . You may do so by clicking the unsubscribe link at the end of the newsletter, or by sending an email or message to the contact details provided above. We will store your data for as long as you remain subscribed to the newsletter. Once you have withdrawn your consent, we will store your email address on a so-called blacklist to prevent you from receiving future mailings. The legal basis for this is Article 6(1)(f) of the GDPR.

Competitions

1. For the purpose of running prize draws, your email address is stored so that we can contact you and, should you win, your address details are stored so that we can send you your prize. Your address details may be passed on to a delivery service provider. The data will not be disclosed to any other third parties. Participation in the prize draw is open to those aged 18 and over.

2. The legal basis is Article 6(1), first sentence, point (b) of the GDPR. The data will be deleted two months after the winner has been determined.

Google AdWords with conversion tracking

1. We use the ‘Google Ads with Conversion Tracking’ service (service provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) to draw attention to our website via adverts on third-party websites.

2. Data categories and description of data processing: usage data/communication data. When you click on one of our Google adverts , a cookie is stored in your browser, which remains valid for approximately 30 days. If you subsequently visit our website, both we and Google can use the cookie to determine whether you have visited our website and which pages you have viewed there. Google compiles statistics based on this. The data is also transferred to the USA and analysed there. If you are logged in to a Google account, AdWords can associate the data with your account. If you do not wish this to happen, you must log out before visiting our website.

3. Purpose of data processing: This conversion tracking serves the purpose of analysis/performance measurement, optimisation and the cost-effective operation of our advertising and website.

4. Legal basis: If you have given your consent (‘opt-in’) to the processing of your personal data via ‘Google Ads with conversion tracking’, then Article 6(1)(a) of the GDPR forms the legal basis. Otherwise, the legal basis for the processing of your data is our legitimate interest in the analysis, optimisation and efficient commercial operation of our advertising and website in accordance with Article 6(1), first sentence, point (f) of the GDPR.

5. Data transfer/category of recipients: Google Ireland.

6. Retention period: up to 540 days

7. Options to object and opt out: You can object to or prevent the installation of cookies by Google in various ways.

8. Further information can be found in Google’s Privacy Policy at https://policies.google.com/priva cy?hl=de&gl=de and https://services.google.com/sitestats/de.html. 

Google Analytics Remarketing / ‘Similar Audiences’

1. We use the Google Analytics Remarketing / ‘Similar Audiences’ service (service provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) to draw attention to our website via adverts on third-party websites and other online platforms. There is joint responsibility between Google and us regarding data processing in accordance with Article 26 of the GDPR. We have agreed with Google that we shall assume primary responsibility under the GDPR for the processing of the data and shall fulfil all obligations under the GDPR with regard to the processing of the data (including, amongst others, Articles 12 and 13 of the GDPR, Articles 15 to 22 of the GDPR and Articles 32 to 34 of the GDPR).

2. Categories of data and description of data processing: usage data/communication data. Using the remarketing or ‘Similar Audiences’ function in Ads, we can reach you there if you have already visited our website and address you with a relevant message via an advert. Remarketing enables us to bring our previous visitors back to our website with a single click. If you subsequently visit other websites or online services, we and Google can use the cookie to determine whether you have already visited our website and display our adverts to you there as well. Google compiles statistics on this basis. We are not aware of the full extent of the data processing involved. The data is also transferred to the USA and analysed there . According to Google, the data collected through remarketing is not merged with any personal data you may have stored with Google , but is instead processed using pseudonyms.

3. Purpose of processing: This remarketing serves the purpose of analysing, optimising and ensuring the efficient operation of our advertising and website.

4. Legal bases: If you have given your consent (‘opt-in’) to the processing of your personal data via ‘Google Ads Remarketing’ or ‘Similar Audiences’, then Article 6(1) sentence 1(a) of the GDPR is the legal basis. Otherwise, the legal basis for the processing of your data is our legitimate interest in the analysis, optimisation and efficient commercial operation of our advertising and website in accordance with Article 6(1), first sentence, point (f) of the GDPR.

5. Data transfer /category of recipients: Google Ireland.

6. Retention period: When you visit certain pages on our site, a cookie is stored in your browser, which remains valid for 30 days.

7. Options to object and opt out: You can object to or prevent the installation of cookies by Google in various ways:

• You can block cookies in your browser by selecting the “do not accept cookies” setting, which also includes third-party cookies;
  
• You can disable personalised advertisements directly via Google using the link https://adssettings.google.com; however, this setting will only remain in effect until you delete your cookies.
  
• You can disable personalised adverts from third-party providers participating in the ‘About Ads’ advertising self-regulatory initiative via the link https://optout.aboutads.info for US websites or via http://www.youronlinechoices.com/de/pra conference-management/ for EU websites, although this setting will only remain in effect until you delete all your cookies;
  
• You can permanently disable cookies using a browser plug-in for Chrome, Firefox or Internet Explorer via the link https://support.google.com/ads/answer/7395996. Disabling cookies may mean that you are no longer able to make full use of all the features of our website.
  

8. Further information can be found in Google’s privacy policy at https://policies.google.com/privacy?hl=de&gl=de

Plerdy Heatmap Tool

1. We use the Plerdy Heatmap Tool to analyse user behaviour on a website. It provides insights into how visitors use the site by showing which areas are clicked on particularly frequently or which elements attract the most attention. This data helps to improve the website’s user-friendliness without storing or processing any personal information.

2. Plerdy places great importance on protecting users’ privacy and does not store any personal data entered into the website’s fields. Plerdy’s commitment to data integrity and protection is underpinned by the fact that all its servers are located in Germany, a country known for its strict data protection laws. Plerdy strictly adheres to its security and privacy policies to ensure the highest standards of data protection and security. Detailed information can be found in Plerdy’s security and privacy policies: https://www.plerdy.com/faq/ ; https://www.plerdy.com/privacy-policy/

Facebook Custom Audience

1. On our website, we use the ‘Custom Audiences’ remarketing feature provided by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are based in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

2. Data categories and description of data processing: IP address, cookie ID, location information. If you visit the Facebook social network or other websites that use this remarketing feature, you may be shown interest-based adverts (Facebook Ads). We use the remarketing feature to optimise and run our website efficiently, to show you adverts that are as relevant to your interests as possible, and to make our website more user-friendly. When you visit our website, your browser establishes a connection to Facebook’s servers. However, Facebook receives the information that you have viewed or clicked on a relevant advert. If you are logged into Facebook at the time, Facebook can associate this information with your account. With regard to processing by Facebook, please read Facebook’s Privacy Policy at https://www.facebook.com/policy.php. Specific information and details about the Facebook Pixel and how it works can be found in Facebook’s Help Centre: https://www.facebook.com/business/ help/651294705016616.

3. Purpose of processing: Display of personalised advertising, measurement and evaluation of advertising, billing for advertising, analysis of viewing behaviour.

4. Legal bases: If you have given your consent (‘opt-in’) to the processing of your personal data via ‘Custom Audiences’ by the third-party provider, then Article 6(1), first sentence, point (a) of the GDPR is the legal basis. The legal basis is also our legitimate interest in data processing, which is also inherent in the purposes set out above, in accordance with Article 6(1), first sentence, point (f) of the GDPR.

5. Retention period: Facebook grants us access to this data for 180 days.

6. Data transfer/category of recipients: Facebook Ireland.

7. Right to object (“opt-out”): Logged-in users can deactivate the “Facebook Custom Audiences” feature via this link: https://www.facebook.com/sett ings/?tab=ads#.

Google Analytics

1. We have integrated the website analytics tool ‘Google Analytics’ (service provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) into our website. With regard to the use of the data, Google and we share joint responsibility for data processing in accordance with Article 26 of the GDPR. We have agreed with Google that we shall assume primary responsibility under the GDPR for the processing of the data and shall fulfil all obligations under the GDPR with regard to the processing of the data (including, amongst others, Articles 12 and 13 of the GDPR, Articles 15 to 22 of the GDPR and Articles 32 to 34 of the GDPR). 

2. Categories of data and description of data processing: User ID, IP address (anonymised). When you visit our website, Google places a cookie on your computer to analyse your use of our website . We have enabled the IP anonymisation feature ‘anonymizeIP’ , which means that IP addresses are only processed in truncated form. On this website, your IP address is therefore truncated by Google beforehand within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website and internet usage to the data controller. We have also enabled cross-device analysis of website visitors, which is carried out using a so-called user ID. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. Further information on data usage in Google Analytics can be found here: https://www.google.com/analytics/ter ms/de.html (Analytics Terms of Service), https://support.google.com/analytics/answer/6004245?hl=de (Information on data protection in Analytics) and Google’s Privacy Policy https://pol icies.google.com/privacy.

3. Purpose of processing: Google Analytics is used for the purpose of analysing, optimising and improving our website.

4. Legal basis: If you have given your consent to the processing of your personal data by means of “ Google Analytics’ (“opt-in”), then Article 6(1), first sentence, point (a) of the GDPR forms the legal basis. The legal basis is also our legitimate interest, in line with the purposes set out above (the analysis, optimisation and improvement of our website), in the processing of data pursuant to Article 6(1), first sentence, point (f) of the GDPR. For services provided in connection with a contract, the tracking and analysis of user behaviour is carried out in accordance with Article 6(1), first sentence, point (b) of the GDPR, in order to use the information obtained thereby to offer optimised services for the fulfilment of the purpose of the contract.

5. Retention period: The data sent by us and linked to cookies, user identifiers (e.g. user ID) or advertising IDs is automatically deleted after 14 months. Data for which the retention period has expired is automatically deleted once a month.

6. Data transfer/recipient categories: Google, Ireland and the USA. We have also entered into a data processing agreement with Google in accordance with Article 28 of the GDPR .

7. Options to object and opt out:

• You can generally prevent cookies from being stored on your hard drive by selecting ‘do not accept cookies’ in your browser settings. However, this may result in a restriction of the functionality of our services. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website, as well as prevent Google from processing this data, by downloading and installing the browser plug-in available via the following link: http://tools.google.com/ dlpage/gaoptout?hl=de
• As an alternative to the browser plug-in mentioned above, you can prevent data collection by Google Analytics by clicking [__please insert the Analytics opt-out link for your website here__] . Clicking this link sets an ‘opt-out’ cookie, which prevents the collection of your data when you visit this website in future. This cookie applies only to our website and your current browser, and remains in place only until you delete your cookies. In that case, you would need to set the cookie again.
• You can disable cross-device user analysis in your Google Account under ‘My data > Personal data’. 

YouTube videos

1. We have embedded YouTube videos from youtube.com on our website using the embed function, so that they can be accessed directly on our website. YouTube is owned by Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland.

2. Data category and description of data processing: usage data (e.g. webpages visited, content and access times). We have embedded the videos in what is known as ‘enhanced privacy mode’, without using cookies to track usage behaviour for the purpose of personalising video playback. Instead, video recommendations are based on the video currently being played. Videos played in enhanced privacy mode in an embedded player do not affect which videos are recommended to you on YouTube. When you start a video (by clicking on it), you consent to YouTube tracking the fact that you have visited the relevant subpage or viewed the video on our website, and to YouTube using this data for advertising purposes.

3. Purpose of processing: To provide a user-friendly service, and to optimise and improve our content.

4. Legal bases: If you have given your consent (‘opt-in’) to the processing of your personal data via the third-party provider ‘etracker’, then Article 6(1), first sentence, point (a) of the GDPR forms the legal basis. The legal basis is also our legitimate interest in data processing, as set out in the purposes above, in accordance with Article 6(1), first sentence, point (f) of the GDPR. B For services provided in connection with a contract, the tracking and analysis of user behaviour is carried out in accordance with Article 6(1), first sentence, point (b) of the GDPR in order to use the information obtained thereby to offer optimised services for the fulfilment of the purpose of the contract.

5. Data transfer/categories of recipients: Third-party providers in the USA. The data collected is transferred to the USA and stored there. This takes place even without a Google user account. If you are logged into your Google account, Google may associate the above data with your account. If you do not wish this to happen, you must log out of your Google account. Google creates user profiles from such data and uses this data for the purposes of advertising, market research or optimising its websites.

6. Retention period: Cookies for up to 2 years or until the cookies are deleted by you as the user.

7. Objection: You have the right to object to Google creating user profiles. Please contact Google directly via the privacy policy link provided below. You can opt out of advertising cookies here in your Google account: https://adssetti ngs.google.com/authenticated.

Google reCAPTCHA

1. We have integrated the ‘reCAPTCHA’ anti-spam function from ‘Google’ (provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) into our website.

2. Data category and description of data processing: usage data (e.g. webpage visited, IP address). By using ‘reCAPTCHA’ in our forms, we can determine whether the input was made by a machine (bot) or a human. When using the service, your IP address and, where applicable, any other data required for this purpose may be transferred to Google servers in the USA.

3. Purpose of processing: To prevent spam and misuse, and to further our legitimate business interest in optimising our website.

4. Legal basis: If you have given your consent (‘opt-in’) to the processing of your personal data via ‘reCAPTCHA’ by the third-party provider, then Article 6(1), first sentence, point (a) of the GDPR forms the legal basis. The legal basis is also our legitimate interest in data processing, as set out in the above purposes, pursuant to Article 6(1), first sentence, point (f) of the GDPR.

5. Data transfer/categories of recipients: third-party providers in the USA.

6. Retention period: until the cookies are deleted by you as the user.

7. Further information on Google reCAPTCHA can be found at https://www.google.com/recaptcha and in Google’s Privacy Policy at: https://policies.google.com/privacy.

Google Maps

1. We have integrated maps from ‘Google Maps’ (provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) into our website.

2. Data category and description of data processing: usage data (e.g. IP address, location, page accessed). Google Maps enables us to display the location of addresses and directions directly on our website via interactive maps, thereby allowing you to use this tool. When you access a page on our website where Google Maps is integrated, a connection is established with Google’s servers in the USA. In doing so, your IP address and location may be transmitted to Google. In addition, Google receives the information that you have accessed the relevant page. This occurs even if you do not have a Google user account. If you are logged into your Google account, Google may associate the above data with your account. If you do not wish this to happen, you must log out of your Google account. Google creates user profiles from such data and uses this data for the purposes of advertising, market research or optimising its websites.

3. Purpose of processing: To provide a user-friendly, cost-effective and optimised website.

4. Legal basis: If you have given your consent (‘opt-in’) to the processing of your personal data via ‘Google Maps’ from the third-party provider, then Article 6(1), first sentence, point (a) of the GDPR is the legal basis. The legal basis is also our legitimate interest in data processing, in line with the purposes set out above, pursuant to Article 6(1), first sentence, point (f) of the GDPR.

5. Data transfer/categories of recipients: Third-party providers in the USA.

6. Retention period: Cookies for up to 6 months or until you delete them. Otherwise, as soon as they are no longer required for the purposes of processing.

7. Right to object and right to have data erased: You have the right to object to Google creating user profiles. Please contact Google directly via the privacy policy link provided below. You can opt out of advertising cookies here in your Google Account: https://adssettings.google.com/authenticated.

8.Further information on the use of Google cookies and its advertising technologies, retention periods, anonymisation, location data, how they work and your rights. Google’s general privacy policy: https://policies.google.com/privacy.

Social media presence

1. We maintain profiles or fan pages on social media. When you use and access our profile on the relevant network, the respective privacy policy and terms of use of that network apply.

2. Data categories and description of data processing:usage data, contact details, content data, inventory data. Furthermore, users’ data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behaviour and the resulting interests. These user profiles may in turn be used, for example, to display adverts both within and outside the networks that are presumed to correspond to users’ interests . For these purposes, cookies are generally stored on users’ computers, in which users’ usage behaviour and interests are recorded. Furthermore, data may also be stored in the usage profiles independently of the devices used by users (in particular, if users are members of the respective platforms and are logged in to them). For a detailed description of the respective forms of processing and the options for opting out, please refer to the privacy policies and information provided by the operators of the respective networks. In the case of requests for information and the exercise of data subjects’ rights, we would also point out that these can most effectively be exercised with the providers. Only the providers have access to users’ data in each case and can take appropriate measures directly and provide information. Should you nevertheless require assistance, you may contact us.

3. Purpose of processing: Communication with users who are connected to and registered on social networks; providing information and advertising our products, offers and services; promoting our brand and maintaining our image; evaluating and analysing users and content on our social media presence.

4. Legal bases: The legal basis for the processing of personal data is our legitimate interest in the purposes set out above, in accordance with Article 6(1), first sentence, point (f) of the GDPR. Insofar as you have given your consent to us or to the controller of the social network for the processing of your personal data, the legal basis is Article 6(1), first sentence, point (a) in conjunction with Article 7 of the GDPR.

5. Data transfer/categories of recipients: social network.

6. The privacy notices, options for obtaining information and options to object (opt -out) for the respective networks/service providers can be found here:

Rights of the data subject

1. Objection or withdrawal of consent to the processing of your data: