Envelope Youtube Linkedin Xing

Translation notice: This English version is a translation of the German privacy policy and is provided for convenience only. In the event of any discrepancy or ambiguity, the German version is authoritative.

Preamble

With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to as “data”) we process for which purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of the provision of our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”).

The terms used are not gender-specific.

Status: 20. March 2023

Legal text by Dr Schwenke – click for more information.

Content overview

Controller

Florian Kaiser
Gärtnerstraße 52
20253 Hamburg
Germany

Email address:

kontakt@florian-kaiser-consulting.de

Phone:

+49(0) 15258909835

Legal notice:

florian-kaiser-consulting.de/impressum

Overview of processing operations

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

  • Master data.
  • Payment data.
  • Location data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta, communication and procedural data.
  • Image and/or video recordings.

Special categories of data

  • Health data.
  • Data on sex life or sexual orientation.
  • Religious or ideological beliefs.
  • data showing racial and ethnic origin.

Categories of data subjects

  • Customers.
  • employees.
  • Prospective customers.
  • Communication partners.
  • Users.
  • business and contractual partners.
  • Persons depicted.

Purposes of processing

  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • security measures.
  • Direct marketing.
  • Reach measurement.
  • Tracking.
  • Office and organisational procedures.
  • Conversion measurement.
  • Click tracking.
  • A/B-Tests.
  • Management and response to requests.
  • Feedback.
  • Heatmaps.
  • surveys and questionnaires.
  • Marketing.
  • Profiles with user-related information.
  • Provision of our online offer and user-friendliness.
  • Information technology infrastructure.

Relevant legal basis

In the following, you will find an overview of the legal bases of the GDPR, on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or domicile. If more specific legal bases are also relevant in individual cases, we will inform you of them in the privacy policy.

  • Consent (Art. 6 Abs. 1 S. 1 lit. a) GDPR)– The data subject has given his or her consent to the processing of personal data concerning him or her for a specific purpose or several specific purposes.
  • Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR)– The processing is necessary for the performance of a contract of which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the data subject.
  • Legal obligation (Art. 6 Abs. 1 S. 1 lit. c) GDPR)– The processing is necessary to fulfill a legal obligation to which the controller is subject.
  • Legitimate interests (Article 6(1)(f) GDPR)– The processing is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data predominate.

In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes in particular the Act on Protection against Misuse of Personal Data in Data Processing (Bundedatenschutzgesetz – BDSG). The BDSG contains in particular special provisions on the right to access, the right to erasure, the right to object, the processing of special categories of personal data, the processing for other purposes and the transmission as well as automated decision-making in individual cases including profiling. Furthermore, it regulates data processing for the purposes of the employment relationship (§ 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships and the consent of employees. Furthermore, state data protection laws of the individual federal states can be applied.

Security measures

In accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, extent, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

Measures shall include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to, access to, input, disclosure, availability and segregation of data. We have also set up procedures to ensure the exercise of data subjects’ rights, the deletion of data and the response to the threat to data. Furthermore, we already take into account the protection of personal data during development or Selection of hardware, software and procedures in accordance with the principle of data protection, technology design and data protection-friendly presets.

Shortening of the IP address: If IP addresses are processed by us or by the service providers and technologies used and the processing of a complete IP address is not necessary, the IP address will be shortened (also referred to as “IP masking”). In this case, the last two digits or the last part of the IP address after a point are removed or replaced by placeholders. By shortening the IP address, the identification of a person based on his or her IP address is to be prevented or made significantly more difficult.

TLS encryption (https): In order to protect your data transmitted via our online offer, we use TLS encryption. You recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission of personal data

As part of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and in particular conclude corresponding contracts or agreements that protect your data with the recipients of your data.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing in the context of the use of third-party services or disclosure or The transfer of data to other persons, bodies or companies takes place only in accordance with the legal requirements.

Subject to express consent or contractually or legally required transmission, we only process or have the data processed in third countries with a recognized level of data protection, contractual obligation by so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission):https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of data

The data we process will be deleted in accordance with the legal requirements as soon as their consents allowed for processing are revoked or other permissions are waived (e.g. if the purpose of the processing of this data is waived or they are not necessary for the purpose). If the data are not deleted because they are necessary for other and legally permitted purposes, their processing will be limited to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be kept for commercial or tax reasons or whose storage is necessary for asserting, exercising or defending legal claims or for protecting the rights of another natural or legal person.

Our data protection notice may also contain further information on the storage and deletion of data that applies primarily to the respective processing operations.

Use of cookies

Cookies are small text files or other storage notes that store information on terminals and read information from the terminals. For example, to store the login status in a user account, a shopping cart content in an e-shop, the accessed content or used functions of an online offer. Cookies can also be used for various purposes, e.g. for the purposes of the functionality, security and convenience of online offers as well as the creation of analyses of visitor flows.

Consent notes:We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users, unless this is not required by law. In particular, consent is not necessary if the storage and reading of the information, i.e. also of cookies, are absolutely necessary in order to provide the users with a telemedia service expressly desired by them (i.e. our online offer). The revocable consent is clearly communicated to the users and contains the information about the respective cookie use.

Information on the data protection legal basis: On which data protection legal basis we process the personal data of users with the help of cookies depends on whether we ask users for consent. If the users consent, the legal basis for the processing of your data is the declared consent. Otherwise, the data processed with the help of cookies will be processed on the basis of our legitimate interests (e.g. in a business operation of our online offer and improving its usability) or, if this takes place in the context of the fulfillment of our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. For which purposes the cookies are processed by us, we clarify in the course of this privacy policy or in the context of our consent and processing processes.

Storage period: With regard to storage time, the following types of cookies are distinguished:

  • Temporary cookies (also: session or session cookies):Temporary cookies are deleted at the latest after a user has left an online offer and closed his/her terminal (e.g. browser or mobile application).
  • Persistent cookies:Permanent cookies remain stored even after closing the end device. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, the user data collected with the help of cookies can be used for range measurement. Unless we provide users with explicit information about the type and storage period of cookies (e.g. in the context of obtaining consent), users should assume that cookies are permanent and the storage period can be up to two years.

General information on revocation and objection (opt-out):Users can revoke the consents given by them at any time and also object to the processing in accordance with the legal requirements in art. 21 GDPR. Users can also explain their objection via the settings of their browser, e.g. by deactivating the use of cookies (which may also limit the functionality of our online services). An objection to the use of cookies for online marketing purposes may also be made through the websiteshttps://optout.aboutads.infoandhttps://www.youronlinechoices.com/are explained.

Further information on processing processes, procedures and services:

  • Processing of cookie data based on consent:We use a procedure for cookie consent management, in the context of which the consents of the users in the use of cookies or the processing and providers mentioned in the context of the cookie consent management procedure can be obtained and managed and revoked by the users. Here, the declaration of consent is stored in order not to have to repeat its query again and to be able to prove the consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or using comparable technologies) in order to be able to assign the consent to a user or his device. Subject to individual information about the providers of cookie management services, the following information applies: The duration of storage of the consent can be up to two years. Here, a pseudonymous user identifier is formed and stored with the time of consent, information about the scope of the consent (e.g. which categories of cookies and / or service providers) as well as the browser, system and used device.
  • BorlabsCookie: Cookie-Consents-Management; Service provider: Hosted locally on our server; no data is shared with third parties; Website: https://de.borlabs.io/borlabs-cookie/; Further information:An individual user ID, language and types of consents and the time of their submission are stored on the server side and in the cookie on the user’s device.

Business services

We process data of our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”) in the context of contractual and comparable legal relationships as well as associated measures and in the context of communication with the contractual partners (or pre-contractual), e.g. to answer inquiries.

We process this data in order to fulfill our contractual obligations. This includes in particular the obligations to provide the agreed services, any update obligations and remedy in the event of warranty and other service disruptions. In addition, we process the data for the protection of our rights and for the purpose of the administrative tasks associated with these obligations as well as the company organization. In addition, we process the data on the basis of our legitimate interests in proper and business management as well as in security measures for the protection of our contractual partners and our business operations against misuse, endangerment of their data, secrets, information and rights (e.g. for the participation of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal consultants, payment service providers or financial authorities). Within the framework of applicable law, we only pass on the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. Further forms of processing, e.g. for marketing purposes, will be notified to the contractual partners within the framework of this privacy policy.

Which data are necessary for the aforementioned purposes, we inform the contractual partners before or in the context of data collection, e.g. in online forms, by special marking (e.g. colors) or symbols (e.g. starlets or similar), or personally.

We delete the data after expiry of legal warranty and comparable obligations, i.e., in principle after expiry of 4 years, unless the data is stored in a customer account, e.g., as long as they have to be kept for legal reasons of archiving. The statutory retention period for tax-relevant documents as well as for trading books, inventories, opening balance sheets, annual financial statements, the work instructions and other organizational documents and accounting documents required to understand these documents is ten years, as well as six years for received commercial and business letters and reproductions of the sent commercial and business letters. The period shall begin on the expiry of the calendar year in which the last entry was made in the book, the inventory, the opening balance, the annual accounts or the management report was drawn up, the commercial or business letter was received or sent, the accounting document was produced, the record was made or the other documents were produced.

Insofar as we use third parties or platforms to provide our services, the terms and conditions and data protection notices of the respective third parties or platforms apply in the relationship between the users and the providers.

  • Types of data processed:Stock data (e.g. names, addresses); Payment data (e.g. bank details, invoices, payment history); contact details (e.g. e-mail, telephone numbers); Contract data (e.g. subject matter of the contract, duration, customer category); usage data (e.g. visited websites, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).
  • Special Categories of Personal Data:health data (Article 9(1) GDPR); data on sexual life or sexual orientation (Article 9(1) GDPR); Religious or ideological convictions (Article 9(1) GDPR); Data showing racial and ethnic origin (Article 9(1) GDPR).
  • Data subjects:interested parties; business and contractual partners; Customers.
  • Purposes of processing:provision of contractual services and customer service; contact requests and communication; office and organisational procedures; management and response to requests; Conversion measurement (measurement of the effectiveness of marketing measures); Profiles with user-related information (creation of user profiles).
  • Legal basis:Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR); Legal obligation (Art. 6 para 1 s. 1 lit. c) GDPR); Legitimate interests (Art. 6 para 1 s. 1 lit. f) GDPR.

Further information on processing processes, procedures and services:

  • Economic Analysis and Market Research:For business reasons and in order to be able to identify market trends, wishes of the contractual partners and users, we analyze the data available to us on business transactions, contracts, inquiries, etc., whereby the group of affected persons may include contractual partners, interested parties, customers, visitors and users of our online offer.The analyses are carried out for the purpose of business evaluations, marketing and market research (e.g. to determine customer groups with different characteristics). If available, we can take into account the profiles of registered users and their information, e.g. regarding services used. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with summarized, i.e. anonymized values. Furthermore, we respect the privacy of users and process the data for the analysis purposes as pseudonymously and, if possible, anonymously (e.g. as aggregated data);Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Coaching: We process the data of our clients as well as interested parties and other clients or contractual partners (uniformly referred to as “clients”) in order to be able to provide our services to them. The processed data, the type, the scope, the purpose and the necessity of their processing are determined by the underlying contractual and client relationship.In the course of our activities, we may also process special categories of data, in particular data relating to the health of clients, where applicable with regard to their sexual life or sexual orientation, as well as data relating to racial and ethnic origin, political opinions, religious or ideological beliefs or trade union membership. For this purpose, we obtain express consent from the clients where necessary and otherwise process the special categories of data insofar as this serves the health of the clients, the data is public or other legal permissions are available.If it is necessary for our contract performance, for the protection of vital interests or by law, or if there is a consent of the clients, we disclose or transmit the data of the clients to third parties or agents, such as authorities, billing offices as well as in the area of IT, office or comparable services, in compliance with the professional regulations;Legal basis:Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR.
  • Consulting: We process the data of our clients, clients as well as interested parties and other clients or contractual partners (uniformly referred to as “clients”) in order to be able to provide our consulting services to them. The processed data, the type, the scope, the purpose and the necessity of their processing are determined by the underlying contractual and client relationship.If it is necessary for our contract performance, for the protection of vital interests or by law, or if there is a consent of the clients, we disclose or transmit the data of the clients to third parties or agents, such as authorities, subcontractors or in the field of IT, office or comparable services, in compliance with the professional regulations;Legal basis:Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR.
  • Brokerage and intermediation services:We process the data of our customers, clients and interested parties (uniformly referred to as “customers”) according to the underlying order of the customers. We may also process information about the characteristics and circumstances of persons or property belonging to them if this is part of our order. This can be, for example, information on personal living circumstances, mobile or immobile property and the financial situation.If necessary for the fulfilment of the contract or by law or authorized by the customers or based on our legitimate interests, we disclose or transmit the data of the customers in the context of coverage requests, conclusions and processing of contracts to providers of the brokered services / objects, insurers, reinsurers, broker pools, technical service providers, other service providers, such as cooperating associations, as well as financial service providers, credit institutions and investment companies as well as social insurance institutions, tax authorities, tax consultants, legal consultants, auditors, insurance ombudsmen and the Federal Financial Supervisory Authority (BaFin). Furthermore, subject to other agreements, we may engage subcontractors, such as sub-intermediaries;Legal basis:Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR.
  • Business consulting: We process the data of our customers, clients and interested parties and other clients or contractual partners (uniformly referred to as “customers”) in order to be able to provide them with our contractual or pre-contractual services, in particular consulting services. The processed data, the type, the scope, the purpose and the necessity of their processing are determined by the underlying contractual and business relationship.If it is necessary for our contract performance or legally, or if there is a consent of the customers, we disclose or transmit the data of the customers to third parties or agents, such as authorities, courts or in the field of IT, office or comparable services, in compliance with the professional regulations;Legal basis:Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR.

Providers and services used in the course of business activities

As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (shortly “Services”) in compliance with the legal requirements. Their use is based on our interests in the proper, lawful and economical management of our business operations and our internal organization.

  • Types of data processed: Master data (z.B. Namen, Adressen); Payment data (z.B. Bankverbindungen, Rechnungen, Zahlungshistorie); Contact data (z.B. E-Mail, Telefonnummern); Content data (z.B. Eingaben in Onlineformularen); Contract data (z.B. Vertragsgegenstand, Laufzeit, Customerskategorie).
  • Data subjects:customers; interested parties; Users (e.g. website visitors, users of online services); business and contractual partners; Employees (e.g. employees, applicants, former employees).
  • Purposes of processing:provision of contractual services and customer service; Office and organisational procedures.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

Provision of the online offer and web hosting

We process the data of the users in order to make our online services available to them. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

  • Types of data processed:usage data (e.g. visited websites, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time, identification numbers, consent status); Content data (e.g. entries in online forms).
  • Data subjects:Users (e.g. website visitors, users of online services).
  • Purposes of processing:provision of our online offer and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical equipment (computer, server, etc.); security measures.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

  • Provision of the Online Service Using Rented Hosting Space: For the provision of our online offer, we use storage space, computing capacity and software that we rent or otherwise purchase from a corresponding server provider (also called “web host”);Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Collection of access data and logfiles:Access to our online offer is logged in the form of so-called “server log files”. The server logfiles can include the address and name of the retrieved web pages and files, date and time of retrieval, transferred data quantities, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.The server log files can be used on the one hand for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the loading of the servers and their stability;Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Deletion of data:Logfile information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is necessary for the purposes of evidence are exempted from deletion until the event is finally resolved.
  • Email delivery and hosting:The web hosting services we use also include the sending, receiving and storage of e-mails. For these purposes, the addresses of the recipients and senders as well as further information regarding the e-mail dispatch (e.g. the participating providers) as well as the contents of the respective e-mails are processed. The aforementioned data may also be processed for the purposes of identifying SPAM. Please note that emails are generally not sent encrypted on the Internet. As a rule, e-mails are encrypted on the transport route, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. Therefore, we cannot take responsibility for the transmission of e-mails between the sender and the reception on our server;Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Content-Delivery-Network: We use a content delivery network (CDN). A CDN is a service by means of which content of an online offer, in particular large media files such as graphics or program scripts, can be delivered faster and more securely using servers distributed regionally and connected via the Internet;Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Raidboxes: services related to the provision of information technology infrastructure and related services (e.g. storage and/or computing capacity);Service provider:RAIDBOXES GmbH, Hafenstraße 32, 48153 Münster, Germany;Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://raidboxes.io/; Privacy policy: https://raidboxes.io/datenschutzerklaerung/; Data processing agreement: https://helpcenter.raidboxes.de/de/articles/1947634-auftragsverarbeitungsvertrag-av.

Blogs and publication media

We use blogs or comparable means of online communication and publication (hereinafter “Publication Medium”). The data of the readers are processed for the purposes of the publication medium only to the extent that it is necessary for its presentation and communication between authors and readers or for reasons of security. In addition, we refer to the information on the processing of visitors to our publication medium within the framework of this data protection notice.

  • Types of data processed:Stock data (e.g. names, addresses); contact details (e.g. e-mail, telephone numbers); Content data (e.g. input in online forms); usage data (e.g. visited websites, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).
  • Data subjects:Users (e.g. website visitors, users of online services).
  • Purposes of processing:provision of contractual services and customer service; feedback (e.g. collecting feedback via online form); Provision of our online offer and user-friendliness.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Contact and request management

When contacting us (e.g. by post, contact form, e-mail, telephone or via social media) as well as in the context of existing user and business relationships, the information of the requesting persons is processed as far as this is necessary to answer the contact requests and any requested measures.

  • Types of data processed:contact details (e.g. e-mail, telephone numbers); Content data (e.g. input in online forms); usage data (e.g. visited websites, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).
  • Data subjects: Communication partners.
  • Purposes of processing:contact requests and communication; management and response to requests; feedback (e.g. collecting feedback via online form); Provision of our online offer and user-friendliness.
  • Legal basis:Legitimate interests (Art. 6 para 1 s. 1 lit. f) GDPR); Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR.

Further information on processing processes, procedures and services:

  • Contact form: If users contact us via our contact form, e-mail or other means of communication, we process the data provided to us in this context in order to process the requested information;Legal basis:Contract performance and pre-contractual inquiries (Art. 6 para 1 s. 1 lit. b) GDPR), Legitimate interests (Art. 6 para 1 s. 1 lit. f) GDPR.

Newsletter with Brevo

On my website I have the possibility to subscribe to a free newsletter. For shipping I use the serviceBrevoBrevo GmbH, Köpenicker Str. 126, 10179 Berlin (subsidiary of Brevo SAS, Paris, France).

Data Provided:Only your e-mail address is mandatory. Further information (first name, company, role) is voluntary and is used exclusively for personal addressing and segmentation.

Legal Basis:The processing is based on your consent according toArticle 6(1)(a) GDPR in conjunction with Section 7(2), no. 3 UWG.

Double-Opt-In:The application is made in the double opt-in procedure. After registration, you will receive an e-mail with the request to confirm the registration. Only after confirmation will your e-mail address be added to the distributor.

Logging:IP address, time of registration and confirmation are stored in order to be able to prove the registration in accordance with legal requirements.

Statistical analysis:The newsletters contain a so-called counting pixel and personalized links. With these I measure if and when newsletters are opened and which links are clicked on. The analysis serves exclusively the statistical optimization of the content.

Storage period:Your data will be stored as long as you have subscribed to the newsletter. After unsubscribing, your data will be deleted from the active distributor and – to prove the original consent – placed on a block list.

Data processing on behalf of the controller:With Brevo I have a contract for order processing in accordance with Art. 28 GDPR closed. Data processing takes place within the European Union (server locations Germany and France).

Withdrawal:You can revoke your consent at any time with effect for the future – either via the unsubscription link in every newsletter e-mail or by message tokontakt@florian-kaiser-consulting.de. The legality of the processing carried out until the revocation remains unaffected.

Further information: Privacy policy of Brevo

Communication via Messenger

We use messengers for communication purposes and therefore ask you to observe the following information about the functionality of messengers, encryption, the use of the communication metadata and your objection options.

You can also contact us in alternative ways, e.g. by phone or e-mail. Please use the contact options communicated to you or the contact options provided within our online offer.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we point out that the communication content (i.e., the content of the message and attached images) is encrypted from end to end. This means that the content of the messages is not visible, not even by the messenger providers themselves. You should always use a current version of Messenger with encryption enabled to ensure encryption of the message content.

However, we also point out to our communication partners that the messenger providers do not see the content, but can find out that and when communication partners communicate with us, as well as technical information about the device used by the communication partners and, depending on the settings of their device, location information (so-called metadata) is processed.

Information on the legal basis: If we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. Incidentally, if we do not ask for consent and e.g. contact us on our own initiative, we use Messenger in relation to our contractual partners as a contractual measure and in the case of other interested parties and communication partners on the basis of our legitimate interests in a fast and efficient communication and fulfillment of the needs of our communication partner in communication via Messenger. Furthermore, we point out that we do not transmit the contact data provided to us for the first time to Messenger without your consent.

Revocation, objection and deletion:You can revoke a given consent at any time and object to communication with us via Messenger at any time. In the case of communication via messenger, we delete the messages in accordance with our general deletion guidelines (i.e., e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise, as soon as we can assume that we have answered any information of the communication partners, if no reference to a previous conversation is expected and the deletion does not conflict with any statutory storage obligations.

Subject to reference to other means of communication:Finally, we would like to point out that for reasons of your security, we reserve the right not to answer requests via Messenger. This is the case if, for example, contract internals require special secrecy or a response via Messenger does not meet the formal requirements. In such cases, we refer you to more adequate means of communication.

  • Types of data processed:contact details (e.g. e-mail, telephone numbers); usage data (e.g. visited websites, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time, identification numbers, consent status); Content data (e.g. entries in online forms).
  • Data subjects: Communication partners.
  • Purposes of processing:contact requests and communication; Direct marketing (e.g. by e-mail or by post).
  • Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) GDPR); Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

Video conferencing, online meetings, webinars and screen sharing

We use platforms and applications of other providers (hereinafter referred to as “conference platforms”) for the purposes of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter referred to collectively as “conference”). When selecting conference platforms and their services, we observe the legal requirements.

Data processed by conference platforms:When participating in a conference, the conference platforms process the personal data of the participants referred to below. The scope of the processing depends on the one hand on which data are requested in the context of a specific conference (e.g. input of access data or real names) and which optional data are provided by the participants. In addition to the processing for the implementation of the conference, the data of the participants can also be processed by the conference platforms for security purposes or service optimization. The processed data includes data on the person (first name, last name), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, information on the professional status/function, the IP address of the Internet access, information on the subscribers’ terminals, their operating system, the browser and its technical and language settings, information on the content communication processes, i.e. inputs in chats as well as audio and video data, as well as the use of other available functions (e.g. surveys). Contents of the communications are encrypted to the extent technically provided by the conference providers. If the participants are registered with the conference platforms as users, then further data can be processed in accordance with the agreement with the respective conference provider.

Logging and recording:If text inputs, participation results (e.g. surveys) as well as video or audio recordings are logged, this will be communicated transparently to the participants in advance and they will be asked for consent if necessary.

Data protection measures of the participants:Please refer to the details of the processing of your data by the conference platforms and select the optimal security and data protection settings for you within the settings of the conference platforms. Please also provide for the duration of a video conference for data and privacy protection in the background of your recording (e.g. by informing roommates, locking doors and using, as far as technically possible, the function to unrecognize the background). Links to the conference rooms and access data may not be passed on to unauthorized third parties.

Information on the legal basis:If, in addition to the conference platforms, we also process the data of the users and ask the users for their consent to the use of the conference platforms or certain functions (e.g. consent to a recording of conferences), the legal basis of the processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g. in participant lists, in the case of processing of conversation results, etc.). In addition, the data of the users is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

  • Types of data processed:Stock data (e.g. names, addresses); contact details (e.g. e-mail, telephone numbers); Content data (e.g. input in online forms); usage data (e.g. visited websites, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).
  • Data subjects:communication partners; Users (e.g. website visitors, users of online services); Persons depicted.
  • Purposes of processing:provision of contractual services and customer service; contact requests and communication; Office and organisational procedures.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

Cloud services

We use software services accessible via the Internet and executed on the servers of their providers (so-called “cloud services”, also known as “software as a service”) for the storage and management of content (e.g. document storage and management, exchange of documents, content and information with certain recipients or publication of content and information).

In this context, personal data can be processed and stored on the servers of the providers, as far as they are part of communication processes with us or are otherwise processed by us, as described in the context of this privacy policy. These data may include in particular master data and contact data of the users, data on processes, contracts, other processes and their content. The cloud service providers also process usage data and metadata used by them for security purposes and service optimization.

If we provide forms or documents and content for other users or publicly accessible websites with the help of the cloud services, the providers can store cookies on users’ devices for web analysis purposes or in order to remember user settings (e.g. in the case of media control).

  • Types of data processed:Stock data (e.g. names, addresses); contact details (e.g. e-mail, telephone numbers); Content data (e.g. input in online forms); usage data (e.g. visited websites, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time, identification numbers, consent status); Image and/or video footage (e.g. photographs or video footage of a person).
  • Data subjects:customers; Employees (e.g. employees, applicants, former employees); interested parties; communication partners.
  • Purposes of processing:office and organisational procedures; Information technology infrastructure (operation and provision of information systems and technical equipment (computer, server, etc.); Provision of contractual services and customer service.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

Web analysis, monitoring and optimization

The web analysis (also referred to as “range measurement”) serves to evaluate the visitor flows of our online offer and may include behavior, interests or demographic information about the visitors, such as age or gender, as pseudonymous values. With the help of the reach analysis, we can identify, for example, at which time our online offer or its functions or contents are most frequently used or invite for reuse. We can also understand which areas require optimization.

In addition to web analysis, we can also use test procedures to test and optimize different versions of our online offer or its components.

Unless otherwise stated below, profiles, i.e. data combined for a use process, can be created for these purposes and information stored in a browser or in a terminal device and read out from it. The information collected includes in particular visited websites and elements used there as well as technical information such as the browser used, the computer system used and information on times of use. If users have agreed to the collection of their location data to us or to the providers of the services we use, location data can also be processed.

The IP addresses of the users are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear data of the users (such as e-mail addresses or names) are stored in the context of web analysis, A/B testing and optimization, but pseudonyms. This means that we and the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

  • Types of data processed:usage data (e.g. visited websites, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).
  • Data subjects:Users (e.g. website visitors, users of online services).
  • Purposes of processing:range measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles); Tracking (e.g. interest/behavioural profiling, use of cookies); provision of our online offer and user-friendliness; Click tracking; A/B tests; Heatmaps (mouse movements on the part of users, which are combined to form an overall image).
  • Security measures:IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) GDPR).

Further information on processing processes, procedures and services:

  • Google Analytics: web analysis, range measurement and user flow measurement;Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (guarantee of data protection level for processing in third countries): https://business.safety.google/adsprocessorterms; Possibility of objection (opt-out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements:https://adssettings.google.com/authenticated; Further information: https://privacy.google.com/businesses/adsservices(Types of processing and data processed).
  • Google Analytics 4: We use Google Analytics to measure and analyze the use of our online offer based on a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to assign analytical information to a terminal device in order to recognize which content the users have accessed within one or different usage processes, which search terms they have used, re-accessed or interacted with our online offer. Likewise, the time of use and its duration are stored, as well as the sources of the users who refer to our online offer and technical aspects of their devices and browsers. Pseudonymous profiles of users with information from the use of different devices are created, whereby cookies can be used. In Analytics, higher-level geographic location data is provided by collecting the following metadata using IP search: “city” (and the city’s derived latitude and longitude), “continent”, “country”, “region”, “subcontinent” (and the ID-based equivalents). To ensure the protection of user data in the EU, Google receives and processes all user data via domains and servers within the EU. The IP address of the users is not logged and is shortened by the last two digits by default. The shortening of the IP address takes place on EU servers for EU users. In addition, all sensitive data collected by EU users will be deleted before it is collected through EU domains and servers;Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Standard contractual clauses (guarantee of data protection level for processing in third countries): https://business.safety.google/adsprocessorterms; Possibility of objection (opt-out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements:https://adssettings.google.com/authenticated; Further information: https://privacy.google.com/businesses/adsservices(Types of processing and data processed).
  • Google Analytics im Consentsmodus: In consent mode, personal data of users are processed by Google for measurement and advertising purposes, depending on the consent of users. Consent is obtained from users as part of our online services. If the consent of the users is completely missing, the data will only be processed at an aggregated (i.e. not individually assigned and summarized) level. If the consent includes only the statistical measurement, no personal data of the users will be processed for the display or the measurement of the advertising success (so-called “conversion”);Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) GDPR); Website: https://support.google.com/analytics/answer/9976101?hl=de.
  • Hotjar Observe: Software for the analysis and optimization of online offers based on pseudonymous measurements and analyses of user behavior, which may include in particular A/B tests (measurement of the popularity and user-friendliness of different content and functions), measurement of click distances and interaction with content and functions of the online offer (so-called heatmaps and recordings);Service provider: Hotjar Ltd., 3 Lyons Range, 20 Bisazza Street, Sliema SLM 1640, Malta ; Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) GDPR); Website: https://www.hotjar.com; Privacy policy: https://www.hotjar.com/legal/policies/privacy; Deletion of data:The cookies used by Hotjar have a different “lifetime”; some remain valid for up to 365 days, some only during the current visit; Cookie Policy:https://www.hotjar.com/legal/policies/cookie-information; Possibility of objection (opt-out): https://www.hotjar.com/legal/compliance/opt-out.

Customer reviews and evaluation procedures

We participate in review and evaluation procedures to evaluate, optimize and promote our services. If users evaluate us via the participating rating platforms or procedures or otherwise provide feedback, the General Terms and Conditions of Use and the privacy policy of the providers apply in addition. As a rule, the evaluation also requires registration with the respective providers.

In order to ensure that the rating persons have actually used our services, we transmit the necessary data with regard to the customer and the service used to the respective rating platform (including name, e-mail address and order number or article number) with the consent of the customers. This data is used solely to verify the authenticity of the user.

  • Types of data processed:Contract data (e.g. subject matter of the contract, duration, customer category); usage data (e.g. visited websites, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).
  • Data subjects:customers; Users (e.g. website visitors, users of online services).
  • Purposes of processing:feedback (e.g. collecting feedback via online form); Marketing.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

Presence in social networks (social media)

We maintain online presences within social networks and process user data in order to communicate with the users active there or to offer information about us.

We point out that data of users can be processed outside the European Union. This can lead to risks for users, because, for example, the enforcement of users’ rights could be made more difficult.

Furthermore, the data of users within social networks is usually processed for market research and advertising purposes. For example, user profiles can be created based on the user behavior and the resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks, which presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the computers of the users, in which the user behavior and the interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (in particular if the users are members of the respective platforms and are logged into them).

For a detailed presentation of the respective processing forms and the opt-out, we refer to the privacy policys and information of the operators of the respective networks.

Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, you can contact us.

  • Types of data processed:contact details (e.g. e-mail, telephone numbers); Content data (e.g. input in online forms); usage data (e.g. visited websites, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).
  • Data subjects:Users (e.g. website visitors, users of online services).
  • Purposes of processing:contact requests and communication; feedback (e.g. collecting feedback via online form); Marketing.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

  • Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
  • Facebook Pages: Profiles within the social network Facebook – Together with Meta Platforms Ireland Limited, we are responsible for the collection (but not the further processing) of data of visitors to our Facebook page (so-called “fan page”). This information includes information about the types of content that users view or interact with or the actions they take (see “Things made and provided by you and others” in the Facebook Data Policy):https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; See “Device Information” in the Facebook Data Policy:https://www.facebook.com/policy) As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, so-called “page insights”, to page operators to gain insights into how people interact with their pages and with the content associated with them. We have entered into a special agreement with Facebook (“Information on page insights”),https://www.facebook.com/legal/terms/page_controller_addendum), which in particular regulates which security measures Facebook must observe and in which Facebook has agreed to comply with the data subject rights (i.e. users can e.g. address information or deletion requests directly to Facebook. The rights of users (in particular to access, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information on page insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (guarantee of data protection level for processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: Joint controller agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. The joint responsibility is limited to the collection by and transfer of data to Meta Platforms Ireland Limited, an EU based company. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • Facebook events: Event profiles within the social network Facebook – We use the “events” function of the Facebook platform to refer to events and dates, to contact users (participants and interested parties) and to exchange information. In doing so, we process personal data of the users of our event pages, as far as this is necessary for the purpose of the event page and its moderation. These data include information on first and last names, as well as published or privately communicated content, as well as values for the status of the participation as well as the times for the aforementioned data. We also refer to the processing of user data by Facebook itself. This information includes information about the types of content that users view or interact with or the actions they take (see “Things made and provided by you and others” in the Facebook Data Policy):https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; See “Device Information” in the Facebook Data Policy:https://www.facebook.com/policy) As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, known as “Insights”, to event providers to provide insights into how people interact with their event pages and with the content associated with them;Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy.
  • LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Data processing agreement: https://legal.linkedin.com/dpa; Standard contractual clauses (guarantee of data protection level for processing in third countries): https://legal.linkedin.com/dpa; Possibility of objection (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
  • TikTok: Social network / Video-Plattform; Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.tiktok.com; Privacy policy: https://www.tiktok.com/de/privacy-policy.
  • Twitter: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, Mutterunternehmen: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Privacy policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
  • YouTube: social network and video platform;Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Privacy policy: https://policies.google.com/privacy; Possibility of objection (opt-out): https://adssettings.google.com/authenticated.
  • Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.xing.de; Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plugins and embedded functions as well as content

We integrate functional and content elements into our online offer, which are purchased from the servers of their respective providers (hereinafter referred to as “third party providers”). These can be, for example, graphics, videos or city plans (hereinafter referred to as “content”).

The integration always requires that the third-party providers of this content process the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is thus necessary for the presentation of these contents or functions. We make every effort to use only such content whose respective providers use the IP address only for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user’s device and, among other things, contain technical information about the browser and the operating system, websites to be referenced, visit time and further information about the use of our online offer as well as be combined with such information from other sources.

  • Types of data processed:usage data (e.g. visited websites, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time, identification numbers, consent status); Stock data (e.g. names, addresses); contact details (e.g. e-mail, telephone numbers); Content data (e.g. input in online forms); Location data (information on the geographical location of a device or a person).
  • Data subjects:Users (e.g. website visitors, users of online services).
  • Purposes of processing:provision of our online offer and user-friendliness; provision of contractual services and customer service; Profiles with user-related information (creation of user profiles).
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

  • Integration of third-party software, scripts or frameworks (e.g. jQuery):We integrate software into our online offer that we retrieve from servers of other providers (e.g. function libraries that we use for the presentation or user-friendliness of our online offer). The respective providers collect the IP address of the users and can process them for the purposes of transmitting the software to the browser of the users as well as for the purposes of security, as well as for the evaluation and optimization of their offer. – We integrate into our online offer software that we retrieve from servers of other providers (e.g. function libraries that we use for the presentation or user-friendliness of our online offer). The respective providers collect the IP address of the users and can process them for the purposes of transmitting the software to the browser of the users as well as for the purposes of security, as well as for the evaluation and optimization of their offer;Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Google Fonts (Hosted on Our Own Server): Provision of font files for the purpose of a user-friendly presentation of our online offer;Service provider:The Google Fonts are hosted on our server, no data is transmitted to Google;Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Google Maps: We integrate the maps of the service “Google Maps” of the provider Google. The processed data may include, in particular, IP addresses and user location data;Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy.
  • Google Maps APIs and SDKs:Interfaces to the map and location services of Google, which e.g. allow the addition of address inputs, location determinations, distance calculations or the provision of additional information on locations and other locations;Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy.
  • reCAPTCHA: We integrate the function “reCAPTCHA” in order to be able to recognize whether inputs (e.g. in online forms) are made by humans and not by automatically acting machines (so-called “bots”). The processed data may include IP addresses, information about operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, length of stay on websites, previously visited websites, interactions with ReCaptcha on other websites, possibly cookies and results of manual recognition processes (e.g. answering asked questions or selecting objects in pictures). The data processing takes place on the basis of our legitimate interest to protect our online offer against abusive automated crawling and spam;Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.google.com/recaptcha/; Privacy policy: https://policies.google.com/privacy; Possibility of objection (opt-out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements:https://adssettings.google.com/authenticated.
  • YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Possibility of objection (opt-out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements:https://adssettings.google.com/authenticated.
  • YouTube videos: video content; YouTube videos are integrated via a special domain (recognizable by the component “youtube-nocookie”) in the so-called “Advanced data protection mode”, whereby no cookies are collected for user activities in order to personalize the video playback. Nevertheless, information about the interaction of users with the video (e.g. note of the last playback location) can be stored;Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy.
  • Vimeo: Video content; Service provider: Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://vimeo.com; Privacy policy: https://vimeo.com/privacy; Possibility of objection (opt-out):We point out that Vimeo can use Google Analytics and refer to the privacy policy ()https://policies.google.com/privacy) as well as the opt-out possibilities for Google Analytics (https://tools.google.com/dlpage/gaoptout?hl=de) or Google’s settings for data use for marketing purposes (https://adssettings.google.com/).

Management, organisation and auxiliary tools

We use the services, platforms and software of other providers (hereinafter referred to as “Third Party Providers”) for the purposes of organization, administration, planning and provision of our services. When selecting third parties and their services, we observe the legal requirements.

In this context, personal data can be processed and stored on the servers of third parties. This may affect various data that we process in accordance with this privacy policy. These data may include in particular master data and contact data of the users, data on processes, contracts, other processes and their content.

If users are referred to the third party providers or their software or platforms in the context of communication, business or other relationships with us, the third party providers may process usage data and metadata for security purposes, for service optimization or for marketing purposes. We therefore ask you to observe the data protection notices of the respective third parties.

  • Types of data processed:Content data (e.g. input in online forms); usage data (e.g. visited websites, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time, identification numbers, consent status); Contact details (e.g. e-mail, telephone numbers).
  • Data subjects:communication partners; Users (e.g. website visitors, users of online services).
  • Purposes of processing:contact requests and communication; provision of contractual services and customer service; office and organisational procedures; management and response to requests; feedback (e.g. collecting feedback via online form); surveys and questionnaires (e.g. surveys with input options, multiple-choice questions); Profiles with user-related information (creation of user profiles).
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing processes, procedures and services:

Amendment and update of the privacy policy

We ask you to inform yourself regularly about the content of our privacy policy. We adjust the privacy policy as soon as the changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we specify addresses and contact information of companies and organizations in this privacy policy, we ask you to note that the addresses may change over time and ask you to check the information before contacting us.

Rights of data subjects

As data subjects, they are entitled to various rights under the GDPR, in particular from art. 15 to 21 GDPR:

  • Right of objection: You have the right, for reasons arising from your particular situation, at any time against the processing of personal data concerning you, based on art. 6 par. 1 lit. e or f GDPR is to file an objection; This also applies to profiling based on these provisions. If the personal data concerning you are processed for direct marketing, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such advertising; This also applies to profiling insofar as it is related to such direct marketing.
  • Right to Withdraw Consent: You have the right to withdraw consent you have given at any time.
  • Right of Access:You have the right to request confirmation as to whether the data in question is processed and on information about this data as well as on further information and copy of the data in accordance with the legal requirements.
  • Right to Rectification:In accordance with the legal requirements, you have the right to request the completion of the data concerning you or the correction of the inaccurate data concerning you.
  • Right to erasure and restriction of processing:In accordance with the legal requirements, you have the right to demand that data concerning you be deleted immediately or, alternatively, to demand a restriction of the processing of the data in accordance with the legal requirements.
  • Right to data portability:You have the right to receive data concerning you that you have provided to us in a structured, common and machine-readable format in accordance with the legal requirements or to request their transmission to another controller.
  • Complaint to the supervisory authority:Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of alleged infringement, if you consider that the processing of personal data concerning you violates the requirements of the GDPR.

Supervisory authority responsible for us:

The Hamburg Commissioner for Data Protection and Freedom of Information
of the Free and Hanseatic City of Hamburg – Corporation of Public Law

Ludwig-Erhard-Str 22, 7. OG
20459 Hamburg
Tel.: 040 / 428 54 – 4040
E-Mail: mailbox@datenschutz.hamburg.de

Definitions

In this section you will get an overview of the terms used in this privacy policy. Many of the terms are taken from the law and especially in the art. 4 GDPR is defined. The legal definitions are binding. The following explanations, on the other hand, are intended primarily for understanding. The terms are sorted alphabetically.

  • A/B-Tests:A/B tests serve to improve the user-friendliness and performance of online offers. For example, users are shown different versions of a website or its elements, such as input forms, on which the placement of the contents or the labels of the navigation elements can differ. Subsequently, based on the behavior of the users, e.g. longer stays on the website or more frequent interaction with the elements, it can be determined which of these websites or elements rather meet the needs of the users.
  • Heatmaps:“Heatmaps” are mouse movements of the users, which are combined to form an overall image, with the aid of which it is possible, for example, to recognize which website elements are preferably controlled and which website elements users prefer less.
  • Click tracking:Clicktracking allows to monitor the movements of users within an entire online offer. Since the results of these tests are more accurate if the interaction of users can be tracked over a certain period of time (e.g. so that we can find out if a user likes to return), cookies are usually stored on users’ computers for these test purposes.
  • Conversion measurement:Conversion measurement (also known as “visit action evaluation”) is a method by which the effectiveness of marketing measures can be determined. For this purpose, a cookie is usually stored on the devices of the users within the websites on which the marketing measures are carried out and then retrieved again on the target website. For example, we can track whether the ads we placed on other websites were successful.
  • Personal Data:‘personal data’ means any information relating to an identified or identifiable natural person (the ‘data subject’); identifiable is a natural person who can be identified directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more special characteristics that are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
  • Profiles with user-related information:The processing of “profiles with user-related information”, or “profiles” for short, includes any type of automated processing of personal data, which consists in the fact that this personal data is used to analyze, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, different information relating to demographics, behavior and interests, such as interaction with websites and their content, etc.) (e.g. the interests in certain content or products, the click behavior on a website or the location). For profiling purposes, cookies and web beacons are often used.
  • Reach measurement:The range measurement (also referred to as web analytics) serves to evaluate the visitor flows of an online offer and can include the behavior or interests of visitors in certain information, such as content of websites. With the help of reach analysis, website owners can recognize, for example, at what time visitors visit their website and what content they are interested in. This allows them, for example, to better adapt the content of the website to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus obtain more accurate analyses for the use of an online offer.
  • Location data:Location data is generated when a mobile device (or other device with the technical prerequisites for location determination) connects to a radio cell, a WLAN or similar technical intermediaries and functions of location determination. Location data are used to indicate at which geographically determinable position of the earth the respective device is located. Location data can be used, for example, to represent map functions or other information dependent on a location.
  • Tracking:The term “tracking” is used when the behavior of users can be understood across several online offers. As a rule, behavioral and interest information is stored in cookies or on servers of the providers of tracking technologies (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to correspond to their interests.
  • Controller:“Responsible” means the natural or legal person, authority, body or other body which alone or jointly with others decides on the purposes and means of processing personal data.
  • Processing:“Processing” means any operation or series of operations carried out with or without the assistance of automated procedures in connection with personal data. The term extends far and includes virtually every handling of data, be it the collection, evaluation, storage, transmission or deletion.