Data Protection Notice

Preamble

With the following data protection notice, we would like to inform you about which types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. This data protection notice applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).

The terms used are not gender-specific.

As of: August 5, 2025

Responsible party

Carl Berghöfer GmbH

Rosmarter Allee 17

58762 Altena

Authorized representatives: Arnd Berghöfer (Managing Director), Anja Berghöfer (Managing Director)

Email address: info@berghoefer-metalle.de

Phone: +49 (0) 23 51 / 9 09 80-0

Imprint: https://berghoefer-metalle.de/impressum/

Contact Data Protection Officer

You can reach our data protection team at datenschutz@berghoefer-metalle.de or by mail at our address, adding the word “Data Protection Officer.”

Overview of processing activities

The following overview summarizes the types of data processed and the purposes for which they are processed, and refers to the data subjects.

Types of data processed

Inventory data.
Employee data.
Payment data.
Location data.
Contact data.
Content data.
Contract data.
Usage data.
Meta, communication, and procedural data.
Social data.
Applicant data.
Image and/or video recordings.
Sound recordings.
Log data.
Performance and behavior data.
Working time data.
Creditworthiness data.
Salary data.

Special categories of data

Health data.
Religious or ideological beliefs.
Trade union membership.

Categories of data subjects

Service recipients and clients.
Employees.
Interested parties.
Communication partners.
Users.
Applicants.
Sweepstakes and competition participants.
Business and contractual partners.
Participants.
Depicted persons.
Third parties.
Whistleblower.

Purposes of processing

Provision of contractual services and fulfillment of contractual obligations.
Communication.
Security measures.
Direct marketing.
Reach measurement.
Tracking.
Office and organizational procedures.
Target group formation.
Organizational and administrative procedures.
Application procedures.
Conducting prize draws and competitions.
Firewall.
Feedback.

Surveys and questionnaires.
Marketing.
Profiles with user-related information.
Provision of our online offering and user-friendliness.
Assessment of creditworthiness and credit rating.
Establishment and implementation of employment relationships.
Information technology infrastructure.
Whistleblower protection.
Financial and payment management.
Public relations.
Sales promotion.
Business processes and business procedures.
Artificial intelligence (AI).

Automated decisions in individual cases

Credit reports.

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy notice.

Consent (Art. 6 (1) (a) GDPR) – The data subject has given their consent to the processing of personal data concerning them for a specific purpose or several specific purposes.
Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Legal obligation (Art. 6 (1) (c) GDPR) – Processing is necessary to fulfill a legal obligation to which the controller is subject.
Legitimate interests (Art. 6 (1) (f) GDPR) – Processing is necessary to protect the legitimate interests of the controller or a third party, provided that the interests, fundamental rights and freedoms of the data subject which require protection of personal data do not override them.
Application process as a pre-contractual or contractual relationship (Art. 6 (1) (b) GDPR) – If, as part of the application process, special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data, such as severe disability or ethnic origin) are requested from applicants so that the controller or the data subject can exercise the rights arising from employment law and social security and social protection law and can fulfil his or her obligations in this regard, their processing is carried out in accordance with Art. 9 (2) (b) GDPR, in the case of the protection of vital interests of applicants or other persons in accordance with Art. 9 (2) (c). GDPR or for the purposes of preventive healthcare or occupational medicine, for assessing the employee’s ability to work, for medical diagnosis, health or social care or treatment, or for the management of health or social care systems and services pursuant to Art. 9 (2) (h) GDPR. In the case of voluntary consent-based disclosure of special categories of data, their processing is based on Art. 9 (2) (a) GDPR.
Processing of special categories of personal data relating to healthcare, occupation, and social security (Art. 9 (2) (h) GDPR) – Processing is necessary for the purposes of preventive healthcare or occupational medicine, for assessing the employee’s ability to work, for medical diagnosis, health or social care or treatment, or for the management of health or social care systems and services on the basis of Union or Member State law or on the basis of a contract with a healthcare professional.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special provisions on the right to information, the right to erasure, the right of objection, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including Profiling. Furthermore, the national data protection laws of the individual federal states may apply.

Relevant legal basis under the Swiss Data Protection Act: If you are located in Switzerland, we process your data on the basis of the Federal Data Protection Act (abbreviated to “Swiss DSG”). Unlike, for example, the GDPR, the Swiss DSG does not generally require a legal basis for the processing of personal data to be stated, and the processing of personal data is carried out in good faith, lawfully, and proportionately (Art. 6 (1) and (2) of the Swiss DSG). Furthermore, we only collect personal data for a specific purpose that is recognizable to the data subject and only process it in a manner compatible with that purpose (Art. 6 (3) of the Swiss DSG).

Note on the applicability of the GDPR and the Swiss DSG: This data protection notice serves to provide information in accordance with both the Swiss DSG and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that the terms of the GDPR are used due to their broader geographical application and clarity. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “particularly sensitive personal data” used in the Swiss Data Protection Act, the terms “processing” of “personal data,” “legitimate interest,” and “special categories of data” used in the GDPR are used. However, the legal meaning of these terms continues to be determined by the Swiss Data Protection Act within the scope of the Swiss Data Protection Act.

Security Measures

In accordance with the legal requirements, taking into account the state of the art, the implementation costs, and the nature, scope, circumstances, and purposes of the processing, as well as the varying probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to it, input, transfer, ensuring its availability, and segregation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the deletion of data, and responses to data threats. Furthermore, we consider the protection of personal data right from the development and selection of hardware, software, and processes in accordance with the principle of data protection, through technology design, and through data protection-friendly default settings.

Securing online connections with TLS/SSL encryption technology (HTTPS): To protect user data transmitted via our online services from unauthorized access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the advanced and more secure version of SSL, ensures that all data transmissions meet the highest security standards. If a website is secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This serves as an indicator for users that their data is being transmitted securely and encrypted.

Transfer of personal data

As part of our processing of personal data, it may happen that this data is transmitted to or disclosed to other bodies, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International data transfers

Data processing in third countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs as part of the use of third-party services or the disclosure or transmission of data to other persons, bodies, or companies (which can be identified by the postal address of the respective provider or if the data transfer is expressly mentioned in the privacy policy to third countries), this is always done in compliance with legal requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the EU Commission dated July 10, 2023. In addition, we have concluded standard contractual clauses with the respective providers that comply with the requirements of the EU Commission and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: The DPF forms the primary layer of protection, while the Standard Contractual Clauses serve as an additional safeguard. Should changes occur within the framework of the DPF, the Standard Contractual Clauses intervene as a reliable fallback option. This ensures that your data always remains adequately protected, even in the event of any political or legal changes.

We will inform you about the individual service providers’ certification under the DPF and whether they have Standard Contractual Clauses in place. Further information on the DPF and a list of certified companies can be found on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, appropriate safeguards apply, in particular Standard Contractual Clauses, explicit consent, or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

Disclosure of personal data abroad: In accordance with the Swiss Data Protection Act (FADP), we only disclose personal data abroad if adequate protection of the data subjects is guaranteed (Article 16 of the Swiss FADP). If the Federal Council has not determined adequate protection (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we implement alternative security measures.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by a Swiss adequacy decision dated June 7, 2024. In addition, we have entered into standard data protection clauses with the respective providers, which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and establish contractual obligations to protect your data.

This dual protection ensures comprehensive protection of your data: The DPF forms the primary layer of protection, while the standard data protection clauses serve as an additional safeguard. Should changes occur within the framework of the DPF, the standard data protection clauses intervene as a reliable fallback option. This ensures that your data always remains adequately protected, even in the event of any political or legal changes.

For each service provider, we will inform you whether they are certified under the DPF and whether standard data protection clauses are in place. The list of certified companies and further information about the DPF can be found on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Appropriate security measures apply to data transfers to other third countries, including international treaties, specific guarantees, standard data protection clauses approved by the FDPIC, or internal company data protection rules approved in advance by the FDPIC or a competent data protection authority in another country.

General information on data storage and deletion

We delete personal data that we process in accordance with legal provisions as soon as the underlying consent is revoked or there are no further legal grounds for processing. This applies to cases where the original processing purpose no longer applies or the data is no longer needed. Exceptions to this rule exist if legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose retention is necessary for legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy policy contains additional information on data retention and deletion that applies specifically to certain processing operations.

If multiple retention periods or deletion periods are specified for a given date, the longest period always applies. Data that is no longer retained for its original purpose but due to legal requirements or other reasons will only be processed for the reasons that justify its retention.

Retention and deletion of data: The following general retention periods apply to the retention and archiving of data under German law:

10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and documentation necessary for their understanding. Other organizational documents (Section 147 (1) No. 1 in conjunction with Section 3 of the German Fiscal Code (AO), Section 14b (1) of the German Value Added Tax Act (UStG), Section 257 (1) No. 1 in conjunction with Section 4 of the German Commercial Code (HGB).
8 years – Accounting documents, such as invoices and cost receipts (Section 147 (1) Nos. 4 and 4a in conjunction with Section 3 Sentence 1 of the German Fiscal Code (AO) and Section 257 (1) No. 4 in conjunction with Section 4 of the German Commercial Code (HGB).
6 years – Other business documents: received commercial or business letters, reproductions of sent commercial or business letters, other documents, insofar as they are relevant for taxation, e.g. hourly wage slips, operating statements, calculation documents, price labels, but also payroll documents, insofar as they are not already accounting documents and cash register slips (Section 147 (1) Nos. 2, 3, 5 in conjunction with Section 3 AO, Section 257 (1) Nos. 2 and 3 in conjunction with Section 4 HGB).
3 years – Data required to consider potential warranty and compensation claims or similar contractual claims and rights, as well as to process related inquiries, based on previous business experience and standard industry practices, will be stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Data retention and deletion: The following general retention periods apply to retention and archiving under Swiss law:

10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting documents and invoices, as well as all necessary work instructions and other organizational documents (Art. 958f of the Swiss Code of Obligations (CO)).
10 years – Data necessary to consider potential claims for damages or similar contractual claims and rights, as well as to process related inquiries based on previous business experience and standard industry practices, will be retained for the statutory limitation period of ten years, unless a shorter period of five years applies, which is applicable in specific cases (Art. 127, 130 CO). Claims for rent, lease, and capital interest, as well as other periodic payments, from the delivery of food, meals, and innkeepers’ debts, as well as from craft work, retail sales of goods, medical care, professional work by lawyers, legal agents, public prosecutors, and notaries, and from the employment of employees, expire after five years (Art. 128 of the Swiss Code of Obligations).

The limitation period begins at the end of the year: If a limitation period does not expressly begin on a specific date and lasts at least one year, it automatically begins at the end of the calendar year in which the event triggering the limitation period occurred. In the case of ongoing contractual relationships in which data is stored, the event triggering the limitation period is the date on which the termination or other termination of the legal relationship takes effect.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

Right of objection: You have the right to object at any time to the processing of personal data concerning you based on Article 6 (1) (e) or (f) GDPR, for reasons related to your particular situation; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising; this also applies to profiling insofar as it is related to such direct marketing.
Right to withdraw consent: You have the right to withdraw consent given at any time.
Right to information: You have the right to request confirmation as to whether the data in question is being processed and to access this data, as well as further information and a copy of the data in accordance with legal requirements.
Right to rectification: You have the right, in accordance with the statutory provisions, to request that the data concerning you be completed or that inaccurate data concerning you be rectified.
Right to erasure and restriction of processing: You have the right, in accordance with the statutory provisions, to request that data concerning you be erased immediately or, alternatively, to request that processing of the data be restricted in accordance with the statutory provisions.
Right to data portability: You have the right, in accordance with the statutory provisions, to receive the data concerning you that you have provided to us in a structured, common, and machine-readable format or to request that it be transmitted to another controller.
Complaint to a supervisory authority: In accordance with the statutory provisions and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State in which you habitually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Rights of data subjects under the Swiss Data Protection Act:

As a data subject, you are entitled to the following rights in accordance with the provisions of the Swiss Data Protection Act:

Right to information: You have the right to request confirmation as to whether personal data concerning you is being processed, and to receive the information necessary to assert your rights under this law and to ensure transparent data processing.
Right to data disclosure or transfer: You have the right to request the disclosure of your personal data that you have provided to us in a common electronic format.
Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
Right to objection, erasure, and destruction: You have the right to object to the processing of your data and to request that personal data concerning you be erased or destroyed.

Business services

We process data from our contractual and business partners, e.g. B. Customers and interested parties (collectively referred to as “contractual partners”), within the framework of contractual and comparable legal relationships as well as related measures and with regard to communication with the contractual partners (or pre-contractually), for example, to answer inquiries.

We use this data to fulfill our contractual obligations. This includes, in particular, the obligations to provide the agreed services, any update obligations, and remedy in the event of warranty and other service disruptions. Furthermore, we use the data to protect our rights and for the purposes of the administrative tasks associated with these obligations, as well as for corporate organization. Furthermore, we process the data based on our legitimate interests in both proper and efficient business management and security measures to protect our contractual partners and our business operations from misuse and endangerment of their data, secrets, information, and rights (e.g., the involvement of telecommunications, transport, and other auxiliary services, as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Within the scope of applicable law, we only share contractual partners’ data with third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners will be informed of further forms of processing, such as for marketing purposes, in the privacy policy.

We will inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks, etc.), or in person.

We delete data after the expiration of statutory warranty and similar obligations, i.e., generally after four years, unless the data is stored in a customer account, e.g., for as long as it must be retained for legal archiving reasons (e.g., for tax purposes, usually ten years). We delete data disclosed to us by the contractual partner as part of an order in accordance with the specifications and generally after the end of the order.

Types of data processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and email addresses or telephone numbers); contract data (e.g., subject matter of the contract, term, customer category).
Data subjects: Service recipients and clients; interested parties; business and contractual partners.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; communication; office and organizational procedures; organizational and administrative procedures; business processes and operational procedures.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR); legal obligation (Art. 6 (1) (c) GDPR). Legitimate interests (Article 6 (1) (f) GDPR).

Further information on processing procedures, processes, and services:

Craft services: We process the data of our customers and clients (hereinafter referred to collectively as “customers”) to enable them to select, purchase, or commission the selected services or works and related activities, as well as to pay for and deliver them, execute them, or provide them.

The required information is marked as such within the scope of the order, purchase order, or similar contract conclusion and includes the information required for delivery and billing, as well as contact information for any follow-up consultations. Legal basis: contract fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR).

Business Processes and Procedures

Personal data of service recipients and clients – including customers, clients, or in special cases, clients, patients, business partners, and other third parties – is processed within the framework of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting, and project management.

The collected data is used to fulfill contractual obligations and organize operational processes efficiently. This includes the processing of business transactions, the management of customer relationships, the optimization of sales strategies, and the maintenance of internal accounting and financial processes. In addition, the data supports the protection of the controller’s rights and promotes administrative tasks and the organization of the company.

Personal data may be transferred to third parties if this is necessary to fulfill the stated purposes or legal obligations. After the expiration of statutory retention periods or if the purpose of the processing no longer applies, the data will be deleted. This also includes data that must be stored for a longer period due to tax and legal documentation requirements.

Types of data processed: Inventory data (e.g. full name, home address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and contributions as well as the information relating to them, such as details of authorship or time of creation); contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved); protocol data (e.g. log files relating to logins or the retrieval of data or access times). Employee data (information relating to employees and other persons in an employment relationship).
Data subjects: Service recipients and clients; interested parties; communication partners; business and contractual partners; third parties; users (e.g., website visitors, users of online services); employees (e.g., employees, applicants, temporary workers, and other staff).
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and management procedures; communication; marketing; sales promotion; public relations; financial and payment management; security measures; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal bases: Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR); legitimate interests (Art. 6 (1) (f) GDPR); legal obligation (Art. 6 (1) (c) GDPR).

Further information on processing processes, procedures, and services:

Contact management and contact maintenance: Procedures required for organizing, maintaining, and securing contact information (e.g., setting up and maintaining a central contact database, regularly updating contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, backing up and restoring contact data, training employees in the effective use of contact management software, regularly reviewing communication history, and adapting contact strategies); Legal bases: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
General payment transactions: Procedures required for the execution of payment transactions, the monitoring of bank accounts, and the control of payment flows (e.g., preparation and verification of transfers, processing of direct debit transactions, checking of account statements, monitoring of incoming and outgoing payments, direct debit management, account reconciliation, cash management); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Accounting, accounts payable, accounts receivable: Procedures required for the recording, processing, and control of business transactions in the area of accounts payable and accounts receivable accounting (e.g., preparation and verification of incoming and outgoing invoices, monitoring and management of open items, execution of payment transactions, processing of dunning procedures, account reconciliation within the scope of receivables and payables, accounts payable and accounts receivable accounting); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Financial accounting and taxes: Procedures required for the recording, administration, and control of financially relevant business transactions as well as for the calculation, reporting, and payment of taxes (e.g., account assignment and posting of business transactions, preparation of quarterly and annual financial statements, execution of payment transactions, processing of dunning procedures, account reconciliation, tax advice, preparation and filing of tax returns, handling of tax matters); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Purchasing: Procedures necessary for the procurement of goods, raw materials, or services (e.g., supplier selection and evaluation, price negotiations, order placement and monitoring, review and control of deliveries, invoice auditing, order management, warehouse management, creation and maintenance of purchasing guidelines); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Sales: Procedures required for the planning, implementation, and control of measures for the marketing and sale of products or services (e.g., customer acquisition, quotation creation and tracking, order processing, customer advice and support, sales promotion, product training, sales controlling and analysis, management of sales channels); Legal basis: Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Marketing, advertising, and sales promotion: Procedures required within the framework of marketing, advertising, and sales promotion (e.g., market analysis and target group identification, development of marketing strategies, planning and implementation of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, budget management and cost control); Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).
Economic analyses and market research: To fulfill business purposes and to identify market trends and the wishes of contractual partners and users, the available data on business transactions, contracts, inquiries, etc. are analyzed. The group of data subjects may include contractual partners, interested parties, customers, visitors, and users of the controller’s online offering. The analyses are carried out for the purposes of business evaluations, marketing, and market research (e.g., to determine customer groups with different characteristics). Profiles of registered users, where available, along with their information on the services used, are taken into account. The analyses serve exclusively the controller and are not disclosed externally, unless they are anonymous analyses with summarized, i.e., anonymized values. Furthermore, the privacy of users is taken into account; the data is processed pseudonymously for analysis purposes wherever possible and, where feasible, anonymized (e.g., as summarized data). Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).
Public relations: Procedures required within the scope of public relations (e.g., development and implementation of communication strategies, planning and execution of PR campaigns, preparation and distribution of press releases, maintaining media contacts, monitoring and analyzing media coverage, organizing press conferences and public events, crisis communication, creating content for social media and company websites, maintaining corporate branding); Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).
Guest Wi-Fi: Procedures required for setting up, operating, maintaining, and monitoring a wireless network for guests (e.g., installation and configuration of Wi-Fi access points, creation and management of guest access points, monitoring the network connection, ensuring network security, troubleshooting connection issues, updating network software, compliance with data protection regulations); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).

Providers and services used in the course of our business activities

In the course of our business activities, we use additional services, platforms, interfaces, or plug-ins from third-party providers (hereinafter “Services”) in compliance with legal requirements. Their use is based on our interest in the proper, lawful, and economical management of our business operations and our internal organization.

Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); contract data (e.g., subject matter of the contract, term, customer category); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, persons involved).
Data subjects: Service recipients and clients; interested parties; business and contractual partners; employees (e.g., employees, applicants, temporary workers, and other staff). Communication partners.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and management procedures; communication; marketing.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures, and services:

Financial accounting system: Software for accounting, communication with tax advisors and authorities, and with document storage; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Data processing agreement: Provided by the service provider.
ERP system: customer relationship management, financial planning and analysis, supply chain operations, business process automation, personnel management, and service optimization; Legal basis: legitimate interests (Art. 6 (1) (f) GDPR); Data processing agreement: provided by the service provider. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).

Payment Methods

Within the framework of contractual and other legal relationships, due to legal obligations, or otherwise based on our legitimate interests, we offer data subjects efficient and secure payment options and, in addition to banks and credit institutions, use other service providers (collectively, “Payment Service Providers”) for this purpose.

The data processed by the payment service providers includes inventory data, such as name and address, bank details, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, amount, and recipient-related information. This information is required to process the transactions. However, the data entered is only processed and stored by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information confirming or rejecting the payment. Under certain circumstances, the payment service providers may transmit the data to credit agencies. This transmission is for the purpose of identity and credit checks. For more information, please refer to the terms and conditions and the privacy policy of the payment service providers.

The terms and conditions and privacy policy of the respective payment service providers apply to payment transactions and are available on the respective websites or transaction applications. We also refer to these for further information and to assert data subjects’ rights of withdrawal, information, and other rights.

Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contract data (e.g., subject matter of the contract, term, customer category); usage data (e.g., page views and duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, persons involved).
Data subjects: Service recipients and clients; business and contractual partners; interested parties.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations. Business processes and management procedures.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Credit check

If we make advance payments or assume comparable economic risks (e.g., when ordering on account), we reserve the right, in order to protect our legitimate interests, to obtain identity and credit information from specialized service providers (credit reporting agencies) for the purpose of assessing the credit risk based on mathematical and statistical methods.

We process the information received from the credit reporting agencies regarding the statistical probability of a payment default as part of an appropriate discretionary decision regarding the establishment, implementation, and termination of the contractual relationship. We reserve the right to refuse payment on account or any other advance payment in the event of a negative credit check result.

The decision as to whether we will make advance payments is made solely on the basis of an automated decision in each individual case, which our software makes based on the information provided by the credit agency.

If we obtain express consent from contractual partners, the legal basis for the credit check and the transmission of the customer’s data to the credit agencies is their consent. If no consent is obtained, the credit check is based on our legitimate interest in ensuring the reliability of our payment claims.

Data types processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and email addresses or telephone numbers); contract data (e.g., subject matter of the contract, term, customer category); creditworthiness data (e.g., received credit score, estimated probability of default, risk classification based on this, historical payment behavior).
Data subjects: Service recipients and clients; interested parties; business and contractual partners.
Purposes of processing: Assessment of creditworthiness and creditworthiness.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Consent (Art. 6 (1) (a) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR).
Automated decisions in individual cases: Credit information (decision based on a credit check).

Provision of the online service and web hosting

We process user data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

Types of data processed: Usage data (e.g., page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved); protocol data (e.g., log files relating to logins or data retrieval or access times); content data (e.g., textual or visual messages and contributions as well as information relating to them, such as authorship or time of creation); inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers).
Data subjects: Users (e.g., website visitors, users of online services); service recipients and clients; communication partners; business and contractual partners.
Purposes of processing: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures; provision of contractual services and fulfillment of contractual obligations; firewall; communication; organizational and administrative procedures.
Storage and deletion: Deletion in accordance with the information in the “General Information on Data Storage and Deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing procedures, methods, and services:

Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity, and software that we rent from a corresponding server provider (also known as a “web host”) or obtain from other sources; legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).
Collection of access data and log files: Access to our online services is logged in the form of so-called “server log files.” The server log files may include the address and name of the accessed web pages and files, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), and usually IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to avoid server overload (particularly in the case of abusive attacks, so-called DDoS attacks), and to ensure server utilization and stability; legal basis: legitimate interests (Art. 6 (1) (f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the respective incident has been finally resolved.
Content Delivery Network: We use a “Content Delivery Network” (CDN). A CDN is a service that enables faster and more secure delivery of online content, especially large media files such as graphics or program scripts, using regionally distributed servers connected via the Internet. Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).
Web Host: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Data processing agreement: Provided by the service provider.
Hosting system: Hosting and software for the creation, provision, and operation of websites, blogs, and other online offerings; Service provider: Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR). Data processing agreement: Provided by the service provider. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider).
Wordfence: Firewall and security functions as well as error detection functions to detect and prevent unauthorized access attempts as well as technical vulnerabilities that could enable such access. For these purposes, cookies and similar storage methods required for this purpose may be used, and security logs may be created during the review and especially in the event of unauthorized access. In this context, the IP addresses of users, a user identification number and their activities, including the time of access, and compared with the data provided by the provider of the firewall and security function and transmitted to them; Service provider: Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.wordfence.com; Privacy policy: https://www.wordfence.com/privacy-policy/; Basis for third country transfers: EU/EEA – Standard Contractual Clauses (https://www.wordfence.com/standard-contractual-clauses/), Switzerland – Standard Contractual Clauses (https://www.wordfence.com/standard-contractual-clauses/ ). Further information: https://www.wordfence.com/help/general-data-protection-regulation/.
Google Cloud CDN: Content Delivery Network (CDN) – service that enables the faster and more secure delivery of online content, particularly large media files such as graphics or program scripts, using regionally distributed servers connected via the Internet; service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; legal basis: legitimate interests (Art. 6 (1) (f) GDPR); website: https://cloud.google.com/cdn; privacy policy: https://policies.google.com/privacy; data processing agreement: https://cloud.google.com/terms/data-processing-addendum. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause).
gstatic.com: Content Delivery Network (CDN) – a service that enables faster and more secure delivery of online content, especially large media files such as graphics or program scripts, using regionally distributed servers connected via the Internet. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.google.de/. Privacy Policy: https://policies.google.com/privacy.
Mail Security: Email security, spam filtering, protection against phishing attacks, email archiving, message encryption, ensuring compliance with legal requirements, and providing backup solutions for email data; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR)
JSDelivr: Content Delivery Network (CDN) that helps deliver media and files quickly and efficiently, especially under high load; Service provider: ProspectOne, Królewska 65A/1, 30-081, Kraków, Poland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.jsdelivr.com. Privacy Policy: https://www.jsdelivr.com/terms/privacy-policy.

Use of Cookies

The term “cookies” refers to functions that store and retrieve information from users’ devices. Cookies can also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as creating analytics of visitor flows. We use cookies in accordance with legal regulations. Where necessary, we obtain user consent in advance. If consent is not required, we rely on our legitimate interests. This applies when storing and retrieving information is essential to provide expressly requested content and functions. This includes, for example, saving settings and ensuring the functionality and security of our online services. Consent can be revoked at any time. We provide clear information about the scope of consent and which cookies are used.

Notes on legal bases under data protection law: Whether we process personal data using cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage period: With regard to storage period, a distinction is made between the following types of cookies:

Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their device (e.g., browser or mobile application).
Persistent cookies: Persistent cookies remain stored even after the device is closed. For example, the login status can be saved and preferred content can be displayed directly when the user visits a website again. Likewise, the user data collected using cookies can be used to measure reach. Unless we provide users with explicit information about the type and storage period of cookies (e.g., when obtaining consent), they should assume that they are permanent and that the storage period can be up to two years.

General information on revocation and objection (opt-out): Users can revoke their consent at any time and also object to processing in accordance with legal requirements, including through their browser’s privacy settings.

Data types processed: Meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Provision of our online offering and user-friendliness.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR). Consent (Art. 6 (1) (a) GDPR).

Further information on processing procedures, methods, and services:

Processing of cookie data based on consent: We use a consent management solution that obtains users’ consent to the use of cookies or to the methods and providers specified within the consent management solution. This procedure is used to obtain, log, manage, and revoke consent, particularly with regard to the use of cookies and similar technologies used to store, read, and process information on users’ end devices. As part of this procedure, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing operations and providers named in the consent management procedure. Users also have the option of managing and revoking their consent. The declarations of consent are saved to avoid further queries and to be able to provide evidence of consent in accordance with legal requirements. The data is stored on the server and/or in a cookie (so-called opt-in cookie) or using similar technologies in order to be able to assign the consent to a specific user or their device. If no specific information is available about the providers of consent management services, the following general information applies: Consent is stored for a maximum of two years. A pseudonymous user identifier is created, which is stored together with the time of consent, information on the scope of consent (e.g., relevant categories of cookies and/or service providers), and information about the browser, system, and device used. Legal basis: Consent (Art. 6 (1) (a) GDPR).
Real Cookie Banner: Consent management: Procedures for obtaining, logging, managing, and revoking consent, in particular for the use of cookies and similar technologies for storing, reading, and processing information on users’ devices, as well as their processing. Service provider: Execution on servers and/or computers under their own data protection responsibility. Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://devowl.io/de/wordpress-real-cookie-banner/. Privacy policy: https://devowl.io/de/datenschutzerklaerung/.

Blogs and Publication Media

We use blogs or similar means of online communication and publication (hereinafter “Publication Media”). Readers’ data is processed for the purposes of the Publication Media only to the extent necessary for its presentation and communication between authors and readers, or for security reasons. Furthermore, we refer to the information on the processing of visitors to our Publication Media within the framework of this Privacy Policy.

Types of data processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, persons involved).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Feedback (e.g., collecting feedback via online forms). Provision of our online offering and user-friendliness.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing procedures, methods, and services:

Gravatar profile pictures: Profile pictures – We use the Gravatar service within our online offering, and in particular on the blog.

Gravatar is a service where users can register and store profile pictures and their email addresses. If users leave posts or comments on other online sites (especially blogs) using their respective email address, their profile pictures may be displayed next to the posts or comments. For this purpose, the email address provided by the user is transmitted in encrypted form to Gravatar to check whether a profile has been saved for it. This is the sole purpose of transmitting the email address. It is not used for any other purpose and is deleted afterward.

The use of Gravatar is based on our legitimate interests, as with Gravatar we offer post and comment authors the opportunity to personalize their posts with a profile picture.

By displaying the images, Gravatar obtains the user’s IP address, as this is necessary for communication between a browser and an online service.

If users do not want a user image linked to their Gravatar email address to appear in comments, they should use an email address that is not stored with Gravatar to comment. We would also like to point out that it is also possible to use an anonymous email address or no email address at all if users do not wish their email address to be sent to Gravatar. Users can completely prevent the transmission of data by not using our comment system; Service provider: Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://automattic.com; Privacy policy: https://automattic.com/privacy; Data processing agreement: Provided by the service provider. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider).

Contact and Inquiry Management

When you contact us (e.g., by mail, contact form, email, telephone, or via social media), as well as within the framework of existing user and business relationships, the information provided by the inquiring persons will be processed to the extent necessary to respond to the contact inquiries and any requested measures.

Data types processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication, and process data (e.g., IP addresses, time information, identification numbers, persons involved).
Data subjects: Communication partners; service recipients and clients; users (e.g., website visitors, users of online services).
Purposes of processing: Communication; organizational and administrative procedures; feedback (e.g., collecting feedback via online forms). Provision of our online services and user-friendliness.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR). Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR).

Further information on processing processes, procedures, and services:

Contact form: When you contact us via our contact form, email, or other communication channels, we process the personal data transmitted to us to answer and process the respective request. This generally includes information such as name, contact information, and, if applicable, other information that is provided to us and is necessary for appropriate processing. We use this data exclusively for the stated purpose of contacting and communicating with you; legal basis: contract fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Contact Form 7: Management of contact inquiries and communication; service provider: Rock Lobster, LLC; legal basis: legitimate interests (Art. 6 (1) (f) GDPR); website: https://contactform7.com/. Further information: Operation within our own hosting environment.
Elementor: Creation of online forms, collection and storage of the associated user input; service provider: Elementor Ltd., Tuval St 40, Ramat Gan, Israel; legal basis: contract fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR); Website: https://elementor.com/features/form-builder/; Privacy Policy: https://elementor.com/about/privacy/; Data Processing Agreement: https://elementor.com/terms/cloud-toc/elementor-data-processing-agreement/; Basis for third-country transfers: EU/EEA – Standard Contractual Clauses (https://elementor.com/terms/cloud-toc/elementor-data-processing-agreement/), Switzerland – Standard Contractual Clauses (https://elementor.com/terms/cloud-toc/elementor-data-processing-agreement/). Further information: https://elementor.com/trust/.

Communication via Messenger

We use messengers for communication purposes and therefore ask you to observe the following information regarding the functionality of the messengers, encryption, the use of communication metadata, and your options for opting out.

You can also contact us via alternative means, e.g., by phone or email. Please use the contact options provided to you or the contact options provided within our online offering.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we would like to point out that the communication content (i.e., the content of the message and attached images) is encrypted end-to-end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use a current version of the messenger with encryption enabled to ensure the encryption of the message content.

However, we would also like to point out to our communication partners that while the providers of the messengers cannot view the content, they can learn that and when communication partners communicate with us, as well as technical information about the device used by the communication partners and, depending on their device settings, location information (so-called metadata) is processed.

Notes on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. Furthermore, if we do not ask for consent and they contact us on their own initiative, for example, we use messengers in our relationship with our contractual partners and in the context of contract initiation as a contractual measure. In the case of other interested parties and communication partners, we use messengers based on our legitimate interests in fast and efficient communication and in meeting the needs of our communication partners in communicating via messenger. We would also like to point out that we will not transmit the contact details provided to us to the messengers for the first time without your consent.

Revocation, objection, and deletion: You can revoke your consent and object to communication with us via messenger at any time. In the case of communication via messenger, we delete the messages in accordance with our general deletion guidelines (e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have responded to any inquiries from the communication partners, provided that no reference to a previous conversation is expected and there are no legal retention obligations that prevent deletion.

Reservation of reference to other communication channels: To ensure your security, we ask for your understanding that for certain reasons we may not be able to respond to inquiries via messenger. This applies to situations in which, for example, contract details must be treated with particular confidentiality or a response via messenger does not meet the formal requirements. In these cases, we recommend that you use more suitable communication channels.

Types of data processed: Contact data (e.g., postal and email addresses or telephone numbers); Content data (e.g., textual or visual messages and contributions as well as related information, such as authorship or time of creation); Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and process data (e.g., IP addresses, time information, identification numbers, persons involved).
Data subjects: Communication partners.
Purposes of processing: Communication. Direct marketing (e.g., by email or post).
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Consent (Art. 6 (1) (a) GDPR); Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing procedures, methods, and services:

WhatsApp: Text messages, voice and video calls, sending images, videos, and documents, group chat function, end-to-end encryption for increased security; Service provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.whatsapp.com/; Privacy Policy: https://www.whatsapp.com/legal. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).

Artificial Intelligence (AI)

We use artificial intelligence (AI) to process personal data. The specific purposes and our interest in using AI are set out below. In accordance with the term “AI system” pursuant to Article 3 No. 1 of the AI Regulation, we define AI as a machine-based system designed for varying degrees of autonomous operation, capable of adapting after its introduction, and capable of generating results such as predictions, content, recommendations, or decisions from the inputs received that can influence physical or virtual environments.

Our AI systems are used in strict compliance with legal requirements. These include both specific regulations for artificial intelligence and data protection requirements. In particular, we adhere to the principles of lawfulness, transparency, fairness, human control, purpose limitation, data minimization, integrity, and confidentiality. We ensure that the processing of personal data always takes place on a legal basis. This can be either the consent of the data subject or legal permission.

When using external AI systems, we carefully select their providers (hereinafter “AI providers”). In accordance with our legal obligations, we ensure that the AI providers comply with applicable regulations. We also observe our obligations when using or operating the purchased AI services. Personal data is processed by us and the AI providers exclusively on the basis of consent or legal authorization. We attach particular importance to transparency, fairness, and maintaining human control over AI-supported decision-making processes.

To protect the processed data, we implement appropriate and robust technical and organizational measures. These guarantee the integrity and confidentiality of the processed data and minimize potential risks. Through regular reviews of the AI providers and their services, we ensure ongoing compliance with current legal and ethical standards.

Types of data processed: Content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation). Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
Data subjects: Users (e.g., website visitors, users of online services). Third parties.
Purposes of processing: Artificial Intelligence (AI).
Retention and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures, and services:

ChatGPT: AI-based service designed to understand and generate natural language and associated inputs and data, analyze information, and make predictions (“AI,” i.e., “Artificial Intelligence,” is to be understood in the applicable legal sense of the term); Service provider: OpenAI Ireland Ltd, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://openai.com/de-DE/chatgpt/overview/; Privacy policy: https://openai.com/de-DE/policies/privacy-policy/. Opt-out option: https://privacy.openai.com/policies?modal=select-subject.
Microsoft Copilot: Enables the creation and editing of texts, spreadsheets, and presentations. Offers support in analyzing data, automating tasks, and integrating with various Microsoft Office applications. Uses machine learning to improve workflows and provide contextual suggestions; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-copilot/organizations; Privacy Policy: https://www.microsoft.com/de-de/privacy/privacystatement; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

Video conferences, online meetings, webinars, and screen sharing

We use platforms and applications from other providers (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as “conferences”). When selecting conference platforms and their services, we comply with legal requirements.

Data processed by conference platforms: When participating in a conference, the conference platforms process the personal data of participants listed below. The scope of processing depends on which data is required for a specific conference (e.g., providing access data or real names) and which optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants’ data may also be processed by the conference platforms for security purposes or to optimize the service. The data processed includes personal information (first name, last name), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, information about professional position/function, the IP address of the internet access, information about the participants’ devices, their operating system, the browser, and its technical and language settings, information about the content of the communication processes, i.e., entries in chats as well as audio and video data, as well as the use of other available functions (e.g., surveys). The content of the communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users on the conference platforms, additional data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g., from surveys), and video or audio recordings are logged, participants will be transparently informed in advance and, where necessary, asked for their consent.

Participant data protection measures: Please refer to the conference platforms’ privacy policies for details on how your data is processed and select the optimal security and data protection settings for you within the conference platform settings. Please also ensure data and privacy protection in the background of your recording for the duration of a video conference (e.g., by informing roommates, locking doors, and using the background blur function, where technically possible). Links to the conference rooms and access data may not be passed on to unauthorized third parties.

Notes on legal bases: If, in addition to the conference platforms, we also process user data and ask users for their consent to use the conference platforms or certain functions (e.g., consent to a recording of conferences), the legal basis for processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g., in participant lists, in the case of processing discussion results, etc.). Furthermore, user data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

Types of data processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); image and/or video recordings (e.g., photographs or video recordings of a person); sound recordings. Log data (e.g., log files regarding logins or data retrieval or access times).
Data subjects: Communication partners; users (e.g., website visitors, users of online services). Depicted persons.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; communication. Office and organizational procedures.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing procedures, methods, and services:

Microsoft Teams: Audio and video conferencing, chat, file sharing, integration with Office 365 applications, real-time document collaboration, calendar functions, task management, screen sharing, optional recording; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-teams/; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement; Security information: https://www.microsoft.com/de-de/trustcenter. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
Zoom: video conferences, online meetings, webinars, screen sharing, optional recording of sessions, chat function, integration with calendars and other apps; service provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; legal basis: legitimate interests (Art. 6 (1) (f) GDPR); Website: https://zoom.us; Privacy Policy: https://explore.zoom.us/de/privacy/; Data Processing Agreement: https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf).

Audio Content

We use hosting services from service providers to offer our audio content for listening and downloading. We use platforms that enable the uploading, storage, and distribution of audio material.

Types of data processed: Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, persons involved); protocol data (e.g., log files relating to logins or data retrieval or access times).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Reach measurement (e.g., access statistics, recognition of recurring visitors); profiles with user-related information (creation of user profiles). Provision of our online offering and user-friendliness.
Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion.”
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Cloud Services

We use software services accessible via the Internet and running on their providers’ servers (so-called “cloud services,” also referred to as “software as a service”) for storing and managing content (e.g., document storage and management, sharing documents, content, and information with specific recipients, or publishing content and information).

In this context, personal data may be processed and stored on the providers’ servers if it is part of communication with us or is otherwise processed by us as set out in this privacy policy. This data may include, in particular, user master data and contact details, data on transactions, contracts, other processes, and their content. The providers of cloud services also process usage data and metadata, which they use for security purposes and to optimize the service.

If we use cloud services to provide forms, documents, and content to other users or publicly accessible websites, the providers may store cookies on users’ devices for web analysis purposes or to remember user settings (e.g., in the case of media control).

Types of data processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); image and/or video recordings (e.g., photographs or video recordings of a person). Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, persons involved).
Data subjects: Interested parties; communication partners; business and contractual partners; Users (e.g., website visitors, users of online services).
Purposes of processing: Office and organizational procedures; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Provision of contractual services and fulfillment of contractual obligations.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing methods, procedures, and services:

Adobe Creative Cloud: Cloud storage, cloud infrastructure services, and cloud-based application software, including for photo editing, video editing, graphic design, and web development. Service provider: Adobe Systems Software Ireland, 4-6, Riverwalk Drive, Citywest Business Campus, Brownsbarn, Dublin 24, D24 DCW0, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.adobe.com/de/creativecloud.html; Privacy policy: https://www.adobe.com/de/privacy.html; Data processing agreement: Provided by the service provider. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider).
Microsoft Cloud Services: Cloud storage, cloud infrastructure services, and cloud-based application software; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://microsoft.com/de-de; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Notice: https://www.microsoft.com/de-de/trustcenter; Data Processing Agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
Amazon Web Services (AWS): Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Service provider: Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855, Luxembourg; Legal basis: Legitimate interests (Art. 6, Paragraph 1, sentence 1, letter f) GDPR); Website: https://aws.amazon.com/de/; Privacy Policy: https://aws.amazon.com/de/privacy/; Data processing agreement: https://aws.amazon.com/de/compliance/gdpr-center/. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://aws.amazon.com/service-terms/), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://aws.amazon.com/service-terms/).

Sweepstakes and Competitions

We only process the personal data of participants in sweepstakes and competitions in compliance with the relevant data protection regulations, provided that the processing is contractually necessary for the provision, implementation, and execution of the sweepstakes, the participants have consented to the processing, or the processing serves our legitimate interests (e.g., the security of the sweepstakes or the protection of our interests against misuse through the possible collection of IP addresses when submitting sweepstakes entries).

If participants’ contributions are published as part of the sweepstakes (e.g., as part of a vote or presentation of the sweepstakes entries or the winners, or reporting on the sweepstakes), we would like to point out that the names of the participants may also be published in this context. Participants can object to this at any time.

If the sweepstakes takes place within an online platform or social network (e.g., Facebook or Instagram, hereinafter referred to as the “Online Platform”), the terms of use and data protection provisions of the respective platforms also apply. In these cases, we would like to point out that we are responsible for the information provided by participants during the competition, and any inquiries regarding the competition should be directed to us.

Participants’ data will be deleted as soon as the competition or contest has ended and the data is no longer required to inform the winners or because no further queries regarding the competition are expected. Participants’ data will generally be deleted no later than six months after the end of the competition. Winners’ data may be retained for a longer period, for example, to answer queries about the prizes or to fulfill the prize-winning services. In this case, the retention period depends on the type of prize and is up to three years for goods or services, for example, in order to process warranty claims. Participants’ data may also be stored for a longer period, for example, in the form of reporting on the competition in online and offline media.

If data was collected for other purposes as part of the competition, its processing and retention period are governed by the privacy policy for this use (e.g., in the case of registration for the newsletter as part of a competition).

Types of data processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and contributions, as well as information relating to them, such as authorship or time of creation).
Data subjects: Competition and contest participants.
Purposes of processing: Conducting competitions and contests.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Surveys and Questionnaires

We conduct surveys and questionnaires to collect information for the respective communicated survey or questionnaire purpose. The surveys and questionnaires we conduct (hereinafter “surveys”) are evaluated anonymously. Personal data is processed only to the extent necessary for the provision and technical implementation of the surveys (e.g., processing the IP address to display the survey in the user’s browser or to enable resumption of the survey using a cookie).

Data types processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, persons involved).
Data subjects: Participants. Users (e.g., website visitors, users of online services).
Purposes of processing: Feedback (e.g., collecting feedback via online forms). Surveys and questionnaires (e.g., surveys with input options, multiple-choice questions).
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures, and services:

Microsoft Forms: Creation of online forms, collection of responses in real time, analysis of results with integrated charts. Integration with other Office applications for further data processing. Customizable forms with various question types and answer options, as well as data export. Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://forms.office.com/; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

Web analysis, monitoring, and optimization

Web analysis (also known as “reach measurement”) is used to evaluate visitor flows to our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. Using reach analysis, we can, for example, identify when our online offering or its functions or content are most frequently used, or encourage reuse. We are also able to understand which areas require optimization.

In addition to web analysis, we can also use testing procedures to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e., data summarized for a usage process, may be created for these purposes, and information may be stored in a browser or on a device and then read out. The data collected includes, in particular, websites visited and the elements used there, as well as technical information such as the browser used, the computer system used, and information on usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

In addition, users’ IP addresses are stored. However, we use an IP masking process (i.e., pseudonymization by shortening the IP address) to protect users. Generally, no real user data (such as email addresses or names) is stored for web analysis, A/B testing, and optimization, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective processes.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g., page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Reach measurement (e.g., access statistics, recognition of recurring visitors). Profiles with user-related information (creation of user profiles).
Retention and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section. Cookies are stored for up to two years (unless otherwise stated, cookies and similar storage methods may be stored on users’ devices for a period of two years).
Security measures: IP masking (pseudonymization of the IP address).
Legal basis: Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Online Marketing

We process personal data for the purpose of online marketing, which may include, in particular, the marketing of advertising space or the presentation of advertising and other content (collectively referred to as “content”) based on users’ potential interests, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called “cookie”), or similar processes are used to store the user information relevant to the presentation of the aforementioned content. This may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used, as well as information on usage times and functions used. If users have consented to the collection of their location data, this data may also be processed.

In addition, users’ IP addresses are stored. However, we use available IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. Generally, no user data (such as email addresses or names) is stored within the online marketing process, but rather pseudonyms. This means that neither we nor the providers of the online marketing process know the actual user identity, but only the information stored in their profiles.

The statements in the profiles are generally stored in cookies or similar processes. These cookies can generally be read later on other websites that use the same online marketing process and analyzed for the purpose of displaying content, supplemented with additional data, and stored on the server of the online marketing process provider.

Exceptionally, it is possible to assign clear data to the profiles, primarily if the users are, for example, members of a social network whose online marketing process we use and the network links the user profiles with the aforementioned information. Please note that users can enter into additional agreements with the providers, for example, by consenting during registration.

We generally only receive access to summarized information about the success of our advertisements. However, within the framework of so-called conversion measurements, we can check which of our online marketing processes have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurements are used solely to analyze the success of our marketing measures.

Unless otherwise stated, we ask you to assume that cookies used will be stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Notes on revocation and objection:

We refer you to the privacy policies of the respective providers and the objection options (so-called “opt-out”) specified for the providers. If no explicit opt-out option has been stated, you have the option of deactivating cookies in your browser settings. However, this may limit the functionality of our online offering. We therefore recommend the following opt-out options, which are summarized for each region:

a) Europe: https://www.youronlinechoices.eu.
b) Canada: https://www.youradchoices.ca/choices.
c) USA: https://www.aboutads.info/choices.
d) Cross-regional: https://optout.aboutads.info.

Types of data processed: Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Reach measurement (e.g., access statistics, recognition of recurring visitors); Tracking (e.g., interest-/behavior-based profiling, use of cookies); Target group building; Marketing. Profiles with user-related information (creation of user profiles).
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section. Cookies are stored for up to two years. (Unless otherwise stated, cookies and similar storage methods may be stored on users’ devices for a period of two years.)
Security measures: IP masking (pseudonymization of the IP address).
Legal basis: Consent (Art. 6 (1) (a) GDPR).

Further information on processing procedures, methods, and services:

Google Adsense with personalized ads: We integrate the Google Adsense service, which enables personalized ads to be placed within our online offering. Google Adsense analyzes user behavior and uses this data to display targeted advertising tailored to the interests of our visitors. We receive financial compensation for each ad placement or other use of these ads. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 (1) (a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF); Further information: Types of processing and data processed: https://business.safety.google/adsservices/. Data processing conditions for Google advertising products: Information about the services, data processing conditions between controllers, and standard contractual clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.

Customer reviews and rating processes

We participate in review and rating processes to evaluate, optimize, and promote our services. If users rate us via the participating rating platforms or processes or otherwise provide feedback, the general terms and conditions or terms of use and the privacy policy of the providers also apply. As a rule, the rating also requires registration with the respective providers.

To ensure that the reviewers have actually used our services, with the customer’s consent, we transmit the necessary data regarding the customer and the service used to the respective rating platform (including name, email address, and order number or item number). This data is used solely to verify the user’s authenticity.

Data types processed: Contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); Meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, persons involved).
Data subjects: Service recipients and clients. Users (e.g., website visitors, users of online services).
Purposes of processing: Feedback (e.g., collecting feedback via online form). Marketing.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures, and services:

Google Customer Reviews: Service for collecting and/or presenting customer satisfaction and opinions; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF); Further information: When collecting customer reviews, an identification number and the time of the business transaction to be evaluated are processed. For review requests sent directly to customers, the customer’s email address, their country of residence, and the review details themselves are processed. Further information on the types of processing and the data processed can be found at https://business.safety.google/adsservices/. Data processing terms for Google advertising products: Information about the services, data processing terms between controllers, and standard contractual clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.

Presences on social networks (social media)

We maintain online presences within social networks and, in this context, process user data to communicate with users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This could result in risks for users, for example, because it could make it more difficult to enforce user rights.

Furthermore, user data is generally processed within social networks for market research and advertising purposes. For example, user profiles can be created based on user behavior and the resulting interests of users. These profiles may, in turn, be used to place advertisements within and outside the networks that presumably correspond to the user’s interests. Therefore, cookies are generally stored on users’ computers to store user behavior and interests. In addition, data may also be stored in user profiles regardless of the devices used by users (especially if they are members of the respective platforms and are logged in there).

For a detailed description of the respective processing methods and the opt-out options, please refer to the privacy policies and information provided by the operators of the respective networks.

Regarding requests for information and the assertion of data subject rights, we would like to point out that these can be most effectively asserted with the providers. Only the latter have access to user data and can directly take appropriate measures and provide information. If you still need help, please contact us.

Types of data processed: Contact data (e.g., postal and email addresses or telephone numbers); Content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Communication; Feedback (e.g., collecting feedback via online form); Public relations.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing procedures, methods, and services:

Instagram: Social network, enables sharing photos and videos, commenting on and favorite posts, sending messages, and subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
Facebook pages: Profiles within the social network Facebook – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (so-called “fan page”). This data includes information about the types of content users view or interact with, or the actions they take (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/), as well as information about the devices users use (e.g., IP addresses, operating system, browser type, language preferences, cookie data; see “Device Information” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services called “Page Insights” to Page operators to help them understand how people interact with their Pages and the content associated with them. We have concluded a special agreement with Facebook (“Information on Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which specifically regulates the security measures Facebook must observe and in which Facebook has agreed to fulfill the rights of those affected (i.e., users can, for example, submit information or deletion requests directly to Facebook). Users’ rights (in particular the right to information, deletion, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information on Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data). Joint controllership is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, particularly regarding the transmission of data to the parent company Meta Platforms, Inc. in the USA. Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
LinkedIn: Social network – We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not further processing) of visitor data used to create the “Page Insights” (statistics) of our LinkedIn profiles. This data includes information about the types of content users view or interact with, as well as the actions they take. It also collects details about the devices used, such as IP addresses, operating systems, browser types, language preferences, and cookie data, as well as from user profiles, such as job function, country, industry, hierarchy level, company size, and employment status. Data protection information regarding the processing of user data by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

We have concluded a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum”, https://legal.linkedin.com/pages-joint-controller-addendum), which specifically regulates the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of data subjects (i.e., users can, for example, submit requests for information or deletion directly to LinkedIn). Users’ rights (in particular the right to information, deletion, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint controllership is limited to the collection and transmission of data to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular with regard to the transmission of data to the parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa). Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

X: Social network; Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://x.com. Privacy policy: https://x.com/de/privacy.
Vimeo: Social network and video platform; Service provider: Vimeo Inc., Attention: Legal Department, 555 West 18th Street, New York, New York 10011, USA; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://vimeo.com. Privacy policy: https://vimeo.com/privacy.
YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF). Opt-out option: https://myadcenter.google.com/personalizationoff.
Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.xing.com/. Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plug-ins and embedded functions and content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or city maps (hereinafter collectively referred to as “content”).

Integration always requires that the third-party providers of this content process the users’ IP address, as they would not be able to send the content to their browsers without an IP address. The IP address is therefore required to display this content or functions. We endeavor to only use content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These “pixel tags” enable information, such as visitor traffic on the pages of this website, to be evaluated. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, the time of visit, and other information about the use of our online offering, but may also be linked to such information from other sources.

Types of data processed: Usage data (e.g., page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, persons involved); location data (information on the geographical position of a device or person); Contact data (e.g., postal and email addresses or telephone numbers). Content data (e.g., textual or visual messages and posts, as well as information relating to them, such as authorship or time of creation).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Provision of our online offering and user-friendliness; reach measurement (e.g., access statistics, recognition of recurring visitors); tracking (e.g., interest-/behavior-based profiling, use of cookies); target group building; marketing; provision of contractual services and fulfillment of contractual obligations. Profiles with user-related information (creation of user profiles).
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section. Cookies are stored for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users’ devices for a period of two years).
Legal basis: Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing methods, procedures, and services:

Google Fonts (obtained from Google servers): Obtaining fonts (and symbols) for the purpose of technically secure, maintenance-free, and efficient use of fonts and symbols with regard to timeliness and loading times, their consistent presentation, and consideration of possible licensing restrictions. The font provider is informed of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for providing the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA. When visiting our website, users’ browsers send HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving fonts). The Google Fonts Web API provides users with Google Fonts’ Cascading Style Sheets (CSS) and subsequently the fonts specified in the CCS. These HTTP requests include (1) the IP address used by the respective user to access the Internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the user agent, which describes the browser and operating system versions of website visitors, and the referring URL (i.e., the web page where the Google Font should be displayed). IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent, and referring URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how often a particular font family is requested. The Google Fonts Web API requires the user agent to customize the font generated for each browser type. The user agent is logged primarily for debugging purposes and is used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts Analytics page. Finally, the referring URL is logged so that the data can be used for production maintenance and an aggregated report on top integrations can be generated based on the number of font requests. According to Google, no information collected by Google Fonts can be used to create profiles of end users or to display targeted ads. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
Google Maps: We integrate the maps of the “Google Maps” service provided by Google. The data processed may include, in particular, users’ IP addresses and location data. Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6 (1) (a) GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
Google Maps APIs and SDKs: Interfaces to Google’s map and location services, which, for example, allow the addition of address entries, location determination, distance calculations, or the provision of additional information on locations and other places. Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Legal basis: Consent (Art. 6 (1) (a) GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy. Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
Pinterest plugins and content: Pinterest plugins and content – This can include, for example, content such as images, videos, or text and buttons that allow users to share content from this online offering within Pinterest; Service provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.pinterest.com. Privacy Policy: https://policy.pinterest.com/de/privacy-policy.
reCAPTCHA: We integrate the “reCAPTCHA” function to be able to recognize whether entries (e.g. in online forms) are made by people and not by automatically acting machines (so-called “bots”). The data processed may include IP addresses, information about operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, time spent on websites, previously visited websites, interactions with ReCaptcha on other websites, possibly cookies and the results of manual recognition processes (e.g. answering questions asked or selecting objects in images). The data processing is based on our legitimate interest in protecting our online offering from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.google.com/recaptcha/; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF). Opt-out option: Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying advertisements: https://myadcenter.google.com/personalizationoff.
X plugins and content: Plugins and buttons from the “X” platform. This can include, for example, content such as images, videos, or text and buttons that users can use to share content from this online offering within X. Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://x.com/de; Privacy Policy: https://x.com/de/privacy (Settings: https://x.com/personalization); Data processing agreement: https://privacy.x.com/en/for-our-partners/global-dpa. Basis for third-country transfers: EU/EEA – Standard Contractual Clauses (https://privacy.x.com/en/for-our-partners/global-dpa), Switzerland – Standard Contractual Clauses (https://privacy.x.com/en/for-our-partners/global-dpa).
YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 (1) (a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF). Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying advertisements: https://myadcenter.google.com/personalizationoff.
Vimeo video player: Integration of a video player; Service provider: Vimeo Inc., Attention: Legal Department, 555 West 18th Street, New York, New York 10011, USA; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://vimeo.com; Privacy Policy: https://vimeo.com/privacy; Data processing agreement: https://vimeo.com/enterpriseterms/dpa. Basis for third-country transfers: EU/EEA standard contractual clauses (https://vimeo.com/enterpriseterms/dpa), Switzerland – Standard Contractual Clauses (https://vimeo.com/enterpriseterms/dpa).
Font Awesome (obtained from the provider’s server): Obtaining fonts (and icons) for the purpose of technically secure, maintenance-free, and efficient use of fonts and icons with regard to timeliness and loading times, their consistent presentation, and consideration of possible licensing restrictions. The font provider is informed of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted that is necessary for providing the fonts depending on the devices used and the technical environment. Service provider: Fonticons, Inc., 6 Porter Road Apartment 3R, Cambridge, MA 02140, USA; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://fontawesome.com/. Privacy policy: https://fontawesome.com/privacy.
Google Hosted Libraries: Google Hosted Libraries is a globally available content delivery network (CDN) for the most popular open-source JavaScript libraries. These are used to provide web libraries to optimize website loading times, reduce bandwidth usage, and improve performance by using shared, public resources. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://developers.google.com/speed/libraries/. Privacy policy: https://policies.google.com/privacy.
Adobe Fonts: Provision of fonts for integration into web and print designs, synchronization of fonts across devices, access to a library of licensed fonts for creative projects, management and organization of fonts in projects; Service provider: Adobe Systems Software Ireland, 4-6, Riverwalk Drive, Citywest Business Campus, Brownsbarn, Dublin 24, D24 DCW0, Ireland; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.adobe.com/de/; Privacy Policy: https://www.adobe.com/de/privacy.html; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF). Further information: https://www.adobe.com/de/privacy/policies/adobe-fonts.html.

Management, Organization, and Support Tools

We use services, platforms, and software from third-party providers (hereinafter referred to as “third-party providers”) for the organization, administration, planning, and provision of our services. We comply with legal requirements when selecting third-party providers and their services.

In this context, personal data may be processed and stored on the servers of third-party providers. This may affect various data, which we process in accordance with the privacy policy. This data may include, in particular, user master data and contact details, data on transactions, contracts, other processes, and their content.

If users are referred to third-party providers or their software or platforms as part of communication, business, or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask you to observe the privacy policies of the respective third-party providers.

Types of data processed: Content data (e.g., textual or visual messages and contributions, as well as information relating to them, such as authorship or time of creation); Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication, and process data (e.g., IP addresses, time information, identification numbers, persons involved); inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers).
Data subjects: Communication partners. Users (e.g., website visitors, users of online services).
Purposes of processing: Communication; provision of contractual services and fulfillment of contractual obligations. Office and organizational procedures.
Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion.”
Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing methods, procedures, and services:

WeTransfer: Transfer of files over the internet; Service provider: WeTransfer BV, Oostelijke Handelskade 751, Amsterdam, 1019 BW, Netherlands; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://wetransfer.com. Privacy policy: https://wetransfer.com/legal/privacy.

Processing of data in the context of employment relationships

In the context of employment relationships, personal data is processed with the aim of effectively managing the establishment, implementation, and termination of such relationships. This data processing supports various operational and administrative functions necessary for managing employee relations.

Data processing encompasses various aspects ranging from contract initiation to contract termination. This includes the organization and management of daily working hours, the management of access rights and authorizations, as well as the handling of personnel development measures and employee interviews. Processing also serves the accounting and administration of wage and salary payments, which are critical aspects of contract implementation.

In addition, data processing takes into account the legitimate interests of the responsible employer, such as ensuring workplace safety or collecting performance data to evaluate and optimize operational processes. Furthermore, data processing includes the disclosure of employee data as part of external communication and publication processes where this is necessary for operational or legal purposes.

This data is always processed in compliance with the applicable legal framework, with the goal of creating and maintaining a fair and efficient working environment. This also includes considering the data protection of the employees concerned, anonymizing or deleting data after the processing purpose has been fulfilled or in accordance with statutory retention periods.

Types of data processed: Employee data (information about employees and other persons in an employment relationship); Payment data (e.g., bank details, invoices, payment history); Contract data (e.g., subject matter of the contract, term, customer category); Inventory data (e.g., full name, home address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or telephone numbers); Content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation); Social data (data subject to social secrecy and processed, for example, by social insurance providers, social assistance providers, or welfare authorities). Log data (e.g., log files relating to logins, data retrieval, or access times); performance and behavior data (e.g., performance and behavior aspects such as performance evaluations, feedback from superiors, training participation, compliance with company policies, self-assessments, and behavioral assessments); working time data (e.g., start of working time, end of working time, actual working time, target working time, break times, overtime, vacation days, special leave days, sick days, absences, home office days, business trips); salary data (e.g., base salary, bonus payments, premiums, tax class information, night work/overtime allowances, tax deductions, social security contributions, net payout amount); image and/or video recordings (e.g., photographs or video recordings of a person); usage data (e.g., page views and duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, persons involved).
Special categories of personal data: Health data; Religious or ideological beliefs; Union membership.
Data subjects: Employees (e.g., employees, applicants, temporary workers, and other staff).
Purposes of processing: Establishment and performance of employment relationships (processing of employee data in the context of establishing and performing employment relationships); Business processes and operational procedures; Security measures; Provision of contractual services and fulfillment of contractual obligations; Public relations; Office and organizational procedures.
Legal bases: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR); Legal obligation (Art. 6 (1) (c) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR). Processing of special categories of personal data relating to healthcare, employment, and social security (Article 9 (2) (h) GDPR).

Further information on processing processes, procedures, and services:

Time recording: Procedures for recording employees’ working hours include both manual and automated methods, such as the use of time clocks, Time recording software or mobile apps. Activities such as entering arrival and departure times, break times, overtime, and absences are performed. The review and validation of recorded working hours includes comparing them with deployment or shift schedules, reviewing absences, and having overtime approved by supervisors. Reports and analyses are created based on the recorded working hours to provide timesheets, overtime reports, and absence statistics for management and the human resources department. Legal bases: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Authorization management: Procedures required to define, manage, and control access rights and user roles within a system or organization (e.g., creation of authorization profiles, role- and access-based control, review and approval of access requests, regular review of access rights, tracking and auditing of user activities, creation of security policies and procedures); Legal bases: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), Legal obligation (Art. 6 (1) (c) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).
Special categories of personal data: Special categories of personal data are processed within the scope of the employment relationship or to fulfill legal obligations. The special categories of personal data processed include data relating to the health, trade union membership, or religious affiliation of employees. This data may, for example, be passed on to health insurance companies or processed to assess employees’ ability to work, for occupational health management, or for information to be provided to the tax office. Legal bases: Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Sources of the processed data: Personal data obtained as part of the employee’s application and/or employment relationship are processed. In addition, personal data is collected from other sources if required by law. These can be tax authorities for tax-relevant information, the respective health insurance company for information on incapacity to work, third parties such as employment agencies, or publicly accessible sources such as professional social networks in the context of application processes. Legal bases: Legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Video surveillance: The monitoring of employees serves the security of the company, the protection of property, and the safety of employees. Various procedures and data processing steps are carried out for this purpose.

First, surveillance cameras are installed and positioned, following a site analysis to identify security-relevant areas. The cameras are then installed at suitable locations, with indications of surveillance being provided by the installation of signs or warning notices.

Regular checks are carried out to ensure that the cameras are working properly and that no failures occur that could compromise security.

The actual monitoring is carried out by conducting video recordings to capture and document potential security incidents. These recordings are then evaluated and analyzed to identify suspicious activities and respond appropriately.

All recorded video data is archived in accordance with legal regulations and data protection guidelines. Please note that the data is deleted after a maximum of 96 hours, unless there is a specific suspicion that requires longer retention to clarify the facts or ensure the security of the company.

In addition, data deletion measures are implemented as soon as the retention periods have expired or the data is no longer needed in order to comply with data protection guidelines and protect employee privacy. Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Purposes of data processing: Employees’ personal data is primarily processed for the establishment, implementation, and termination of the employment relationship. Furthermore, the processing of this data is necessary to fulfill legal obligations in the areas of tax and social security law. In addition to these primary purposes, employee data is also used to fulfill regulatory and supervisory requirements, to optimize electronic data processing processes, and to compile internal or cross-company data, possibly including statistical data. Furthermore, employee data may be processed to assert legal claims and defend against legal disputes; legal bases: Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Transfer of employee data: Employee data is processed internally only by those departments that need it to fulfill operational, contractual, and legal obligations.

Data is only transferred to external recipients if required by law or if the employees concerned have given their consent. Possible scenarios for this could be requests for information from authorities or in the case of capital formation benefits. Furthermore, the controller may forward personal data to other recipients if this is necessary for Fulfillment of contractual and legal obligations as an employer is necessary. These recipients may include: a) Banks b) Health insurance companies, pension insurance providers, retirement provision providers, and other social insurance providers c) Authorities, courts (e.g., tax authorities, labor courts, other supervisory authorities in the context of fulfilling reporting and information obligations) d) Tax and legal advisors e) Third-party debtors in the event of wage and salary garnishments f) Other bodies to whom legally binding declarations must be made.

In addition, data may be passed on to third parties if this is necessary for communication with business partners, suppliers, or other service providers. Examples of this include information in the sender area of emails or letterheads, as well as the creation of profiles on external platforms; Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).

Transfer of employee data to third countries: Employee data will only be transferred to third countries, i.e., countries outside the European Union (EU) and the European Economic Area (EEA), if this is necessary for the performance of the employment relationship, is required by law, or if employees have given their consent. Employees will be informed separately of the details, where required by law; legal basis: legitimate interests (Article 6 (1) (f) GDPR).
Business trips and travel expense accounting: Procedures required for the planning, implementation, and accounting of business trips (e.g., booking trips, organizing accommodation and transportation, managing travel expense advances, submitting and reviewing travel expense reports, monitoring and posting costs incurred, adhering to travel guidelines, and managing travel expense management); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Payroll and wage accounting: Procedures required for the calculation, payment, and documentation of wages, salaries, and other remuneration of employees (e.g., recording working hours, calculating deductions and allowances, paying taxes and social security contributions, preparing payroll statements, maintaining payroll accounts, and reporting to tax authorities and social security institutions); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR).
Deletion of employee data: Under German law, employee data is deleted if it is no longer required for the purpose for which it was collected, unless it must be retained or archived due to legal obligations or the interests of the employer. The following retention and archiving obligations are observed:
General personnel documents – General personnel documents (such as employment contracts, employment references, and supplementary agreements) are retained for up to three years after the termination of the employment relationship (Section 195 of the German Civil Code (BGB)).

Tax-relevant documents – Tax-relevant documents in the personnel file are retained for six years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)).

Information on wages and working hours – Information on wages and working hours for (accident) insured persons with wage statements is retained for five years (Section 165 I 1, IV 2 of the German Social Code (SGB VII)).

Payroll lists, including lists for special payments – Payroll lists, including lists for special payments, provided that a booking receipt exists, are retained for ten years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB).
Payroll lists for interim, final, and special payments – Payroll lists for interim, final, and special payments are retained for six years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB).
Employee insurance documents – Employee insurance documents, provided that booking receipts exist, are retained for ten years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code).
Contribution statements to social insurance institutions – Contribution statements to social insurance institutions are retained for ten years (Section 165 of the German Social Code (SGB VII)).

Payroll accounts – Payroll accounts are retained for six years (Section 41 I 9 of the German Income Tax Act (EStG).

Applicant data – Will be retained for a maximum of six months from receipt of the rejection notice.
Working time records (for more than 8 hours on weekdays) – Retained for two years (Section 16 II of the Working Hours Act (ArbZG)).
Application documents (following an online job advertisement) – Retained for three to a maximum of six months after receipt of the rejection notice (Section 26
of the Federal Data Protection Act (BDSG) new version, Section 15 IV of the General Equal Treatment Act (AGG)).
Incapacity certificates (AU) – Retained for up to five years (Section 6 I of the Expenses Compensation Act (AAG)).
Documents relating to company pension plans – Retained for 30 years (Section 18a of the Act to Improve Company Pension Schemes (BetrAVG)).
Employee illness data – Retained for twelve months after the onset of the illness if the absences do not exceed six weeks in a year.
Maternity protection documents – Retained for two years (Section 27 (5) of the MuSchG).

Legal bases:

Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR), processing of special categories of personal data relating to healthcare, employment, and social security (Art. 9 (2) (h) GDPR).

Personnel file management: procedures necessary for organizing, updating, and managing employee data and records (e.g., recording personnel master data, storing employment contracts, certificates, and attestations, updating data in the event of changes, compiling documents for employee interviews, archiving personnel files, compliance with data protection regulations); Legal bases: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR), processing of special categories of personal data relating to healthcare, employment and social security (Art. 9 (2) (h) GDPR).
Personnel development, performance evaluation and employee reviews: Procedures necessary in the area of the promotion and further development of employees as well as in the assessment of their performance and in the context of employee reviews (e.g. needs analysis for further training, planning and implementation of training measures, preparation of performance evaluations, implementation of goal-setting and feedback discussions, career planning and talent management, succession planning); Legal bases: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR), processing of special categories of personal data relating to healthcare, occupation, and social security (Art. 9 (2) (h) GDPR).
Obligation to provide data: The controller informs employees that the provision of their data is necessary. This is generally the case if the data is necessary for the establishment and implementation of the employment relationship or if its collection is required by law. The provision of data may also be necessary if employees assert claims or are entitled to claims. The implementation of these measures or the provision of services depends on the provision of this data (for example, the provision of data for the purpose of receiving wages); Legal bases: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legal obligation (Art. 6 (1) (c) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).
Publication and disclosure of employee data: Employee data will only be published or disclosed to third parties if, on the one hand, this is necessary to perform the work tasks in accordance with the employment contract. This applies, for example, if employees are named as contact persons in correspondence, on the website, or in public registers after consultation or an agreed job description, or if the area of responsibility includes representative functions. This can also be the case if, as part of the performance of duties, representation or communication with the public takes place, such as photographs taken as part of public relations work. Otherwise, employee data will only be published with their consent or on the basis of the employer’s legitimate interests, for example, in the case of stage or group photo shoots during a public event. Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).

Application Process

The application process requires applicants to provide us with the data necessary for their assessment and selection. The information required can be found in the job description or, in the case of online forms, in the information provided there.

Generally, the required information includes personal information such as name, address, contact details, and proof of the qualifications required for a position. Upon request, we will be happy to provide additional information.

Where available, applicants are welcome to submit their applications via our online form, which is encrypted using the latest technology. Alternatively, applications can also be sent to us by email. However, we would like to point out that emails are generally not encrypted over the internet. Although emails are usually encrypted during transport, this is not done on the servers from which they are sent and received. Therefore, we cannot accept any responsibility for the security of the application during transmission between the sender and our server.

For the purposes of searching for applicants, submitting applications, and selecting applicants, we may, in compliance with legal requirements, utilize applicant management or recruitment software, platforms, and services from third-party providers.

Applicants are welcome to contact us regarding the method of submitting their application or to send it to us by mail.

Processing of special categories of data: If special categories of personal data (Article 9 (1) GDPR, e.g., health data such as severe disability or ethnic origin) are requested from applicants or disclosed by them as part of the application process, this data will be processed so that the controller or the data subject can exercise their rights under labor law and social security and social protection law and fulfill their obligations in this regard, in the case of protecting the vital interests of the applicants or other persons or for the purposes of preventive healthcare or occupational medicine, for assessing the employee’s ability to work, for medical diagnostics, for the provision of care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector.

Deletion of data: If the application is successful, the data provided by applicants may be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a job offer is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a legitimate withdrawal by the applicant, data will be deleted after a period of six months at the latest, so that we can answer any follow-up questions regarding the application and fulfill our documentation obligations under the regulations on equal treatment of applicants. Invoices for any reimbursement of travel expenses will be archived in accordance with tax law requirements.

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the ongoing application process, and that they can revoke their consent at any time with effect for the future.

Data types processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as information relating to them, such as authorship or time of creation); applicant data (e.g., personal information, postal and contact addresses, application documents and the information contained therein, such as cover letters, resumes, certificates, and other personal or qualification information provided by applicants with regard to a specific position or voluntarily provided by applicants).
Data subjects: Applicants.
Purposes of processing: Application process (justification and possible subsequent implementation, as well as possible subsequent termination of the employment relationship).
Storage and deletion: Deletion in accordance with the information in the “General Information on Data Storage and Deletion” section.
Legal basis: Application process as a pre-contractual or contractual relationship (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing procedures, methods, and services:

Stepstone: Services related to employee recruitment (search for employees, communication, application procedures, contract negotiations); Service provider: StepStone Deutschland GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany; Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.stepstone.de. Privacy Policy: https://www.stepstone.de/Ueber-StepStone/Rechtliche-Hinweise/datenschutzerklaerung/.

Data protection information for whistleblowers

In this section, you will find information about how we handle data from individuals who provide information (whistleblowers), as well as from affected and involved parties, as part of our whistleblower process. Our goal is to provide a straightforward and secure way to report possible misconduct by us, our employees, or service providers, especially for actions that violate laws or ethical guidelines. We also ensure appropriate processing and handling of reports.

Legal basis (Germany): To the extent that we process data to fulfill our legal obligations under the Whistleblower Protection Act (HinSchG), the legal basis for processing is Article 6 (1) (c) GDPR and, in the case of special categories of personal data, Article 9 (2) (g) GDPR, Section 22 BDSG (German Federal Data Protection Act), in each case in conjunction with Section 10 HinSchG. This refers to the obligation to establish and operate an internal whistleblower reporting center, to fulfill its statutory duties, and, in the case of the use of the data collected in the reporting process, to initiate further investigations or legal proceedings against individuals found to have committed a violation.

To the extent that we process data (particularly in the case of identified misconduct) in the context of or in preparation for legal defense, this is done on the basis of our legitimate interests in acting in a legally compliant and ethical manner in accordance with Article 6 (1) (f) GDPR.

If you have given us your consent to process personal data for specific purposes, the processing will be based on Art. 6 (1) (a) GDPR and, in the case of special categories of personal data, Art. 9 (2) (a) GDPR. Examples of this would be disclosing the identity of the whistleblower or taking a verbatim transcript during a personal meeting. Consent given can be revoked at any time with future effect.

Types of data processed:

In the context of receiving and processing tips and in the subsequent whistleblower procedure, we may collect various data. This includes, in particular, the data provided by a whistleblower, such as:

Name, contact details, and location of the person providing the information,
Names and details of possible witnesses or persons affected by the information,
Names and details of the persons against whom the information is directed,
Information about the alleged misconduct,
Other relevant details, if provided by the whistleblower.

For the purposes of the investigation and the further proceedings, we also process the following personal data:

Unique identification of the report,
Contact details of the whistleblower, if provided,
Personal details of persons named in the information, if provided,
Personal details of persons indirectly affected by the investigation, if applicable,
Personal details of persons from other companies involved (e.g., in the context of legal advice), if relevant,
Other data related to the matter.

Special categories of personal data:

We may collect special types of personal data in the course of our activities, particularly when provided by a whistleblower. This includes:

Data relating to an individual’s health,
Data relating to an individual’s racial or ethnic origin,
Information relating to an individual’s religious or philosophical beliefs,
Information relating to an individual’s sexual orientation.

This data will only be processed if it is relevant to processing the respective tip and has been expressly provided by the whistleblower.

Using our online forms: Please note that it is possible to submit tips anonymously. To ensure the security of your data when using our online forms, we recommend using your browser’s ‘incognito mode’. To open an incognito window, follow these steps: a) On a Windows PC: Open your browser and press Ctrl+Shift+N; b) On a Mac: Open your browser and press Command+Shift+N; c) On mobile devices: Switch to private mode via the tab menu.

When you access our website in normal mode, your browser automatically sends certain information to our server, such as the browser type and version, the date and time of your access. This also includes the IP address of your device. This data is temporarily stored in a log file and automatically deleted after 30 days at the latest.

The processing of the IP address serves the technical and administrative purposes of establishing a connection to our website. It ensures the security, stability, and functionality of the whistleblower form and is an important part of our measures to ensure confidentiality.

The processing of the logged data is based on Article 6 (1) (f) GDPR. Our legitimate interest lies in the need for security and the necessity to ensure the technical requirements for smooth and uninterrupted reporting.

Providing names: You have the option of submitting reports anonymously. However, unless prohibited by national law, we recommend providing your name and contact details. This allows us to investigate the report more effectively and, if necessary, contact you directly.

If you provide your name and contact details, your identity will be treated with the strictest confidence. Exceptions to this confidentiality only apply if we are legally required to disclose your identity. This may be necessary to protect or defend our rights or the rights of our employees, customers, suppliers, or business partners. Another exception applies if it is determined that the allegations were made maliciously.

Provision of data to third parties: We will only disclose data related to the information you provide to third parties under certain circumstances. This will occur either a) if you have given us your explicit consent to do so, or b) if there is a legal obligation to disclose the data. Possible third parties include public authorities, government, regulatory, or tax authorities if the disclosure is necessary to comply with a legal or regulatory obligation. We may also engage lawyers and other professional advisors as required by law. These are authorized to investigate suspected misconduct and take necessary measures following an investigation, such as initiating disciplinary or legal proceedings. In addition, service providers carefully selected and monitored by us may receive data for these purposes (e.g., operators of a web-based reporting system). However, these service providers are contractually obligated to comply with applicable data protection regulations as part of their contract data processing.

Data retention and deletion: Personal data will only be processed for as long as necessary to fulfill the processing purposes described above. If this data is no longer required for the stated purposes, it will be deleted. In certain situations, however, the data may be retained for longer to comply with legal requirements, as long as this is necessary and proportionate. In such cases, the data will be deleted as soon as it is no longer required for these purposes.

Technical and organizational measures: We have implemented the necessary contractual, technical, and organizational measures to ensure the security of all data we process. This data will be processed exclusively for the specified purposes.

Incoming tips are processed by authorized personnel who are granted access to the respective tips and conduct the subsequent investigation. Our employees are specially trained and educated to properly conduct investigations and are obligated to maintain the strictest confidentiality.

Types of data processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); employee data (information about employees and other persons in an employment relationship); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as information relating to them, such as authorship or time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
Data subjects: Employees (e.g., employees, applicants, temporary workers, and other employees); third parties. Whistleblowers.
Purposes of processing: Whistleblower protection.
Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion.”
Legal basis: Consent (Art. 6 (1) (a) GDPR); Legal obligation (Art. 6 (1) (c) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Whistleblower systems

As part of our whistleblower process, we use external providers. In doing so, we act within the framework of legal requirements and ensure that the technical and organizational requirements for security measures we adhere to are also met by the external providers.

Data types processed: Inventory data (e.g., full name, home address, contact information, customer number, etc.); employee data (information about employees and other persons in an employment relationship); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or visual messages and posts, as well as related information, such as authorship or time of creation). Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
Data subjects: Employees (e.g., employees, applicants, temporary workers, and other staff); third parties; whistleblowers; users (e.g., website visitors, users of online services); business and contractual partners.
Purposes of processing: Whistleblower protection. Security measures.
Storage and deletion: Deletion in accordance with the information in the “General information on data storage and deletion” section.
Legal basis: Consent (Art. 6 (1) (a) GDPR); Legal obligation (Art. 6 (1) (c) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures, and services:

Hinweisgeberexperte.de: Reporting channel and whistleblower system; Service provider: Compliance Beratung + Service GmbH, Maximilianstraße 24, 80539 Munich, Germany; Legal basis: Legal obligation (Art. 6 (1) (c) GDPR); Website: https://hinweisgeberexperte.de/; Privacy policy: https://hinweisgeberexperte.de/datenschutzerklaerung/. Data processing agreement: Provided by the service provider.

Changes and Updates

We ask you to inform yourself regularly about the content of our privacy notice. We will adapt this privacy notice as soon as the changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require your cooperation (e.g., consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy notice, please note that the addresses may change over time and ask you to check the information before contacting us.

Definitions of Terms

This section provides an overview of the terms used in this privacy notice. To the extent that the terms are defined by law, their legal definitions apply. The following explanations, however, are primarily intended to facilitate understanding.

Employees: Employees are persons who are in an employment relationship, whether as employees, staff, or in similar positions. An employment relationship is a legal relationship between an employer and an employee, established by an employment contract or agreement. It involves the employer’s obligation to pay the employee remuneration while the employee performs their work. The employment relationship comprises various phases, including the establishment of the employment contract, the implementation of the contract, during which the employee performs their work, and the termination, when the employment relationship ends, whether through notice, termination agreement, or otherwise. Employee data is all information relating to these individuals and in the context of their employment. This includes aspects such as personal identification data, identification numbers, salary and banking information, working hours, vacation entitlements, health data, and performance evaluations.
Inventory data: Inventory data includes essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include, among other things, personal and demographic information such as names, contact information (addresses, telephone numbers, email addresses), dates of birth, and unique identifiers (user IDs). Inventory data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling unambiguous identification and communication.
Credit report: Automated decisions are based on automatic data processing without human intervention (e.g., in the case of an automatic rejection of a purchase on account, an online credit application, or an online application process without any human intervention). Such automated decisions are only permissible under Art. 22 GDPR if the data subjects consent, if they are necessary for the performance of a contract, or if national law permits such decisions.
Firewall: A firewall is a security system that protects a computer network or an individual computer from unwanted network access.
Content data: Content data includes information generated during the creation, editing, and publication of all types of content. This category of data can include text, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content but also includes metadata that provides information about the content itself, such as tags, descriptions, author information, and publication dates.
Contact data: Contact data is essential information that enables communication with individuals or organizations. It includes, among other things, telephone numbers, postal addresses, and email addresses, as well as communication tools such as social media handles and instant messaging identifiers.
Artificial Intelligence (AI): The purpose of processing data using artificial intelligence (AI) includes the automated analysis and processing of user data to recognize patterns, make predictions, and improve the efficiency and quality of our services. This includes collecting, cleansing, and structuring data, training and applying AI models, and continuously reviewing and optimizing the results. This is done exclusively with user consent or on the basis of legal permission.
Performance and behavior data: Performance and behavior data refers to information related to how people perform tasks or behave in a specific context, such as an educational, work, or social setting. This data can include metrics such as productivity, efficiency, work quality, attendance, and adherence to policies or procedures. Behavioral data could include interactions with colleagues, communication styles, decision-making processes, and responses to various situations. These types of data are often used for performance evaluations, training and development, and decision-making within organizations.
Meta, communication, and procedural data: Meta, communication, and procedural data are categories that contain information about how data is processed, transmitted, and managed. Metadata, also known as data about data, includes information that describes the context, origin, and structure of other data. It can include information about file size, creation date, author of a document, and modification histories. Communication data records the exchange of information between users across different channels, such as email traffic, call logs, social media messages, and chat histories, including the people involved, timestamps, and transmission paths. Procedural data describes the processes and procedures within systems or organizations, including workflow documentation, logs of transactions and activities, and audit logs used to track and review events.
Usage data: Usage data refers to information that records how users interact with digital products, services, or platforms. This data encompasses a broad range of information, including how users use applications, which features they prefer, how long they spend on certain pages, and which paths they take within an application. Usage data can also include frequency of use, timestamps of activities, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. In addition, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings.
Personal data: “Personal data” is any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Profiles with user-related information: The processing of “profiles with user-related information,” or “profiles” for short, includes any type of automated processing of personal data consisting of the use of this personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information relating to demographics, behavior, and interests, such as interaction with websites and their content, etc.) (e.g., interests in certain content or products, click behavior on a website, or location). Cookies and web beacons are often used for profiling purposes.
Log data: Log data is information about events or activities logged on a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details about the use or operation of a system. Log data is often used to analyze system problems, monitor security, or compile performance reports.
Reach measurement: Reach measurement (also known as web analytics) is used to evaluate the visitor flows of an online offering and can include the behavior or interests of visitors in certain information, such as website content.

With the help of reach analysis, operators of online services can, for example, recognize when users visit their websites and what content they are interested in. This allows them, for example, to better adapt the content of the websites to the needs of their visitors. Pseudonymous cookies and web beacons are often used for reach analysis purposes to recognize recurring visitors and thus obtain more precise analyses of the use of an online service.

Location data: Location data is generated when a mobile device (or another device with the technical requirements for location determination) connects to a cell tower, a WLAN or similar technical means and functions for location determination. Location data is used to indicate the geographically identifiable position on earth of the respective device. Location data can be used, for example, to display map functions or other location-dependent information.
Tracking: “Tracking” occurs when user behavior can be tracked across multiple online offerings. Typically, behavioral and interest information related to the online offerings used is stored in cookies or on the servers of the tracking technology providers (so-called profiling). This information can then be used, for example, to show users advertisements that are likely to correspond to their interests.
Controller: The “controller” is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, decides on the purposes and means of processing personal data.
Processing: “Processing” is any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means. The term is broad and encompasses virtually every handling of data, be it collection, analysis, storage, transmission, or deletion.
Contract data: Contract data is specific information relating to the formalization of an agreement between two or more parties. They document the conditions under which services or products are provided, exchanged, or sold. This data category is essential for managing and fulfilling contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data can include contract start and end dates, the type of agreed services or products, pricing agreements, payment terms, termination rights, renewal options, and special terms or clauses. They serve as the legal basis for the relationship between the parties and are crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.
Payment data: Payment data includes all information required to process payment transactions between buyers and sellers. This data is crucial for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank details, payment amounts, transaction data, verification numbers, and billing information. Payment data can also include information about payment status, chargebacks, authorizations, and fees.
Target group creation: Target group creation (English “custom audiences”) is the process of defining target groups for advertising purposes, e.g., displaying advertisements. For example, based on a user’s interest in certain products or topics on the internet, it can be concluded that this user is interested in advertisements for similar products or the online shop in which they viewed the products. “Lookalike audiences” (or similar target groups) are the process of displaying content deemed suitable to users whose profiles or interests presumably correspond to the users for whom the profiles were created. Cookies and web beacons are typically used to create custom audiences and lookalike audiences.

Data Protection Notice

We are Metal Service!

Carl Berghöfer GmbH

Links

Follow us