Data protection declaration

Preamble

With the following data protection declaration, we would like to inform you about which types of your personal data (hereinafter also referred to as “data”) we process for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both in the context of the provision of our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”).

The terms used are not gender-specific.

As of: October 4, 2024

Table of contents

• Preamble
• Person responsible
• Contact data protection officer
• Overview of processing
• Relevant legal bases
• Security measures
• Transfer of personal data
• International data transfers
• General information on data storage and deletion
• Rights of the data subjects
• Business services
• Business processes and procedures
• Provision of the online offer and web hosting
• Use of cookies
• Contact and inquiry management
• Chatbots and chat functions
• Newsletter and electronic notifications
• Advertising communication via email, post, fax or telephone
• Surveys and surveys
• Web analysis, monitoring and optimization
• Online marketing
• Presences in social networks (social media)
• Plug-ins and embedded functions and content
• Management, organization and auxiliary tools
• Changes and updates
• Definitions of terms

Person responsible

Dutch Design Deutschland GmbH
Industriering Ost 72
47906 Kempen

Authorized representatives: Kai Peters

Email address: [email protected]

Telephone: +49 2152 9572677

Imprint: https://senso.com/de/impressum

Contact data protection officer

For questions about data protection, you can contact our data protection officer Michael Schmitz at [email protected]

Overview of processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the persons affected.

Types of data processed

• Inventory data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and process data.
• Protocol data.
• Credit data.

Categories of data subjects

• Service recipients and clients.
• Employees.
• Interested parties.
• Communication partners.
• Users.
• Business and contractual partners.
• Participants.
• Third parties.
• Customers.

Purposes of processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Direct marketing.
• Reach measurement.
• Tracking.
• Office and organizational procedures.
• Remarketing.
• Conversion measurement.
• Target group formation.
• A/B testing.
• Organizational and administrative procedures.
• Server monitoring and error detection.
• Content Delivery Network (CDN).
• Feedback.
• Surveys and questionnaires.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Assessment of creditworthiness and credit rating.
• Information technology infrastructure.
• Financial and payment management.
• Public relations.
• Sales promotion.
• Business processes and business management procedures.

Relevant legal bases

Relevant legal bases according to the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of these in the data protection declaration.

• Consent (Art. 6 Para. 1 S. 1 lit. a) GDPR) – The data subject has given his or her consent to the processing of personal data concerning him or her for a specific purpose or several specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b) GDPR) – The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the data subject.
• Legal obligation (Art. 6 Para. 1 S. 1 lit. c) GDPR) – The processing is necessary to fulfill a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR) – The processing is necessary to protect the legitimate interests of the controller or a third party, provided that the interests, fundamental rights and freedoms of the data subject, which require the protection of personal data, do not prevail.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes in particular the law on protection against misuse of personal data in data processing (Federal Data Protection Act – BDSG). The BDSG contains in particular special regulations on the right to information, the right to erasure, the right of objection, the processing of special categories of personal data, processing for other purposes and transmission and automated decision-making in individual cases, including profiling. In addition, state data protection laws of the individual federal states may apply.

National data protection regulations in the Netherlands: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in the Netherlands. This includes in particular the “Implementation Act on the General Data Protection Regulation” (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG).

National data protection regulations in Austria: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Austria. This includes in particular the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act – DSG). The Data Protection Act contains in particular special regulations on the right to information, the right to rectification or deletion, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases.

Relevant legal bases under the Swiss Data Protection Act: If you are located in Switzerland, we process your data on the basis of the Federal Data Protection Act (in short “Swiss DSG”). Unlike the GDPR, for example, the Swiss DSG does not generally stipulate that a legal basis for the processing of personal data must be stated and that the processing of personal data is carried out in good faith, is lawful and proportionate (Art. 6 Para. 1 and 2 of the Swiss DSG). In addition, we only collect personal data for a specific purpose that is recognizable to the person concerned and only process it in a way that is compatible with this purpose (Art. 6 Para. 3 of the Swiss DSG).

Note on the validity of the GDPR and the Swiss DSG: This data protection notice serves to provide information in accordance with both the Swiss DSG and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that the terms of the GDPR are used due to the broader spatial application and comprehensibility. In particular, instead of the terms “processing” of “personal data”, “overriding interest” and “personal data requiring particular protection” used in the Swiss DSG, the terms “processing” of “personal data” as well as “legitimate interest” and “special categories of data” used in the GDPR are used. However, the legal meaning of the terms will continue to be determined according to the Swiss DSG within the scope of the validity of the Swiss DSG.

Third country (outside the EU and Switzerland): The data protection regulations in the country of residence of the controller apply in addition to or in addition to the data protection regulations of the GDPR. These regulations may contain specific provisions that go beyond or deviate from the requirements of the GDPR. These include, among other things, provisions to protect against misuse of personal data, provisions on rights of information and deletion, rights of objection, processing of special categories of personal data, processing for other purposes, transmission and automated decision-making including profiling.

Security measures

We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to it, input, transfer, securing availability and separation. Furthermore, we have set up procedures that ensure the exercise of data subject rights, the deletion of data and reactions to data threats. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

Securing online connections using TLS/SSL encryption technology (HTTPS): In order to protect user data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), protecting the data from unauthorized access. TLS, as the advanced and more secure version of SSL, ensures that all data transmissions meet the highest

security standards. If a website is secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This serves as an indicator for users that their data is being transmitted securely and encrypted.

Transfer of personal data

As part of our processing of personal data, it may happen that this is transmitted to or disclosed to other bodies, companies, legally independent organizational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

Data transfer within the group of companies: Data transfer within the group of companies: We may transfer personal data to other companies within our group of companies or grant them access to it. This data transfer is based on our legitimate business and commercial interests. For example, we understand this to mean improving business processes, ensuring efficient and effective internal communication, making optimal use of our human and technological resources and the ability to make informed business decisions. In certain cases, the data transfer may also be necessary to fulfill our contractual obligations or it may be based on the consent of the data subject or legal permission.

Data transfer within the organization: We may transfer personal data to other departments or units within our organization or grant them access to it. If the data transfer is for administrative purposes, it is based on our legitimate business and commercial interests or takes place if it is necessary to fulfill our contractual obligations or if the consent of the data subject or legal permission is available.

International data transfers

Data processing in third countries: If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or if the processing takes place in the context of the use of third-party services or the disclosure or transmission of data to other persons, bodies or companies, this will only take place in accordance with the legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers only take place if the level of data protection is otherwise ensured, in particular through standard contractual clauses (Art. 46 Para. 2 lit. c) GDPR), express consent or in the case of contractual or legally required transmission (Art. 49 Para. 1 GDPR). In addition, we will inform you of the basis for the third country transfer for the individual providers from the third country, with the adequacy decisions taking priority as the basis. Information on third country transfers and existing adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de. As part of the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection for certain companies from the USA as secure within the framework of the adequacy decision of July 10, 2023. The list of certified companies and further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). We will inform you as part of the data protection notices, which service providers we use are certified under the Data Privacy Framework.

Disclosure of personal data abroad: In accordance with the Swiss DSG, we only disclose personal data abroad if adequate protection of the data subjects is guaranteed (Art. 16 Swiss DSG). If the Federal Council has not determined adequate protection (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we take alternative security measures. These can include international treaties, specific guarantees, data protection clauses in contracts, standard data protection clauses approved by the Federal Data Protection and Information Commissioner (FDPIC) or internal company data protection regulations approved in advance by the FDPIC or a competent data protection authority in another country. According to Article 16 of the Swiss Data Protection Act, exceptions to the disclosure of data abroad may be permitted if certain conditions are met, including consent of the data subject, contract execution, public interest, protection of life or physical integrity, data made public or data from a legally provided register. These disclosures are always made in accordance with the legal requirements. As part of the so-called “Data Privacy Framework” (DPF), the Swiss has recognized the level of data protection for certain companies from the USA as secure as part of the adequacy decision of June 7, 2024. The list of certified companies and further information on the DPF can be found on the US Department of Commerce website at https://www.dataprivacyframework.gov/ (in English). As part of the data protection information, we inform you about which service providers we use are certified under the Data Privacy Framework.

General information on data storage and deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consent is revoked or there are no further legal bases for the processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule exist if legal obligations or special interests require the data to be stored or archived for a longer period.

In particular, data that must be retained for commercial or tax law reasons or whose storage is necessary for legal proceedings or to protect the rights of other natural or legal persons must be archived accordingly.

Our data protection notices contain additional information on the storage and deletion of data that specifically apply to certain processing processes.

If there are multiple details on the storage period or deletion periods for a date, the longest period is always decisive.

If a period does not expressly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the event that triggers the period occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event that triggers the period is the time at which the termination or other termination of the legal relationship takes effect.

We process data that is no longer stored for the originally intended purpose but due to legal requirements or other reasons only for the reasons that justify its storage.

Further information on processing procedures, methods and services:

• Storage and deletion of data: The following general periods apply to storage and archiving under German law:
• • 10 years – retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets as well as the work instructions and other organizational documents, accounting documents and invoices required for their understanding (Section 147 Paragraph 3 in conjunction with Paragraph 1 Nos. 1, 4 and 4a AO, Section 14b Paragraph 1 UStG, Section 257 Paragraph 1 Nos. 1 and 4, Paragraph 4 HGB).
  • 6 years – Other business documents: received commercial or business letters, reproductions of commercial or business letters sent. Business letters, other documents, insofar as they are relevant for taxation, e.g. B. Hourly wage slips, operating accounting sheets, calculation documents, price labels, but also payroll documents, insofar as they are not already booking documents and cash register slips (Section 147 Paragraph 3 in conjunction with Paragraph 1 No. 2, 3, 5 AO, Section 257 Paragraph 1 No. 2 and 3, Paragraph 4 HGB).
  • 3 years – Data that is required to consider potential warranty and compensation claims or similar contractual claims and rights and to process related inquiries based on previous business experience and standard industry practices are stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 BGB).
• Storage and deletion of data: The following general periods apply to storage and archiving under Austrian law:
• • 10 years – retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting documents and invoices as well as all necessary work instructions and other organizational documents (Federal Tax Code (BAO §132), Commercial Code (UGB §§190-212)).
  • 6 years – Other business documents: Commercial or business letters received, copies of commercial or business letters sent and other documents, provided they are relevant for tax purposes. These include, for example, hourly wage slips, operating accounting sheets, calculation documents, price labels and payroll documents, provided they are not already accounting documents and cash register slips (Federal Tax Code (BAO §132), Commercial Code (UGB §§190-212)).
  • 3 years – data required to consider potential warranty and compensation claims or similar contractual claims and rights and to process related inquiries based on previous business experience and standard industry practices are stored for the duration of the regular statutory limitation period of three years (§§ 1478, 1480 ABGB).
• Retention and deletion of data: The following general periods apply to retention and archiving under Swiss law:
• • 10 years – retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting documents and invoices as well as all necessary work instructions and other organizational documents (Art. 958f of the Swiss Code of Obligations (OR)).
  • 10 years – Data necessary to consider potential claims for damages or similar contractual claims and rights, as well as to process related requests, based on previous business experience and standard industry practices, will be stored for the statutory limitation period of ten years, unless a shorter period of five years applies, which is applicable in specific cases (Art. 127, 130 OR). After five years, claims for rent, lease and capital interest as well as other periodic payments, from the delivery of food, for catering and for innkeeper’s debts, as well as from craft work, retail sales of goods, medical care, professional work by lawyers, legal agents, procurators and notaries and from the employment relationship of employees (Art. 128 OR) expire.

Rights of the data subjects

Rights of the data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right of objection: You have the right to object at any time to the processing of personal data concerning you based on Art. 6 Para. 1 lit. e or f GDPR for reasons arising from your particular situation; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising; this also applies to profiling insofar as it is related to such direct advertising.
• Right of withdrawal of consent: You have the right to withdraw consent given at any time.
• Right to information: You have the right to request confirmation as to whether the data in question is being processed and to information about this data as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the legal requirements, you have the right to request that the data concerning you be completed or that incorrect data concerning you be rectified.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased immediately or, alternatively, to request that the processing of the data be restricted in accordance with the legal requirements.
• Right to Data portability: You have the right to receive data concerning you that you have made available to us in a structured, common and machine-readable format in accordance with the statutory requirements or to request that it be transmitted to another responsible party.
• Complaint to the supervisory authority: In accordance with the statutory requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State in which you habitually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR.

Rights of the data subjects under the Swiss DSG:

As a data subject, you have the following rights in accordance with the provisions of the Swiss DSG:

• Right to information: You have the right to obtain confirmation that request whether personal data concerning you is being processed and to receive the information required to enable you to assert your rights under this law and to ensure transparent data processing.
• Right to data disclosure or transfer: You have the right to request the disclosure of your personal data that you have provided to us in a common electronic format.
• Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
• Right to objection, deletion and destruction: You have the right to object to the processing of your data and to request that the personal data concerning you be deleted or destroyed.

Business services

We process data from our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”), within the framework of contractual and comparable legal relationships and associated measures and with regard to communication with the contractual partners (or pre-contractually), for example to answer inquiries.

We use this data to fulfil our contractual obligations. This includes in particular the obligations to provide the agreed services, any updating obligations and remedy in the event of warranty and other service disruptions.

In addition, we use the data to protect our rights and for the purposes of the administrative tasks associated with these obligations and the company organisation. In addition, we process the data on the basis of our legitimate interests in both proper and commercial business management and security measures to protect our contractual partners and our business operations from misuse and endangerment of their data, secrets, information and rights (e.g. B. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities).

Within the framework of applicable law, we only pass on the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. The contractual partners are informed about other forms of processing, e.g. for marketing purposes, within the framework of this data protection declaration.

We inform the contractual partners which data is required for the aforementioned purposes before or as part of the data collection, e.g. in online forms, by special marking (e.g. colors) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after four years, unless the data is stored in a customer account, e.g. for as long as it must be kept for legal reasons of archiving (e.g. for tax purposes, usually ten years). We delete data that has been disclosed to us by the contractual partner as part of an order in accordance with the specifications and generally after the end of the order.

• Types of data processed: Inventory data (e.g. full name, home address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers). Contract data (e.g. subject of the contract, term, customer category).
• Persons affected: Service recipients and clients; interested parties. Business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; communication; office and organizational procedures; organizational and administrative procedures. Business processes and business management procedures.
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 lit. b) GDPR); Legal obligation (Art. 6 Para. 1 Clause 1 lit. c) GDPR). Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).

Further information on processing processes, procedures and services:

• Craftsmanship services: We process the data of our customers and clients (hereinafter referred to as “customers”) in order to enable them to select, purchase or commission the selected services or works and related activities as well as to pay for and deliver or carry out or provide them.
  The required information is marked as such in the context of the order, purchase order or comparable contract conclusion and includes the information required for delivery and billing as well as contact information in order to be able to hold any consultations; Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 Letter b) GDPR).

Business processes and procedures

Personal data of service recipients and clients – including customers, clients or, in special cases, clients, patients or business partners as well as other third parties – are processed within the framework of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting and project management.

The data collected is used to fulfill contractual obligations and to make operational processes efficient. This includes the processing of business transactions, the management of customer relationships, the optimization of sales strategies and the guarantee of internal accounting and financial processes. In addition, the data supports the protection of the rights of the person responsible and promotes administrative tasks and the organization of the company.

Personal data can be passed on to third parties if this is necessary to fulfill the purposes mentioned or legal obligations. After statutory retention periods have expired or if the purpose of the processing no longer applies, the data is deleted. This also includes data that must be stored for longer due to tax and legal proof obligations.

• Types of data processed: Inventory data (e.g. full name, home address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and contributions as well as the information relating to them, such as details of authorship or time of creation); contract data (e.g. subject matter of the contract, term, customer category); protocol data (e.g. log files relating to logins or the retrieval of data or access times); usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); Creditworthiness data (e.g. credit score received, estimated probability of default, risk classification based on this, historical payment behavior). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, people involved).
• Affected persons: Service recipients and clients; interested parties; communication partners; business and contractual partners; third parties; users (e.g. website visitors, users of online services); employees (e.g. employees, applicants, temporary workers and other employees). Customers.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and business management procedures; communication; marketing; sales promotion; public relations; assessment of creditworthiness and creditworthiness; financial and payment management. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).).
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 Letter b) GDPR); Legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR). Legal obligation (Art. 6 Para. 1 Clause 1 Letter c) GDPR).

Further information on processing procedures, methods and services:

• Customer management and customer relationship management (CRM): Procedures required within the framework of customer management and customer relationship management (CRM) (e.g. customer acquisition in compliance with data protection requirements, measures to promote customer retention and loyalty, effective customer communication, complaint management and customer service with consideration of data protection, data management and analysis to support the customer relationship, administration of CRM systems, secure account management, customer segmentation and target group formation); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 lit. b) GDPR), legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).
• Contact management and contact maintenance: Procedures required for the organization, maintenance and security of contact information (e.g. setting up and maintaining a central contact database, regularly updating contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, carrying out backups and restoring contact data, training employees in the effective use of contact management software, regularly checking communication history and adapting contact strategies); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 Letter b) GDPR), legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR).
• General payment transactions: Procedures required for carrying out payment transactions, monitoring bank accounts and controlling payment flows (e.g. creating and checking transfers, processing direct debit transactions, checking account statements, monitoring incoming and outgoing payments, direct debit management, account reconciliation, cash management); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 lit. b) GDPR), legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).
• Accounting, accounts payable accounting, accounts receivable accounting: Procedures required for the recording, processing and control of business transactions in the area of ​​accounts payable and accounts receivable accounting (e.g. creation and review of incoming and outgoing invoices, monitoring and management of open items, implementation of payment transactions, processing of dunning procedures, account reconciliation in the context of receivables and liabilities, accounts payable accounting and accounts receivable accounting);
  Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 Letter b) GDPR), Legal obligation (Art. 6 Para. 1 Clause 1 Letter c) GDPR), Legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR).
• Financial accounting and taxes: Procedures required for the recording, administration and control of financially relevant business transactions as well as for the calculation, reporting and payment of taxes (e.g. account assignment and posting of business transactions, preparation of quarterly and annual financial statements, implementation of payment transactions, processing of dunning procedures, account reconciliation, tax advice, preparation and filing of tax returns, processing of tax matters); Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 Letter b) GDPR), Legal obligation (Art. 6 Para. 1 Clause 1 Letter c) GDPR), Legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR).
• Marketing, advertising and sales promotion: Procedures that are necessary in the context of marketing, advertising and sales promotion (e.g. market analysis and target group determination, development of marketing strategies, planning and implementation of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, budget management and cost control); Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
• Public relations: Procedures that are necessary in the context of public relations and public relations (e.g. development and implementation of communication strategies, planning and implementation of PR campaigns, preparation and distribution of press releases, maintenance of media contacts, monitoring and analysis of media response, organization of press conferences and public events, crisis communication, creation of content for social media and company websites, maintenance of corporate branding);
  Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Provision of the online offer and web hosting

We process the data of users in order to be able to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

• Types of data processed: Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, people involved); Protocol data (e.g. log files relating to logins or the retrieval of data or access times.); Content data (e.g. textual or visual messages and contributions as well as the information relating to them, such as details of authorship or time of creation). Contact data (e.g. postal and email addresses or telephone numbers).
• Affected persons: Users (e.g. website visitors, users of online services). Interested parties.
• Purposes of processing: Provision of our online offer and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); Security measures; Content Delivery Network (CDN); Server monitoring and error detection; Communication; Direct marketing (e.g. by email or post); Reach measurement (e.g. access statistics, recognition of returning visitors); Conversion measurement (measurement of the effectiveness of marketing measures); Target group formation; A/B tests. Marketing.
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR).

Further information on processing procedures, methods and services:

• Provision of online offer on rented storage space: To provide our online offer, we use storage space, computing capacity and software that we rent from a corresponding server provider (also called “web host”) or obtain from another source; Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).
• Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. The server log files can include the address and name of the websites and files accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used for security purposes, e.g. to avoid overloading the servers (particularly in the case of abusive attacks, so-called DDoS attacks), and to ensure the utilization of the servers and their stability; Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that needs to be retained for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.
• Cloudflare: Content Delivery Network (CDN) – service that can be used to deliver the content of an online offering, in particular large media files such as graphics or program scripts, more quickly and securely using regionally distributed servers connected via the Internet; Service provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.cloudflare.com; Privacy policy: https://www.cloudflare.com/privacypolicy/; Contract processing: https://www.cloudflare.com/cloudflare-customer-dpa/. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
• Datadog: Monitoring of servers, databases, tools and services via a software-as-a-service based data analysis platform; Service provider: Datadog, Inc., 620 8th Avenue, Floor 45, New York, NY 10018 USA; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.datadoghq.com/; Privacy policy: https://www.datadoghq.com/legal/privacy/; Contract for data processing: https://www.datadoghq.com/legal/data-processing-addendum/. Basis for third country transfers: EU/EEA – standard contractual clauses (https://www.datadoghq.com/legal/data-processing-addendum/), Switzerland – standard contractual clauses (https://www.datadoghq.com/legal/data-processing-addendum/).
• New Relic: Server monitoring and error detection; Service provider: New Relic, Inc. Attn: Legal Department 188 Spear Street, Suite 1200 San Francisco, CA 94105, USA; Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR); Website: https://newrelic.com; Security measures: IP masking (pseudonymization of the IP address); Privacy policy: https://newrelic.com/termsandconditions/privacy; Contract processing agreement: https://newrelic.com/termsandconditions/terms; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF). Deletion of data: The aggregated data is deleted after three months, the pseudonymized data after seven days.
• Hubspot Forms: Creation and management of forms, collection and storage of user data, integration into websites and CRM systems, automation of follow-up emails, analysis of form performance, segmentation of data for targeted marketing campaigns; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR); Website: https://www.hubspot.com/products/marketing/forms; Privacy Policy: https://legal.hubspot.com/privacy-policy; Contract processing agreement: https://legal.hubspot.com/dpa. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
• JSDelivr: Content Delivery Network (CDN) that helps deliver media and files quickly and efficiently, especially under high load; Service provider: ProspectOne, Królewska 65A/1, 30-081, Kraków, Poland; Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR); Website: https://www.jsdelivr.com; Privacy policy: https://www.jsdelivr.com/terms/privacy-policy. Basis for third country transfers: Switzerland – adequacy decision (Poland).

Use of cookies

The term “cookies” refers to functions that store information on users’ end devices and read it from them. Cookies can also be used for various purposes, such as for the purposes of the functionality, security and convenience of online services and the creation of analyses of visitor flows. We use cookies in accordance with legal regulations. If necessary, we obtain the consent of users in advance. If consent is not necessary, we rely on our legitimate interests. This applies if the storage and reading of information is essential in order to be able to provide expressly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online service. Consent can be revoked at any time. We provide clear information about the scope of cookies and which cookies are used.
Notes on data protection legal bases: Whether we process personal data using cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device is closed. For example, the log-in status can be saved and preferred content can be displayed directly when the user visits a website again. The user data collected using cookies can also be used to measure reach. Unless we provide users with explicit information about the type and storage period of cookies (e.g. when obtaining consent), they should assume that these are permanent and that the storage period can be up to two years.

General information on revocation and objection (opt-out): Users can revoke the consent they have given at any time and also object to processing in accordance with the legal requirements, including by means of the privacy settings of their browser.

• Types of data processed: Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, people involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR). Consent (Art. 6 Para. 1 Clause 1 Letter a) GDPR).

Further information on processing processes, procedures and services:

• Processing of cookie data based on consent: We use a consent management solution in which the consent of users is obtained for the use of cookies or for the procedures and providers named in the consent management solution. This procedure is used to obtain, log, manage and revoke consent, in particular with regard to the use of cookies and comparable technologies that are used to store, read and process information on users’ end devices. As part of this procedure, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing and providers named in the consent management procedure. Users also have the option of managing and revoking their consent. The declarations of consent are stored in order to avoid further queries and to be able to provide proof of consent in accordance with legal requirements. The data is stored on the server side and/or in a cookie (so-called opt-in cookie) or using comparable technologies in order to be able to assign the consent to a specific user or their device. If no specific information is available about the providers of consent management services, the following general information applies: The consent is stored for up to two years. A pseudonymous user identifier is created, which is stored together with the time of consent, information on the scope of the consent (e.g. relevant categories of cookies and/or service providers) and information about the browser, the system and the device used; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Contact and inquiry management

When you contact us (e.g. by post, contact form, email, telephone or via social media) and within the framework of existing user and business relationships, the details of the inquiring persons are processed insofar as this is necessary to answer the contact inquiries and any requested measures.

• Types of data processed: Inventory data (e.g. full name, home address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. textual or visual messages and contributions as well as the information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, people involved).
• Data subjects: communication partners.
• Purposes of processing: communication; organizational and administrative procedures; feedback (e.g. collecting feedback via online form). Provision of our online offer and user-friendliness.
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR). Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 lit. b) GDPR).

Further information on processing processes, procedures and services:

• Contact form: When you contact us via our contact form, by email or other communication channels, we process the personal data sent to us to answer and process the respective request. This usually includes information such as name, contact information and, if applicable, other information that is communicated to us and is necessary for appropriate processing. We use this data exclusively for the stated purpose of contact and communication; Legal basis: Contractual performance and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 lit. b) GDPR), legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).
• HubSpot CRM: Management of customer contacts, tracking sales activities, automation of marketing campaigns, analysis of sales data, creation and management of email campaigns, integration with other tools and platforms, management of customer support requests, AI-powered content generation, personalized email creation, predictive sales forecasts, automatic workflow descriptions and AI chatbots for customer interaction; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b) GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Contract processing agreement: https://legal.hubspot.com/dpa. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).

Chatbots and chat functions

We offer online chats and chatbot functions (collectively referred to as “chat services”) as a means of communication. A chat is an online conversation that is conducted with a certain degree of time. A chatbot is software that answers users’ questions or informs them about messages. If you use our chat functions, we can process your personal data.

If you use our chat services within an online platform, your identification number will also be stored within the respective platform. We can also collect information about which users interact with our chat services and when. We also store the content of your conversations via the chat services and log registration and consent processes in order to be able to prove these in accordance with legal requirements.

We would like to point out to users that the respective platform provider can find out that and when users communicate with our chat services, as well as collect technical information about the device used by the user and, depending on the settings of their device, location information (so-called metadata) for the purposes of optimizing the respective services and for security purposes. The metadata of communication via chat services (i.e., for example, the information about who communicated with whom) could also be used by the respective platform providers for marketing purposes or to display advertising tailored to users in accordance with their terms, to which we refer for further information.

If users agree to activate information with regular messages to a chatbot, they have the option of unsubscribing from the information for the future at any time. The chatbot informs users how and with which terms they can unsubscribe from the messages. When unsubscribing from the chatbot messages, user data is deleted from the list of message recipients.

We use the aforementioned information to operate our chat services, e.g. B. to address users personally, to answer their inquiries, to transmit any requested content and also to improve our chat services (e.g. to “teach” chatbots answers to frequently asked questions or to recognize unanswered inquiries).

Notes on legal bases: We use chat services on the basis of consent if we have previously obtained permission from users to process their data as part of our chat services (this applies to cases in which users are asked for consent, e.g. so that a chatbot can send them regular messages). If we use chat services to answer user inquiries about our services or our company, this is done for contractual and pre-contractual communication. Otherwise, we use chat services on the basis of our legitimate interests in optimizing the chat services, their economic efficiency and increasing the positive user experience.

Revocation, objection and deletion: You can revoke your consent or object to the processing of your data as part of our chat services at any time.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and contributions as well as the information relating to them, such as details of authorship or time of creation). Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Affected persons: communication partners.
• Purpose of processing: communication.
• Storage and deletion: deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal basis: consent (Art. 6 Para. 1 Clause 1 lit. a) GDPR); contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 Clause 1 lit. b) GDPR). Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR).

Further information on processing procedures, methods and services:

• HubSpot: Chatbot and assistance software and associated services; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Contract processing agreement: https://legal.hubspot.com/dpa. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
• Google Tag Manager (server-side use): The Google Tag Manager is an application with which we can manage so-called website tags via an interface and thus integrate other services into our online offering (see also the additional information in this privacy policy). The Tag Manager itself (which implements the tags) does not store user profiles or cookies. The other services are integrated on the server side. This means that users’ data is not transmitted directly from their device to the respective service or Google. In particular, the user’s IP address is not transmitted to the other service. Instead, the data is first transmitted to our server, where the user’s data records are assigned to our internal user identification number. The subsequent transmission of the data from our server to the servers of the respective service providers only takes place in this pseudonymized form. The user identification number does not contain any unique data, such as names or e-mail addresses; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Contract processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland). Further information: https://business.safety.google/adsservices/ (types of processing and data processed).
• HubSpot Analytics: Web analysis, reach measurement and analysis of user behavior in relation to use and interests regarding functions and content as well as their duration of use based on a pseudonymous user identification number and profiling; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Consent (Art. 6 Para. 1 Clause 1 lit. a) GDPR); Website: https://www.hubspot.com/products/marketing/analytics; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Contract processing agreement: https://legal.hubspot.com/dpa. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
• Microsoft Clarity: Web analysis, reach measurement and analysis of user behavior in relation to use and interests regarding functions and content as well as their duration of use based on a pseudonymous user identification number and profiling; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a) GDPR); Website: https://clarity.microsoft.com; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland).

Online marketing

We process personal data for the purpose of online marketing, which may include in particular the marketing of advertising space or the presentation of advertising and other content (collectively referred to as “content”) based on potential interests of users and the measurement of their effectiveness.
For these purposes, so-called user profiles are created and stored in a file (the so-called “cookie”) or similar procedures are used by means of which the information about the user relevant for the presentation of the aforementioned content is stored. This can include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used and information on usage times and functions used. If users have consented to the collection of their location data, these can also be processed.

In addition, the IP addresses of the users are stored. However, we use available IP masking procedures (i.e. pseudonymization by shortening the IP address) to protect users. In general, no clear data of the users (such as e-mail addresses or names) is stored as part of the online marketing process, but pseudonyms. This means that neither we nor the providers of the online marketing processes know the actual identity of the user, but only the information stored in their profiles.

The statements in the profiles are usually stored in cookies or using similar processes. These cookies can generally be read later on other websites that use the same online marketing process and analyzed for the purpose of displaying content, supplemented with further data and stored on the server of the online marketing process provider.

In exceptional cases, it is possible to assign clear data to the profiles, primarily if the users are, for example, members of a social network whose online marketing process we use and the network links the user profiles with the aforementioned information. Please note that users can make additional agreements with the providers, for example by giving their consent during registration.

In principle, we only receive access to summarized information about the success of our advertisements. However, as part of so-called conversion measurements, we can check which of our online marketing processes have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. The conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, we ask you to assume that cookies used will be stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, users’ data will be processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this data protection declaration.

Notes on revocation and objection:

We refer to the data protection information of the respective providers and the objection options specified for the providers (so-called “opt-out”). If no explicit opt-out option has been specified, you have the option of deactivating cookies in the settings of your browser. However, this may restrict functions of our online offering. We therefore also recommend the following opt-out options, which are offered in summary for each region:

1. a) Europe: https://www.youronlinechoices.eu.
2. b) Canada: https://www.youradchoices.ca/choices.
3. c) USA: https://www.aboutads.info/choices.
4. d) Cross-regional: https://optout.aboutads.info.

• Types of data processed: Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, people involved).
• Affected persons: Users (e.g. website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); Tracking (e.g. interest/behavior-related profiling, use of cookies); Target group formation; Marketing; Profiles with user-related information (creation of user profiles); Conversion measurement (measurement of the effectiveness of marketing measures). Provision of our online offer and user-friendliness.
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”. Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods can be stored on users’ devices for a period of two years).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 Para. 1 Clause 1 lit. a) GDPR). Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).

Further information on processing procedures, methods and services:

• Extended conversions for Google Ads: If users click on our Google ads and then use the advertised service (so-called “conversion”), the data entered by the user, such as the email address, name, home address or telephone number, can be transmitted to Google. The hash values ​​are then compared with users’ existing Google accounts in order to better evaluate and improve users’ interaction with the ads (e.g. clicks or views) and thus their performance; Legal basis: Consent (Art. 6 Para. 1 Clause 1 lit. a) GDPR). Website: https://support.google.com/google-ads/answer/9888656.
• Google Ad Manager: We use the “Google Ad Manager” service to place ads in the Google advertising network (e.g. in search results, in videos, on websites, etc.). The Google Ad Manager is characterized by the fact that ads are displayed in real time based on users’ presumed interests. This allows us to show advertisements for our online offering to users who may have a potential interest in our offering or who have previously shown an interest in it, as well as to measure the success of the advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland); Further information: Types of processing and data processed: https://business.safety.google/adsservices/; Data processing terms for Google advertising products: Information about the services Data processing terms between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms. if Google acts as a processor, data processing conditions for Google advertising products and standard contractual clauses for third country transfers of data: https://business.safety.google/adsprocessorterms.
• Google Ads and conversion measurement: Online marketing processes for the purpose of placing content and advertisements within the service provider’s advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who are likely to be interested in the advertisements. In addition, we measure the conversion of the advertisements, i.e. whether users have taken them as an opportunity to interact with the advertisements and use the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 Para. 1 Clause 1 lit. a) GDPR), Legitimate Interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy Policy:
  https://policies.google.com/privacy; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland); Further information: Types of processing and data processed: https://business.safety.google/adsservices/. Data processing conditions between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
• Google Adsense with personalized ads: We integrate the Google Adsense service, which enables personalized ads to be placed within our online offering. Google Adsense analyzes user behavior and uses this data to display targeted advertising that is tailored to the interests of our visitors. We receive financial compensation for each ad placement or other use of these ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland); Further information: Types of processing and data processed: https://business.safety.google/adsservices/. Data processing conditions for Google advertising products: Information about the services Data processing conditions between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
• LinkedIn advertisements: Placement of advertisements within the LinkedIn platform and evaluation of the ad results; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Consent (Art. 6 Para. 1 Clause 1 lit. a) GDPR), Legitimate Interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR); Website: https://business.linkedin.com/de-de/marketing-solutions/ads; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Contract processing agreement: https://www.linkedin.com/legal/l/dpa; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland); Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Further information: https://legal.linkedin.com/dpa.

Presences in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users because it could, for example, make it more difficult to enforce user rights.

Furthermore, the data of users within social networks is usually processed for market research and advertising purposes. For example, user profiles can be created based on the user’s usage behavior and the resulting interests. The latter can in turn be used to place advertisements within and outside the networks that presumably correspond to the user’s interests. Cookies are therefore usually stored on users’ computers in which the user’s usage behavior and interests are stored. In addition, data can also be stored in the user profiles regardless of the devices used by the users (especially if they are members of the respective platforms and are logged in there).
For a detailed description of the respective processing methods and the options for opting out, please refer to the data protection declarations and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we would like to point out that these can be asserted most effectively with the providers. Only the latter have access to the user data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. textual or visual messages and contributions as well as the information relating to them, such as details of authorship or time of creation). Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Affected persons: users (e.g. website visitors, users of online services).
• Purposes of processing: communication; feedback (e.g. collecting feedback via online form). Public relations.
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).

Further information on processing processes, procedures and services:

• LinkedIn: Social network – Together with LinkedIn Ireland Unlimited Company, we are responsible for collecting (but not further processing) visitor data that is created for the purposes of creating the “Page Insights” (statistics) of our LinkedIn profiles.
  This data includes information about the types of content that users view or interact with, or the actions they take, as well as information about the devices used by users (e.g. IP addresses, operating system, Browser type, language settings, cookie data) and information from the user profile, such as job function, country, industry, hierarchy level, company size and employment status. Data protection information on the processing of user data by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy
  We have concluded a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum (the ‘Addendum’)”, https://legal.linkedin.com/pages-joint-controller-addendum), which in particular regulates which security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of those affected (i.e. users can, for example, send information or deletion requests directly to LinkedIn). The rights of users (in particular the right to information, deletion, objection and complaint to the responsible supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection of data by and transmission to Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of Ireland Unlimited Company, in particular the transmission of data to the parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland). Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Pinterest: Social network, enables sharing of photos, commenting, favorites and curating of posts, sending messages, subscribing to profiles; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.pinterest.com; Privacy policy: https://policy.pinterest.com/de/privacy-policy. Basis for third country transfers: Switzerland – adequacy decision (Ireland).

Plug-ins and embedded functions and content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These can be, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content”).

The integration always requires that the third-party providers of this content process the IP address of the users, since without an IP address they would not be able to send the content to their browser. The IP address is therefore required to display this content or functions. We endeavor to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user’s device and can contain, among other things, technical information about the browser and operating system, referring websites, the time of the visit and other information about the use of our online offer, but can also be linked to such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, the user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this data protection declaration.

• Types of data processed: Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, people involved).
• Affected persons: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offer and user-friendliness. Provision of contractual services and fulfillment of contractual obligations.
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”. Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users’ devices for a period of two years).
• Legal basis: Consent (Art. 6 Para. 1 Clause 1 lit. a) GDPR). Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR).

Further information on processing procedures, methods and services:

• Google Fonts (obtained from Google server): Obtaining fonts (and symbols) for the purpose of a technically secure, maintenance-free and efficient use of fonts and symbols with regard to timeliness and loading times, their uniform presentation and consideration of possible licensing restrictions. The provider of the fonts is informed of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted that is necessary for the provision of the fonts depending on the devices used and the technical environment. This data can be processed on a server of the font provider in the USA – When visiting our online offer, the user’s browser sends their browser HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving the fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) from Google Fonts and then the fonts specified in the CCS. These HTTP requests include (1) the IP address used by the user to access the Internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the user agent describing the browser and operating system versions of the website visitors, and the referring URL (i.e., the web page where the Google font should be displayed). IP addresses are not logged or stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent, and referring URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how often a particular font family is requested. The Google Fonts Web API requires the user agent to customize the font that is generated for the respective browser type. The user agent is logged primarily for debugging purposes and is used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts Analytics page. Finally, the referring URL is logged so that the data can be used to maintain production and generate an aggregated report on the top integrations based on the number of font requests. According to Google, it does not use any of the information collected by Google Fonts to create profiles of end users or to display targeted ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland). Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
• reCAPTCHA: We integrate the “reCAPTCHA” function to be able to recognize whether entries (e.g. in online forms) are made by people and not by automatically acting machines (so-called “bots”). The data processed may include IP addresses, information on operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, time spent on websites, previously visited websites, interactions with ReCaptcha on other websites, possibly cookies and results of manual recognition processes (e.g. answering questions asked or selecting objects in images). The data processing is based on our legitimate interest in protecting our online offering from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.google.com/recaptcha/; Privacy policy: https://policies.google.com/privacy; Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Adequacy Decision (Ireland). Opt-out option: Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://myadcenter.google.com/personalizationoff.
• Font Awesome (obtained from the provider’s server): Obtaining fonts (and symbols) for the purpose of technically secure, maintenance-free and efficient use of fonts and symbols with regard to timeliness and loading times, their uniform presentation and consideration of possible licensing restrictions. The provider of the fonts is informed of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted that is necessary for the provision of the fonts depending on the devices used and the technical environment; Service provider: Fonticons, Inc. , 6 Porter Road Apartment 3R, Cambridge, MA 02140, USA; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://fontawesome.com/. Privacy policy: https://fontawesome.com/privacy.

Management, organization and auxiliary tools

We use services, platforms and software from other providers (hereinafter referred to as “third-party providers”) for the purposes of organizing, managing, planning and providing our services. When selecting third-party providers and their services, we comply with legal requirements.

In this context, personal data may be processed and stored on the servers of third-party providers. This may affect various data that we process in accordance with this privacy policy. This data may include, in particular, master data and contact details of users, data on transactions, contracts, other processes and their contents.

If users are referred to third-party providers or their software or platforms as part of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, to optimize the service or for marketing purposes. We therefore ask you to observe the data protection information of the respective third-party providers.

• Types of data processed: Content data (e.g. textual or visual messages and contributions as well as the information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time information, identification numbers, people involved).
• Data subjects: Communication partners. Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; office and organisational procedures; reach measurement (e.g. access statistics, recognition of returning visitors). Profiles with user-related information (creation of user profiles).
• Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 Letter f) GDPR).

Further information on processing procedures, methods and services:

• HubSpot: Social media publishing, reporting (e.g. traffic sources, access numbers, web analysis), contact management (e.g. contact forms, direct communication and user segmentation), landing pages; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR); Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Contract processing agreement: https://legal.hubspot.com/dpa. Basis for third country transfers: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).

Changes and updates

We ask you to regularly inform yourself about the content of our data protection declaration. We will adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

If we provide addresses and contact information for companies and organizations in this privacy policy, please note that the addresses may change over time and ask you to check the information before contacting us.

Definitions of terms

This section provides you with an overview of the terms used in this privacy policy. If the terms are defined by law, their legal definitions apply. The following explanations, on the other hand, are primarily intended to help you understand.

• A/B tests: A/B tests are used to improve the user-friendliness and performance of online offers. Users are shown different versions of a website or its elements, such as input forms, on which the placement of the content or the labels of the navigation elements may differ. Then, based on the behavior of the users, such as staying longer on the website or interacting with the elements more frequently, it can be determined which of these websites or elements are more suitable for the needs of the users.
• Employees: Employees are people who are in an employment relationship, whether as employees, staff or in similar positions. An employment relationship is a legal relationship between an employer and an employee, which is determined by an employment contract or agreement. It includes the employer’s obligation to pay the employee remuneration while the employee performs his or her work. The employment relationship includes various phases, including the establishment, in which the employment contract is concluded, the implementation, in which the employee carries out his or her work activity, and the termination, when the employment relationship ends, whether by termination, termination agreement or otherwise. Employee data is all information that relates to these people and is in the context of their employment. This includes aspects such as personal identification data, identification numbers, salary and bank details, working hours, holiday entitlements, health data and performance appraisals.
• Inventory data: Inventory data includes essential information that is necessary for the identification and management of contractual partners, user accounts, profiles and similar assignments. This data may include, among other things, personal and demographic information such as names, contact information (addresses, telephone numbers, email addresses), dates of birth and specific identifiers (user IDs). Inventory data forms the basis for any formal interaction between people and services, institutions or systems by enabling clear assignment and communication.
• Content Delivery Network (CDN): A “Content Delivery Network” (CDN) is a service that can be used to deliver the content of an online offering, especially large media files such as graphics or program scripts, more quickly and securely using regionally distributed servers connected via the Internet.
• Content data: Content data includes information that is generated during the creation, editing and publication of all types of content. This category of data can include text, images, videos, audio files and other multimedia content that is published on various platforms and media. Content data is not only limited to the actual content, but also includes metadata that provides information about the content itself, such as tags, descriptions, author information and publication dates.
• Contact data: Contact data is essential information that enables communication with people or organizations. It includes telephone numbers, postal addresses and email addresses, as well as means of communication such as social media handles and instant messaging identifiers.
• Conversion measurement: Conversion measurement (also known as “visit action evaluation”) is a process that can be used to determine the effectiveness of marketing measures. This usually involves storing a cookie on the user’s device within the websites on which the marketing measures take place and then retrieving it on the target website. For example, we can use this to understand whether the ads we have placed on other websites have been successful.
• Meta, communication and procedural data: Meta, communication and procedural data are categories that contain information about the way data is processed, transmitted and managed. Meta data, also known as data about data, includes information that describes the context, origin and structure of other data. It can include information about the file size, the date it was created, the author of a document and the change history. Communication data records the exchange of information between users across different channels, such as email traffic, call logs, messages on social networks and chat histories, including the people involved, timestamps and transmission paths. Process data describes the processes and procedures within systems or organizations, including workflow documentation, logs of transactions and activities, and audit logs used to track and review operations.
• Usage data: Usage data refers to information that records how users interact with digital products, services, or platforms. This data includes a wide range of information that shows how users use applications, which features they prefer, how long they spend on certain pages, and which paths they take through an application. Usage data can also include frequency of use, timestamps of activities, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. In addition, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings
• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); A natural person is considered identifiable if he or she can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more special characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Profiles with user-related information: The processing of “profiles with user-related information”, or “profiles” for short, includes any type of automated processing of personal data consisting of the use of this personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information relating to demographics, behaviour and interests, such as interaction with websites and their content, etc.). Cookies and web beacons are often used for profiling purposes.
• Log data: Log data is information about events or activities logged in a system or network. This data typically contains information such as timestamps, IP addresses, user actions, error messages and other details about the use or operation of a system. Log data is often used to analyze system problems, monitor security or create performance reports.
• Reach measurement: Reach measurement (also known as web analytics) is used to evaluate the flow of visitors to an online offering and can include the behavior or interests of visitors in certain information, such as website content. With the help of reach analysis, operators of online offerings can, for example, recognize at what time users visit their websites and what content they are interested in. This enables them, for example, to better adapt the content of the websites to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus obtain more precise analyses of the use of an online offering.
• Remarketing: “Remarketing” or “retargeting” is when, for example, it is noted for advertising purposes which products a user was interested in on a website in order to remind the user of these products on other websites, e.g. in advertisements.
• Server monitoring and error detection: With the help of server monitoring and error detection, we ensure the availability and integrity of our online offering and use the processed data to technically optimize our online offering. Performance, utilization and comparable technical values ​​are processed, which provide information about the stability and any abnormalities of our online offering. In the event of errors or abnormalities, individual requests from users of our online offering are recorded in order to identify and resolve problem sources.
• Tracking: “Tracking” is when the behavior of users can be tracked across multiple online offerings. As a rule, behavior and interest information is stored in cookies or on servers of the tracking technology providers with regard to the online offerings used (so-called profiling). This information can then be used, for example, to show users advertisements that are likely to correspond to their interests.
• Responsible party: The “responsible party” is the natural or legal person, public authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data.
• Processing: “Processing” is any process or series of processes carried out with or without the aid of automated procedures in connection with personal data. The term is broad and covers virtually every handling of data, be it collecting, evaluating, storing, transmitting or deleting.
• Contract data: Contract data is specific information related to the formalization of an agreement between two or more parties. It documents the terms under which services or products are provided, exchanged or sold. This category of data is essential for managing and fulfilling contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data can include start and end dates of the contract, the type of services or products agreed, pricing agreements, payment terms, termination rights, renewal options and special terms or clauses. It serves as the legal basis for the relationship between the parties and is crucial for clarifying rights and obligations, enforcing claims and resolving disputes.
• Payment data: Payment data includes all information needed to process payment transactions between buyers and sellers. This data is crucial for e-commerce, online banking and any other form of financial transaction. They contain details such as credit card numbers, bank details, payment amounts, transaction data, verification numbers and billing information. Payment data can also contain information about payment status, chargebacks, authorizations and fees.
• Target group formation: Target group formation (English “custom audiences”) is when target groups are determined for advertising purposes, e.g. displaying advertisements. For example, based on a user’s interest in certain products or topics on the Internet, it can be concluded that this user is interested in advertisements for similar products or the online shop in which he viewed the products. “Lookalike audiences” (or similar target groups) are, in turn, when the content deemed suitable is displayed to users whose profiles or interests presumably correspond to the users for whom the profiles were created. Cookies and web beacons are generally used for the purposes of creating custom audiences and lookalike audiences.