Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online services”).

The terms used are not gender-specific.

Status: March 24, 2026

Legal text by Dr. Schwenke - please click for more information.

Table of Contents

Controller

Ayad Abul-Ella
Everblue Technologies GmbH
Fabeckstr. 60-62
14195 Berlin
Germany

Authorized representatives: Ayad Abul-Ella

Email address: ayad@everblue-technologies.de

Legal Notice: https://everblue-technologies.de/impressum

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of Data Processed

  • Master data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta, communication, and procedural data.
  • Log data.

Categories of Data Subjects

  • Service recipients and clients.
  • Employees.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Business and contractual partners.
  • Third parties.
  • Customers.

Purposes of Processing

  • Provision of contractual services and fulfillment of contractual obligations.
  • Communication.
  • Security measures.
  • Reach measurement.
  • Tracking.
  • Office and organizational procedures.
  • Conversion measurement.
  • Target group formation.
  • Organizational and administrative procedures.
  • Feedback.
  • Marketing.
  • Profiles with user-related information.
  • Provision of our online services and user-friendliness.
  • Information technology infrastructure.
  • Financial and payment management.
  • Public relations.
  • Sales promotion.
  • Business processes and economic procedures.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations in your or our country of residence or domicile may apply. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) – The data subject has given their consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission as well as automated decision-making in individual cases including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Note on the application of GDPR and Swiss FADP: These privacy notices serve to provide information according to both the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that due to the broader spatial application and clarity, the terms of the GDPR are used. In particular, instead of the terms “processing” of “personal data”, “overriding interest”, and “sensitive personal data” used in the Swiss FADP, the terms “processing” of “personal data” as well as “legitimate interest” and “special categories of data” used in the GDPR are used. However, the legal meaning of the terms will continue to be determined according to the Swiss FADP within the scope of its application.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access, input, transfer, ensuring availability, and its separation. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data, and reactions to data threats. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software, and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect user data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This serves as an indicator for users that their data is being transmitted securely and encrypted.

Transfer of Personal Data

In the context of our processing of personal data, it happens that these are transferred to other bodies, companies, legally independent organizational units, or persons or disclosed to them. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude corresponding contracts or agreements that serve to protect your data with the recipients of your data.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with legal provisions as soon as the underlying consents are revoked or there are no further legal bases for processing. This applies to cases where the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule exist if legal obligations or special interests require longer storage or archiving of the data.

In particular, data that must be kept for commercial or tax reasons or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons must be archived accordingly.

Our privacy notices contain additional information on the storage and deletion of data that applies specifically to certain processing operations.

If several details are given regarding the storage period or deletion periods of data, the longest period is always decisive. Data that is no longer stored for the originally intended purpose, but due to legal requirements or other reasons, is processed by us exclusively for the reasons that justify its storage.

Storage and deletion of data: The following general periods apply to storage and archiving under German law:

  • 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and other organizational documents required for their understanding (§ 147 para. 1 no. 1 in conjunction with para. 3 AO, § 14b para. 1 UStG, § 257 para. 1 no. 1 in conjunction with para. 4 HGB).
  • 8 years – Accounting vouchers, such as invoices and cost vouchers (§ 147 para. 1 no. 4 and 4a in conjunction with para. 3 sentence 1 AO and § 257 para. 1 no. 4 in conjunction with para. 4 HGB).
  • 6 years – Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are of importance for taxation, e.g., hourly wage slips, business analysis sheets, calculation documents, price labels, but also payroll documents insofar as they are not already accounting vouchers and cash register tapes (§ 147 para. 1 no. 2, 3, 5 in conjunction with para. 3 AO, § 257 para. 1 no. 2 and 3 in conjunction with para. 4 HGB).
  • 3 years – Data required to take into account potential warranty and damage claims or similar contractual claims and rights as well as to process related inquiries, based on previous business experience and common industry practices, are stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Start of period at the end of the year: If a period does not expressly begin on a specific date and is at least one year, it starts automatically at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships within the framework of which data is stored, the event triggering the period is the time at which the termination or other end of the legal relationship becomes effective.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject under the GDPR, you are entitled to various rights, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent at any time.
  • Right of access: You have the right to request confirmation as to whether data in question is being processed and to information about this data as well as further information and a copy of the data in accordance with legal requirements.
  • Right to rectification: You have the right, in accordance with legal requirements, to request the completion of data concerning you or the rectification of incorrect data concerning you.
  • Right to erasure and restriction of processing: You have the right, in accordance with legal requirements, to request that data concerning you be deleted immediately, or alternatively, in accordance with legal requirements, to request a restriction of the processing of the data.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used, and machine-readable format or to demand its transfer to another controller in accordance with legal requirements.
  • Complaint to a supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State in which you usually reside, the supervisory authority of your place of work, or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR.

Business Services

We process personal data of our contractual and business partners, such as customers, clients, interested parties, suppliers, and other cooperation partners (collectively “contractual partners”), for the initiation, implementation, and processing of contractual relationships and comparable legal relationships. This also includes pre-contractual measures taken at request, as well as communication in connection with the respective contractual relationship.

The processing serves in particular to fulfill our primary and secondary contractual obligations. This includes the provision of the agreed services, any update and information obligations, the processing of warranty and other performance disruptions, the processing of revocations, terminations of long-term obligations, reversals, refunds, and the processing of other contract-related declarations and inquiries. Both one-time contracts and ongoing contractual relationships are covered.

In particular, master data such as name, address, and if applicable, company, contact data such as email address and telephone number, contract and performance data such as subject matter of the contract, contract term, order or transaction number, usage and performance data, payment and billing data, as well as communication content and histories are processed. Insofar as necessary, we also process data disclosed or transmitted to us in the context of carrying out an order.

In addition, we process the data to protect our rights and to fulfill legal obligations. This includes, in particular, commercial and tax retention obligations, documentation obligations, and, if applicable, evidence and accountability obligations. In addition, processing takes place on the basis of our legitimate interests in proper business management, internal administration, risk management, and IT security, as well as in protecting our business operations and our contractual partners from misuse, threats to data, secrets, and other legal assets. This may also include the involvement of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisors, or other vicarious agents, insofar as this is necessary for the performance of the contract or to fulfill legal obligations.

Personal data is only passed on to third parties insofar as this is necessary for the fulfillment of the contract, to carry out pre-contractual measures, to protect legitimate interests, or to fulfill legal obligations. We provide separate information about processing beyond this, in particular for marketing purposes, within the framework of this privacy policy.

We inform the contractual partners which data is required in individual cases as part of the data collection, for example in online forms through corresponding marking or in personal contact.

The data is deleted as soon as it is no longer required for the aforementioned purposes and there are no legal retention obligations to the contrary. Statutory retention periods, in particular according to commercial and tax law, may require longer storage. Data transmitted in the context of a specific order will be deleted after completion of the order and expiry of any retention periods, provided there are no further legal or contractual obligations to store it.

The legal basis for processing is Art. 6 para. 1 lit. b GDPR for the implementation of pre-contractual measures and for the fulfillment of the respective contractual relationship, as well as Art. 6 para. 1 lit. c GDPR for the fulfillment of legal obligations. Insofar as processing is based on legitimate interests, it takes place on the basis of Art. 6 para. 1 lit. f GDPR. Insofar as processing is based on Art. 6 para. 1 lit. f GDPR, it takes place to protect our legitimate interests in proper and efficient business organization, internal administration and documentation of business transactions, the enforcement and defense of legal claims, ensuring IT and data security, preventing misuse and fraud, and the economic management and further development of our business operations. These interests consist in particular in ensuring secure and legally compliant business operations and in maintaining our entrepreneurial ability to act.

  • Processed data types: Master data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., postal and email addresses or telephone numbers); Contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and duration of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, persons involved).
  • Data subjects: Service recipients and clients; interested parties. Business and contractual partners.
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures; communication; office and organizational procedures; organizational and administrative procedures. Business processes and economic procedures.
  • Storage and deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”.
  • Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

  • Online shop, order forms, e-commerce, and service fulfillment: We process our customers’ data to enable them to select, purchase, or order the chosen products, goods, and related services, as well as their payment and provision, delivery, or execution. Insofar as necessary for the execution of an order, we use service providers, in particular postal, forwarding, and shipping companies, to carry out the delivery or execution for our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is marked as such in the context of the order or comparable purchase process and includes the information required for delivery, provision, and billing as well as contact information in order to be able to consult if necessary; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).
  • Electronic withdrawal function (withdrawal button): To fulfill our obligation under § 356a BGB, we provide an electronic withdrawal function on our website, through which you can withdraw from a contract concluded with us. When using this function, we process the information you enter there, in particular your name, information to identify the contract or order, and the electronic means of communication you have specified (e.g., email address) to which we transmit the legally required confirmation of receipt. This data is processed exclusively for processing your withdrawal and for fulfilling the legal evidence obligations incumbent upon us and is deleted after the relevant retention periods have expired; Legal bases: Performance of a contract (Art. 6 para. 1 sentence 1 lit. b) GDPR), legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR).

Business Processes and Procedures

Personal data of service recipients and clients – including customers, clients or in special cases mandators, patients or business partners as well as other third parties – are processed in the context of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting, and project management.

The data collected serves to fulfill contractual obligations and to make operational processes efficient. This includes the processing of business transactions, the management of customer relationships, the optimization of sales strategies, and ensuring internal accounting and financial processes. In addition, the data supports the protection of the controller’s rights and promotes administrative tasks and the organization of the company.

Personal data may be passed on to third parties if this is necessary to fulfill the stated purposes or legal obligations. After the statutory retention periods have expired or if the purpose of processing no longer applies, the data will be deleted. This also includes data that must be stored longer due to tax and legal evidence obligations.

  • Processed data types: Master data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., postal and email addresses or telephone numbers); Content data (e.g., textual or pictorial messages and posts as well as the information concerning them, such as information on authorship or time of creation); Contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and duration of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); Meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, persons involved). Log data (e.g., log files concerning logins or the retrieval of data or access times).
  • Data subjects: Service recipients and clients; interested parties; communication partners; business and contractual partners; customers; third parties; users (e.g., website visitors, users of online services). Employees (e.g., employees, applicants, temporary workers, and other staff).
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and economic procedures; security measures; provision of our online services and user-friendliness; communication; marketing; sales promotion; financial and payment management. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
  • Storage and deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”.
  • Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR).

Further information on processing operations, procedures, and services:

  • Contact management and contact maintenance: Procedures required in the context of organizing, maintaining, and securing contact information (e.g., setting up and maintaining a central contact database, regular updates of contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, performing backups and restorations of contact data, training employees in the effective use of contact management software, regular review of communication history, and adjustment of contact strategies); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Customer account: Customers can create an account within our online services (e.g., customer or user account, “customer account” for short). If the registration of a customer account is required, customers will be informed of this as well as the information required for registration. Customer accounts are not public and cannot be indexed by search engines. In the context of registration and subsequent logins and use of the customer account, we store the IP addresses of the customers along with the access times in order to be able to prove the registration and prevent any misuse of the customer account. If the customer account has been terminated, the data of the customer account will be deleted after the time of termination, provided it is not stored for purposes other than provision in the customer account or must be stored for legal reasons (e.g., internal storage of customer data, order processes, or invoices). It is the responsibility of the customers to secure their data upon termination of the customer account; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • General payment transactions: Procedures required when carrying out payment transactions, monitoring bank accounts, and controlling payment flows (e.g., creating and checking transfers, processing direct debit transactions, checking bank statements, monitoring incoming and outgoing payments, chargeback management, account reconciliation, cash management); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Accounting, accounts payable, accounts receivable: Procedures required for the recording, processing, and control of business transactions in the area of accounts payable and accounts receivable (e.g., creation and checking of incoming and outgoing invoices, monitoring and management of open items, carrying out payment transactions, processing dunning, account reconciliation in the context of receivables and payables, accounts payable, and accounts receivable); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Financial accounting and taxes: Procedures required for the recording, management, and control of financially relevant business transactions as well as for the calculation, reporting, and payment of taxes (e.g., account assignment and booking of business transactions, preparation of quarterly and annual financial statements, carrying out payment transactions, processing dunning, account reconciliation, tax advice, preparation and submission of tax returns, processing tax matters); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Purchasing: Procedures required for the procurement of goods, raw materials, or services (e.g., supplier selection and evaluation, price negotiations, order placement and monitoring, checking and control of deliveries, invoice verification, management of orders, warehouse management, creation and maintenance of purchasing guidelines); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Marketing, advertising, and sales promotion: Procedures required in the context of marketing, advertising, and sales promotion (e.g., market analysis and target group determination, development of marketing strategies, planning and implementation of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, budget management, and cost control); Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Providers and Services Used in the Course of Business

In the course of our business activities, we use additional services, platforms, interfaces, or plugins from third-party providers (collectively “services”) in compliance with legal requirements. Their use is based on our interests in proper, lawful, and economic management of our business operations and our internal organization.

  • Processed data types: Master data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., postal and email addresses or telephone numbers); Content data (e.g., textual or pictorial messages and posts as well as the information concerning them, such as information on authorship or time of creation); Contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and duration of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, persons involved).
  • Data subjects: Service recipients and clients; interested parties; business and contractual partners; users (e.g., website visitors, users of online services). Communication partners.
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and economic procedures; conversion measurement (measuring the effectiveness of marketing measures); marketing; provision of our online services and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Communication.
  • Storage and deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”.
  • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further information on processing operations, procedures, and services:

  • German Market: German Market is a plugin for the WooCommerce shop system that adapts the online shop to the legal requirements of the German-speaking market and the EU; Service provider: Execution on servers and/or computers under own data protection responsibility; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Website: https://marketpress.de/shop/plugins/woocommerce/woocommerce-german-market/.
  • PayPal: Payment services (technical connection of online payment methods) (e.g., PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.paypal.com/de. Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full.
  • BorlabsCookie: Storage and management of consents (consent to cookies and data processing), logging of user decisions, display of notices on data protection and cookies, enabling the withdrawal or adjustment of consents by users; Service provider: Execution on servers and/or computers under own data protection responsibility; Website: https://de.borlabs.io/borlabs-cookie/. Further information: An individual user ID, language, as well as types of consents and the time of their submission are stored on the server side and in the cookie on the user’s device.
  • WordPress Multisite: A WordPress plugin for operating multiple websites; Service provider: Execution on servers and/or computers under own data protection responsibility; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Website: https://developer.wordpress.org/advanced-administration/multisite/create-network/.
  • DHL: Logistics company, shipping and delivery services. We share certain personal data with DHL to enable the shipping and delivery of packages as well as shipment tracking and notifications to recipients. This information may include the name, address, and contact details of the recipients; Service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: http://www.dhl.com/. Privacy Policy: https://www.dhl.com/de-de/home/fusszeile/datenschutzhinweis.html.

Payment Procedures

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use other service providers in addition to banks and credit institutions for this purpose (collectively “payment service providers”). Payment transactions are carried out exclusively via encrypted connections in accordance with the state of the art, so that the data entered is protected from unauthorized access during transmission.

The data processed by the payment service providers include master data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs, and checksums, as well as contract, total, and recipient-related information. The information is required to carry out the transactions. However, the data entered is only processed by the payment service providers and stored by them. This means that we do not receive any account or credit card-related information, but only information with confirmation or negative information about the payment. Under certain circumstances, the data is transmitted by the payment service providers to credit agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard, we refer to the terms and conditions and the privacy notices of the payment service providers.

The terms and conditions and the privacy notices of the respective payment service providers, which can be called up within the respective websites or transaction applications, apply to the payment transactions. We also refer to these for further information and to assert withdrawal, information, and other data subject rights.

  • Types of Data Processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contract data (e.g., subject of contract, term, customer category); Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons). Contact data (e.g., postal and email addresses or phone numbers).
  • Affected Persons: Recipients of services and clients; Business and contractual partners. Prospective customers.
  • Purposes of Processing and Legitimate Interests: Provision of contractual services and fulfillment of contractual obligations. Business processes and business administration procedures.
  • Retention and Deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”.
  • Legal Bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

  • Apple Pay: Payment services (technical integration of online payment methods); Service Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Legal Bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.apple.com/de/apple-pay/. Privacy Policy: https://www.apple.com/legal/privacy/de-ww/.
  • Google Pay: Payment services (technical integration of online payment methods); Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://pay.google.com/intl/de_de/about/. Privacy Policy: https://policies.google.com/privacy.
  • PayPal: Payment services (technical integration of online payment methods) (e.g., PayPal, PayPal Plus, Braintree); Service Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal Bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.paypal.com/de. Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full.

Provision of the Online Offering and Web Hosting

We process user data to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

  • Types of Data Processed: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); Log data (e.g., log files concerning logins or data retrieval or access times.); Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., postal and email addresses or phone numbers). Contract data (e.g., subject of contract, term, customer category).
  • Affected Persons: Users (e.g., website visitors, users of online services); Recipients of services and clients; Prospective customers. Business and contractual partners.
  • Purposes of Processing and Legitimate Interests: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); Security measures; Provision of contractual services and fulfillment of contractual obligations; Conversion measurement (measurement of the effectiveness of marketing measures). Marketing.
  • Retention and Deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”.
  • Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

  • Provision of Online Offering on Rented Storage Space: For the provision of our online offering, we use storage space, computing capacity, and software that we rent or otherwise obtain from a corresponding server provider (also called “web hoster”); Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Collection of Access Data and Log Files: Access to our online offering is logged in the form of so-called “server log files”. Server log files may include the address and name of the accessed web pages and files, date and time of access, transferred data volume, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), and generally IP addresses and the requesting provider. Server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure server utilization and stability; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Deletion of Data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is exempt from deletion until the final clarification of the respective incident.
  • WooCommerce: E-commerce software for operating online shops, processing payments, and customer management processes; Service Provider: Execution on servers and/or computers under our own data protection responsibility; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://woocommerce.com/. Privacy Policy: https://automattic.com/privacy/.
  • wpmudev: Hosting; Service Provider: Incsub, LLC
    120 19th St N Ste 201 PMB 88100
    Birmingham, AL, 35203-3219
    USA; Website: https://wpmudev.com/. Privacy Policy: https://wpmudev.com/privacy-policy/.

Use of Cookies

The term “cookies” refers to functions that store and read information on users’ end devices. Cookies can also be used for various purposes, such as the functionality, security, and convenience of online offerings, as well as for creating analyses of visitor flows. We use cookies in accordance with legal regulations. For this, we obtain the user’s consent in advance, if necessary. If consent is not required, we rely on our legitimate interests. This applies if the storage and reading of information is essential to provide expressly requested content and functions. This includes, for example, saving settings and ensuring the functionality and security of our online offering. Consent can be revoked at any time. We clearly inform about their scope and which cookies are used.

Information on Legal Bases for Data Protection: Whether we process personal data with the help of cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage Duration: With regard to storage duration, the following types of cookies are distinguished:

  • Temporary Cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their end device (e.g., browser or mobile application).
  • Persistent Cookies: Persistent cookies remain stored even after the end device is closed. For example, the login status can be saved and preferred content can be displayed directly when the user revisits a website. Similarly, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g., when obtaining consent), they should assume that these are persistent and the storage duration can be up to two years.

General Information on Revocation and Objection (Opt-out): Users can revoke their given consents at any time and also declare an objection to the processing in accordance with legal requirements, including via their browser’s privacy settings.

  • Types of Data Processed: Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
  • Affected Persons: Users (e.g., website visitors, users of online services).
  • Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further information on processing operations, procedures, and services:

  • Processing of Cookie Data Based on Consent: We use a consent management solution that obtains users’ consent for the use of cookies or for the procedures and providers mentioned in the consent management solution. This procedure serves to obtain, log, manage, and revoke consents, particularly regarding the use of cookies and similar technologies used to store, read, and process information on users’ end devices. Within this procedure, users’ consents for the use of cookies and the associated processing of information, including the specific processing and providers mentioned in the consent management procedure, are obtained. Users also have the option to manage and revoke their consents. The declarations of consent are stored to avoid repeated requests and to be able to provide proof of consent in accordance with legal requirements. Storage takes place server-side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies to be able to assign the consent to a specific user or their device. Unless specific information about the providers of consent management services is available, the following general information applies: The duration of consent storage is up to two years. A pseudonymous user identifier is created, which is stored together with the time of consent, information on the scope of consent (e.g., relevant categories of cookies and/or service providers), and information about the browser, system, and end device used; Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
  • BorlabsCookie: Storage and management of consents (agreement to cookies and data processing), logging of user decisions, display of privacy and cookie notices, enabling users to revoke or adjust consents; Service Provider: Execution on servers and/or computers under our own data protection responsibility; Website: https://de.borlabs.io/borlabs-cookie/. Further Information: An individual user ID, language, types of consents, and the time of their submission are stored server-side and in the cookie on the users’ device.

Contact and Inquiry Management

When contacting us (e.g., by mail, contact form, email, phone, or via social media) and within existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to answer contact inquiries and any requested measures.

  • Types of Data Processed: Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts and related information, such as authorship details or time of creation). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
  • Affected Persons: Communication partners.
  • Purposes of Processing and Legitimate Interests: Communication; Organizational and administrative procedures; Feedback (e.g., collecting feedback via online form). Provision of our online offering and user-friendliness.
  • Retention and Deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”.
  • Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further information on processing operations, procedures, and services:

  • Contact Form: When contacting us via our contact form, email, or other communication channels, we process the personal data transmitted to us to answer and process the respective request. This usually includes information such as name, contact information, and, if applicable, further information communicated to us and necessary for appropriate processing. We use this data exclusively for the stated purpose of contact and communication; Legal Bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Web Analysis, Monitoring, and Optimization

Web analysis (also referred to as “reach measurement”) serves to evaluate the visitor flows of our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, determine at what time our online offering or its functions or content are most frequently used, or invite re-use. We can also understand which areas need optimization.

In addition to web analysis, we may also use testing procedures to test and optimize different versions of our online offering or its components.

Unless otherwise specified below, profiles, i.e., data summarized for a usage process, can be created for these purposes, and information can be stored in a browser or on an end device and then read out. The collected information includes, in particular, visited websites and elements used there, as well as technical information, such as the browser used, the computer system used, and information on usage times. If users have agreed to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

Furthermore, users’ IP addresses are stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as email addresses or names) are stored within the framework of web analysis, A/B testing, and optimization, but pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective procedures.

Information on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of Data Processed: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
  • Affected Persons: Users (e.g., website visitors, users of online services).
  • Purposes of Processing and Legitimate Interests: Reach measurement (e.g., access statistics, recognition of returning visitors); Profiles with user-related information (creation of user profiles). Provision of our online offering and user-friendliness.
  • Retention and Deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”. Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods can be stored on users’ devices for a period of two years.).
  • Security Measures: IP masking (pseudonymization of the IP address).
  • Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

  • Google Analytics: We use Google Analytics to measure and analyze the use of our online offering based on a pseudonymous user identification number. This identification number does not contain unique data, such as names or email addresses. It serves to assign analysis information to an end device to recognize which content users have accessed within one or different usage processes, which search terms they have used, have accessed again, or have interacted with our online offering. The time and duration of use are also stored, as well as the sources of users who refer to our online offering and technical aspects of their end devices and browsers.
    Pseudonymous user profiles are created with information from the use of various devices, whereby cookies can be used. Google Analytics does not log and store individual IP addresses for EU users. However, Analytics provides coarse geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. They are not logged, are not accessible, and are not used for further purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before traffic is forwarded to Analytics servers for processing; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security Measures: IP masking (pseudonymization of the IP address); Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms/; Basis for Third-Country Transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms); Opt-out Option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying advertisements: https://myadcenter.google.com/personalizationoff. Further Information: https://business.safety.google/adsservices/ (types of processing and data processed).

Presences on Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context to communicate with active users there or to offer information about us.

We point out that user data may be processed outside the European Union. This may result in risks for users, for example, because the enforcement of user rights could be made more difficult.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on user behavior and resulting interests. The latter may in turn be used to display advertisements within and outside the networks that presumably correspond to the users’ interests. Therefore, cookies are generally stored on users’ computers, in which user behavior and interests are stored. In addition, data independent of the devices used by users can also be stored in the usage profiles (especially if they are members of the respective platforms and logged in there).

For a detailed presentation of the respective processing forms and the objection options (opt-out), we refer to the privacy policies and information of the operators of the respective networks.

Also, in the case of information requests and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the latter have access to the user data and can directly take appropriate measures and provide information. Should you still need help, you can contact us.

  • Types of Data Processed: Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts and related information, such as authorship details or time of creation). Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions).
  • Affected Persons: Users (e.g., website visitors, users of online services).
  • Purposes of Processing and Legitimate Interests: Communication; Feedback (e.g., collecting feedback via online form). Public relations.
  • Retention and Deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”.
  • Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

  • Instagram: Social network, enables sharing photos and videos, commenting and liking posts, sending messages, subscribing to profiles and pages; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/. Basis for Third-Country Transfers: Data Privacy Framework (DPF).
  • Facebook Pages: Profiles within the Facebook social network – The controller is jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data from visitors to our Facebook page (“Fanpage”). This includes, in particular, information about user behavior (e.g., viewed or interacted content, actions performed) as well as device information (e.g., IP address, operating system, browser type, language settings, cookie data). More details can be found in the Facebook Data Policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical evaluations via the “Page Insights” service, which provide insights into how people interact with our page and its content. This is based on an agreement with Facebook (“Information on Page Insights”: https://www.facebook.com/legal/terms/page_controller_addendum), which regulates, among other things, security measures and the exercise of data subject rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users can therefore address information or deletion requests directly to Facebook. The rights of users (in particular information, deletion, objection, complaint to a supervisory authority) remain unaffected by this. Joint responsibility is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for further processing, including a possible transfer to Meta Platforms Inc. in the USA; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Basis for Third-Country Transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
  • Facebook Groups: We use the “Groups” function of the Facebook platform to create interest groups within which Facebook users can interact with each other or with us and exchange information. In doing so, we process personal data of the users of our groups to the extent necessary for the purpose of group use and its moderation. Our policies within the groups may contain further guidelines and information on the use of the respective group. This data includes information on first and last names, as well as published or privately communicated content, as well as values on the status of group membership or group-related activities, such as joining or leaving, and timestamps for the aforementioned data. Furthermore, we refer to the processing of user data by Facebook itself. This data includes information on the types of content that users view or interact with, or the actions they perform (see under “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see under “Device Information” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, so-called “Insights”, to group operators so that they can gain insights into how people interact with their groups and with the content associated with them; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Basis for Third-Country Transfers: Data Privacy Framework (DPF).
  • Facebook Events: Event profiles within the Facebook social network – We use the “Events” function of the Facebook platform to draw attention to events and appointments and to interact with users (participants and interested parties) and exchange information. In doing so, we process personal data of the users of our event pages to the extent necessary for the purpose of the event page and its moderation. This data includes information on first and last names, as well as published or privately communicated content, as well as values on the status of participation and timestamps for the aforementioned data. Furthermore, we refer to the processing of user data by Facebook itself. This data includes information on the types of content that users view or interact with, or the actions they perform (see under “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see under “Device Information” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, so-called “Insights”, to event providers so that they can gain insights into how people interact with their event pages and with the content associated with them; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Basis for Third-Country Transfers: Data Privacy Framework (DPF).
  • LinkedIn: Social network – We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not further processing) of data from visitors that is used to create “Page Insights” (statistics) for our LinkedIn profiles. This data includes information about the types of content users view or interact with, as well as the actions they perform. In addition, details about the devices used are collected, such as IP addresses, operating system, browser type, language settings, and cookie data, as well as information from user profiles, such as job function, country, industry, hierarchy level, company size, and employment status. Privacy information on the processing of user data by LinkedIn can be found in LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy.
    We have concluded a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum”, https://legal.linkedin.com/pages-joint-controller-addendum), which specifically regulates what security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of data subjects (i.e., users can, for example, address information or deletion requests directly to LinkedIn). The rights of users (in particular the right to information, deletion, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection and transmission of data to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing of the data is solely the responsibility of LinkedIn Ireland Unlimited Company, particularly regarding the transfer of data to the parent company LinkedIn Corporation in the USA; Service Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Basis for Third-Country Transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa). Opt-out Option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Plugins and Embedded Functions as well as Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These can be, for example, graphics, videos, or city maps (hereinafter uniformly referred to as “content”).

The integration always requires that the third-party providers of this content process the users’ IP address, as they would not be able to send the content to their browser without an IP address. The IP address is therefore necessary for the display of this content or functions. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. Through the “pixel tags”, information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information can also be stored in cookies on the users’ device and may contain, among other things, technical information about the browser and operating system, referring websites, visit time, and other information about the use of our online offering, but can also be linked with such information from other sources.

Information on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of Data Processed: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
  • Affected Persons: Users (e.g., website visitors, users of online services).
  • Purposes of Processing and Legitimate Interests: Provision of our online offering and user-friendliness; Reach measurement (e.g., access statistics, recognition of returning visitors); Tracking (e.g., interest-/behavior-based profiling, use of cookies); Audience targeting. Marketing.
  • Retention and Deletion: Deletion according to the information in the section “General Information on Data Storage and Deletion”. Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods can be stored on users’ devices for a period of two years.).
  • Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

  • Google Fonts (Provided on Our Own Server): Provision of font files for a user-friendly display of our online offering; Service Provider: Google Fonts are hosted on our server, no data is transmitted to Google; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • YouTube Videos: Video content; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Basis for Third-Country Transfers: Data Privacy Framework (DPF). Opt-out Option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying advertisements: https://myadcenter.google.com/personalizationoff.

Changes and Updates

We ask you to regularly inform yourself about the content of our privacy policy. We will adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or another individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time and we ask you to check the information before contacting us.

Definitions

In this section, you will find an overview of the terms used in this privacy policy. Insofar as the terms are legally defined, their legal definitions apply. The following explanations are primarily intended to aid understanding.

  • Employees: Employees are persons who are in an employment relationship, be it as staff, employees, or in similar positions. An employment relationship is a legal relationship between an employer and an employee, established by an employment contract or agreement. It includes the employer’s obligation to pay the employee remuneration while the employee performs their work. The employment relationship comprises various phases, including its establishment, in which the employment contract is concluded, its execution, in which the employee performs their work, and its termination, when the employment relationship ends, whether by termination, mutual agreement, or otherwise. Employee data refers to all information relating to these persons and in the context of their employment. This includes aspects such as personal identification data, identification numbers, salary and bank details, working hours, vacation entitlements, health data, and performance appraisals.
  • Master Data: Master data includes essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar associations. This data may include, among other things, personal and demographic details such as names, contact information (addresses, phone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Master data forms the basis for any formal interaction between individuals and services, institutions, or systems, enabling clear assignment and communication.
  • Content Data: Content data encompasses information generated during the creation, editing, and publication of all types of content. This category of data can include texts, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content itself but also includes metadata that provides information about the content, such as tags, descriptions, author information, and publication dates.
  • Contact Data: Contact data is essential information that enables communication with individuals or organizations. It includes, among other things, phone numbers, postal addresses, and email addresses, as well as communication channels such as social media handles and instant messaging identifiers.
  • Conversion Measurement: Conversion measurement (also referred to as “visit action evaluation”) is a process used to determine the effectiveness of marketing measures. Typically, a cookie is stored on users’ devices within the websites where the marketing measures take place and then retrieved again on the target website. For example, this allows us to track whether the ads we placed on other websites were successful.
  • Meta, Communication, and Process Data: Meta, communication, and process data are categories that contain information about how data is processed, transmitted, and managed. Metadata, also known as data about data, includes information describing the context, origin, and structure of other data. It can include details about file size, creation date, document author, and revision histories. Communication data captures the exchange of information between users across various channels, such as email traffic, call logs, social network messages, and chat histories, including the individuals involved, timestamps, and transmission paths. Process data describes the processes and workflows within systems or organizations, including workflow documentation, transaction and activity logs, and audit logs used for tracking and verifying operations.
  • Usage Data: Usage data refers to information that captures how users interact with digital products, services, or platforms. This data includes a wide range of information showing how users utilize applications, which features they prefer, how long they spend on specific pages, and the paths they navigate through an application. Usage data can also include frequency of use, activity timestamps, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. Furthermore, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings.
  • Personal Data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Profiles with User-Related Information: The processing of “profiles with user-related information,” or simply “profiles,” encompasses any type of automated processing of personal data that involves using this personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information concerning demographics, behavior, and interests, such as interaction with websites and their content, etc.) (e.g., interests in certain content or products, click behavior on a website, or location). Cookies and web beacons are frequently used for profiling purposes.
  • Log Data: Log data is information about events or activities that have been recorded in a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details about the use or operation of a system. Log data is often used to analyze system problems, monitor security, or generate performance reports.
  • Reach Measurement: Reach measurement (also referred to as Web Analytics) serves to evaluate the visitor flows of an online offering and can include the behavior or interests of visitors in certain information, such as website content. With the help of reach analysis, operators of online offerings can, for example, recognize when users visit their websites and what content they are interested in. This allows them to better adapt the content of the websites to the needs of their visitors. For the purpose of reach analysis, pseudonymous cookies and web beacons are frequently used to recognize returning visitors and thus obtain more accurate analyses of the use of an online offering.
  • Tracking: “Tracking” refers to the ability to trace user behavior across multiple online offerings. Typically, behavioral and interest information related to the online offerings used is stored in cookies or on the servers of the tracking technology providers (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to match their interests.
  • Controller: A “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term is broad and covers practically any handling of data, be it collection, evaluation, storage, transmission, or deletion.
  • Contract Data: Contract data is specific information related to the formalization of an agreement between two or more parties. It documents the terms under which services or products are provided, exchanged, or sold. This data category is essential for the administration and fulfillment of contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include contract start and end dates, the type of agreed services or products, price agreements, payment terms, termination rights, renewal options, and special conditions or clauses. It serves as the legal basis for the relationship between the parties and is crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.
  • Payment Data: Payment data includes all information required to process payment transactions between buyers and sellers. This data is of crucial importance for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank details, payment amounts, transaction dates, verification numbers, and billing information. Payment data may also contain information about payment status, chargebacks, authorizations, and fees.
  • Audience Creation: “Audience Creation” (English “Custom Audiences”) refers to the determination of target groups for advertising purposes, e.g., the display of advertisements. For example, based on a user’s interest in certain products or topics on the internet, it can be inferred that this user is interested in advertisements for similar products or the online shop where they viewed the products. “Lookalike Audiences” (or similar audiences), in turn, refers to displaying content deemed suitable to users whose profiles or interests presumably match those of the users for whom the profiles were created. Cookies and web beacons are typically used for the purpose of creating Custom Audiences and Lookalike Audiences.