Privacy policy

Introduction

In this privacy policy, we would like to inform you about the different types of your personal data (hereinafter also referred to as “data”) that we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data that we carry out, both within the context of the provision of our services and, in particular, on the pages of our website, in mobile applications, and within external online presences, for example, our social media profiles (hereinafter collectively referred to as the “online offer”).

The terms used are not gender-specific.

As of: July 27, 2021

Overview of contents

Controller

Transaction-Network GmbH & Co. KG
Industriepark 312
78244 Gottmadingen

Authorized representatives: Gerd Bart.

Email address: contact@transaction-network.com.

Tel.: +49 7731 16923 – 0.

Imprint: https://www.transaction-network.com/impressum/.

Overview of processing

The following overview summarizes the types of data processed, the purposes of their processing, and makes reference to the data subjects.

Types of data processed

  • Inventory data (e.g., names, addresses).
  • Content data (e.g., entries in online forms).
  • Contact data (e.g., email, telephone numbers).
  • Meta/communication data (e.g., device information, IP addresses).
  • Usage data (e.g., web pages visited, interest in content, access times).
  • Contract data (e.g., subject matter of the contract, term, customer category).
  • Payment data (e.g., bank details, invoices, payment history).

Categories of data subjects

  • Personnel (e.g., employees, applicants, former employees).
  • Business and contractual partners.
  • Interested parties.
  • Communication partners.
  • Customers.
  • Users (e.g., website visitors, users of online services).

Purpose of processing

  • Provision of our online offer and user-friendliness.
  • Office and organizational procedures.
  • Direct marketing (e.g., by email or post).
  • Feedback (e.g., collecting feedback via an online form).
  • Marketing.
  • Contact requests and communication.
  • Profiles with user-related information (creation of user profiles).
  • Security measures.
  • Provision of contractual services and customer service.
  • Managing and responding to requests.

Applicable legal bases

Below you will find an overview of the legal bases of the GDPR, upon which basis we process personal data. Please note that national data protection regulations may apply in your or our country of residence or domicile in addition to the provisions of the GDPR. If, in addition, more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6 para. 1 p. 1 lit. a. GDPR) – The data subject has given his/her consent to the processing of personal data concerning him/her for a specific purpose or several specific purposes.
  • Performance of a contract and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or for the carrying out pre-contractual measures taken at the request of the data subject.
  • Legal obligation (Art. 6 para. 1 p. 1 lit. c. GDPR – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR)– Processing is necessary to protect the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data.

National data protection regulations in Germany: National regulations on data protection apply in Germany in addition to the data protection regulations of the General Data Protection Regulation. This includes, in particular, the act on protection against misuse of personal data in data processing (Bundesdatenschutzgesetz – BDSG). The BDSG contains, in particular, special provisions on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission, as well as automated decision-making in individual cases, including profiling. In addition, it regulates data processing for purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, implementation, or termination of employment relationships as well as the consent of employees. Moreover, state data protection laws of the individual German federal states may apply.

Security measures

We take suitable technical and organizational measures to ensure a level of protection appropriate to the risk in accordance with the legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances, and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons.

The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to it. This also includes access to, input of, disclosure of, assurance of availability of, and separation of the data. In addition, we have established procedures that ensure the exercise of data subject rights, the erasure of data, and responses to data compromise. Moreover, we already take the protection of personal data into account during the development and/or selection of hardware, software, and processes in accordance with the principle of data protection, through the design of technology and default settings favorable to data protection.

Shortening of the IP addresses: If IP addresses are processed by us or by the service providers and technologies used and the processing of a full IP address is not required, the IP address is shortened (also referred to as “IP masking”). The last two digits or the last part of the IP address after a dot are removed or replaced by wildcards. Shortening of the IP address is intended to prevent or make it considerably more difficult to identify a person by their IP address.

SSL encryption (https): We use SSL encryption to protect the data you transfer via our online offer. You are able to recognize encrypted connections like these by the prefix https:// in the address bar of your browser.

Transfer of personal data

The data may be transferred to or disclosed to other entities, companies, legally independent organizational units, or persons during the course of us processing your personal data. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In cases such as these, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data processing in third countries

Insofar as we process data in a third country (i.e., outside the European Union [EU], the European Economic Area [EEA]) or processing takes place with the context of the use of third-party services or the disclosure or transfer of data to other persons, entities, or companies, this will only be done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, the existence of certifications, or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Erasure of data

The data processed by us will be erased in accordance with the statutory provisions as soon as their processing is revoked or other consents no longer apply (e.g., if the purpose of processing this data no longer applies or they are not required for the purpose).

Insofar as the data is not erased because it is required for other and legally permissible purposes, its processing will be limited to these purposes. That means the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural person or legal entity.

Within the scope of our data protection information, we may provide users with additional information regarding the erasure or the retention of data that is specific to each processing operation.

Use of cookies

Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user’s computer. A cookie is primarily used to store information about a user during or after their visit within an online offer. Stored information may include, for example, language settings on a website, login status, a shopping cart, or where a video was watched. The term “cookies” also includes other technologies that perform the same functions as cookies (e.g., when user information is stored using pseudonymous online identifiers, also known as “user IDs”).

A distinction is made between the following types and functions of cookies:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed their browser.
  • Permanent cookies: Permanent cookies are retained even after the browser has been closed. For example, login status can be saved or preferred content can be displayed directly when the user revisits a website. Similarly, the interests of users used for audience measurement or marketing purposes may be stored in such a cookie.
  • First-party cookies: First-party cookies are set by us.
  • Third-party-cookies: Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
  • Necessary (also: essential or absolutely necessary) cookies: On the one hand, cookies may be absolutely necessary for the operation of a website (e.g., to store logins or other user input or for security reasons).
  • Statistical, marketing, and personalization cookies: On the other hand, cookies are generally also used within the context of audience measurement and when the interests or behavior of a user (e.g., viewing certain content, use of functions, etc.) on individual websites are stored in a user profile. Such profiles are used, for instance, to show users, for example, content that matches their potential interests. This process is also called “tracking” (i.e., tracking the potential interests of users). Insofar as we use cookies or “tracking” technologies, we will inform you separately in our privacy policy or within the context of obtaining consent.

Information regarding legal bases: The legal basis upon which we process your personal data using cookies depends on whether we ask for your consent. If this applies and you consent to the use of cookies, the legal basis for the processing of your data is the declared consent. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g., in the business operation of our online offer and its improvement) or, if the use of cookies is necessary to perform our contractual obligations.

Storage period: Unless we provide you with explicit information regarding the storage period of permanent cookies (e.g., within the context of a so-called cookie opt-in), please assume that the storage period can be up to two years.

General information on revocation and objection (opt-out): Depending on whether the processing is based on consent or legal permission, you have the option at any time to revoke any consent you have given or to object to the processing of your data by cookie technologies (collectively referred to as “opt-out”). You can initially declare your objection by means of your browser settings, for example, by deactivating the use of cookies (whereby this may also limit the functionality of our online offer). An objection to the use of cookies for online marketing purposes can also be declared by means of a variety of services, especially in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can receive further instructions on how to object within the context of the information on the service providers and cookies used.

Processing of cookie data on the basis of consent: We use a cookie consent management procedure, under which the consent of users to the use of cookies, or the processing and providers mentioned in the cookie consent management procedure, can be obtained and managed and revoked by users. The declaration of consent is stored so that it does not have to be repeated and the consent can be proven in accordance with legal obligations. Storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or by using similar technologies), in order to be able to assign consent to a user or their device. Subject to individual information on cookie management service providers, the following information applies: The duration of the storage of consent can be up to two years. In this case a pseudonymous user identifier is generated and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), and which browser, system, and end device were used.

  • Types of data processed: usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
  • Data subjects: users (e.g., website visitors, users of online services).
  • Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. GDPR), legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Business services

We process our contractual and business partners’ data, for example, customers and interested parties (collectively referred to as “contractual partners”) within the context of contractual and comparable legal relationships as well as associated measures and within the context of communication with contractual partners (or pre-contractual), for instance, to answer requests.

We process this data to perform our contractual obligations, to safeguard our rights, and for the purposes of the administrative tasks associated with this information as well as for business organization. Within the scope of the applicable law, we only pass on data from contractual partners to third parties to the extent that is necessary for the aforementioned purposes or for the fulfilment of legal obligations or with the consent of the data subject (e.g., to participating telecommunication, transport, and other auxiliary services including subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Contractual partners will be informed regarding further forms of processing, for example, for marketing purposes, within the scope of this privacy policy.

We inform contractual partners regarding what data is required for the aforementioned purposes prior to or during the process of data collection, for example, in online forms, by means of special marking (e.g., colors) or symbols (e.g., asterisks or similar), or in person.

We delete the data after the expiry of the legal warranty and similar obligations, i.e., after 4 years, unless the data is stored in a customer account, for example, as long as it needs to be retained for legal archiving reasons (e.g., 10 years as a rule for tax purposes). Data that has been disclosed to us during the order process by the contractual partner will be deleted in accordance with the specifications of the order, generally after the end of the order.

Insofar as we use third-party providers or platforms to provide our services, the terms of business and data protection information of the respective third-party providers or platforms apply in the relationship between users and providers.

Customer account: A contractual partner can create an account within our online offer (e.g., customer or user account, in short “customer account”). If registration of a customer account is required, contractual partners will be informed of this as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. We store the IP addresses of customers and access times, subsequent logins and the usage of the customer account during the registration process in order to be able to prove registration and prevent any misuse of the customer account.

If customers have terminated their customer account, the data concerning the customer account will be deleted, unless its retention is required for legal reasons. It is the customer’s responsibility to back up their data upon termination of the customer’s account.

Software and platform service offers: We process the data of our users, registered users, and any test users (hereinafter uniformly referred to as “users”) in order to be able to provide our contractual services to them and on the basis of legitimate interests to ensure the security of our offer and to be able to develop it further. The required information is identified as such within the context of the order, purchase order, or comparable contract conclusion and includes information required for the provision of services and billing as well as contact information in order to be able to hold any consultations.

  • Types of data processed: inventory data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., email, telephone numbers), contract data (e.g., subject matter of contract, term, customer category), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
  • Data subjects: interested parties, business and contractual partners, customers.
  • Purposes of processing: provision of contractual services and customer service, contact requests and communications, office and organizational procedures, managing and responding to requests, security measures.
  • Legal bases: performance of a contract and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. GDPR), legal obligation (Art. 6 para. 1 p. 1 lit. c. GDPR), legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Provision of the online offer and web hosting

In order to provide our online offer securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space, and database services, as well as security services and technical maintenance services.

The data processed within the scope of providing the hosting service may include all information relating to the users of our online offer that is generated within the scope of usage and communication. This generally includes the IP address, which is necessary to be able to deliver the contents of online offers to browsers, and all entries made within our online offer or from websites.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data every time the server is accessed (so-called server log files). The server log files may include the address and name of the web pages and the accessed files, the date and time of access, the volume of data transferred, notification of successful access, the type of browser and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files may be used, on the one hand, for security purposes, for example, to prevent server overload (especially in the case of malicious attacks, so-called DDoS attacks) and, on the other, to ensure the capacity utilization of the servers and their stability.

  • Types of data processed: content data (e.g., entries in online forms), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
  • Data subjects: users (e.g., website visitors, users of online services).
  • Purposes of processing: provision of our online offer and user-friendliness.
  • Legal bases: legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

  • DomainFactory: Services in the field of provision of information technology infrastructure and related services (e.g., storage space and/or computing capacities); service provider: domainfactory GmbH, Oskar-Messter-Str. 33, 85737 Ismaning, Germany; website: https://www.df.eu; privacy policy: https://www.df.eu/de/datenschutz.

Contact and request management

When contacting us (e.g., by contact form, email, telephone or via social media), the information relating to the person making the request is processed to the extent necessary to respond to the contact requests and any requested measures.

The response to contact requests within the context of contractual or pre-contractual relationships is made in order to perform our contractual obligations or to respond to (pre-)contractual requests and otherwise on the basis of legitimate interests in responding to the requests.

  • Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., entries in online forms).
  • Data subjects: communication partners.
  • Purposes of processing: contact requests and communication.
  • Legal bases: performance of a contract and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Video conferences, online meetings, webinars, and screen sharing

We use third-party platforms and applications (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter referred to collectively as “conference”). We observe legal requirements when selecting conference platforms and their services.

Data processed through conference platforms: Within the framework of participation in a conference, the conference platforms process the participants’ personal data as mentioned below. On the one hand, the scope of processing depends on what data is requested within the context of a specific conference (e.g., information related to access data or real names) and, on the other, on what optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants’ data may also be processed by the conference platforms for security purposes or to optimize service. The processed data includes personal data (first name, last name), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/role, the IP address of the Internet access, data

Microsoft Teams:

  • Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
  • Data subjects: communication partners, users (e.g., website visitors, users of online services).
  • Purposes of processing: provision of contractual services and customer service, contact requests and communications, office and organizational procedures.
  • Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. GDPR) performance of a contract and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

  • 765995362.9977273 324053382.008547 1160402471.516854 26939398757.117645 842567014.905028 52797583.51574803 2408939638.794304 1141843462.2747524 2376566760.5225987 9385482537.75 393848685.8241206 1926764247.4597702 2660662721.280374 4904131159.138889 3948421105.027027 11334013461.690908 2392358655.4051723 2481735594.218563 616413399.7424242 825183528.6183007

Cloud services

We use software services accessible via the Internet and operating on the servers of their providers (so-called “cloud services”, also referred to as “software as a service”) for the following purposes: document storage and management, calendar management, sending emails, spreadsheets and presentations, sharing documents, content and information with specific recipients or publishing web pages, forms, or other content and information, and chats and participation in audio and video conferences.

Within this context, personal data may be processed and stored on the servers of the providers to the extent they are part of communication processes with us or are otherwise processed by us as specified within the context of this privacy policy. This data may include, in particular, the master data and contact data of users, data on transactions, contracts, other processes, and their contents. The cloud service providers also process

  • Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
  • Data subjects: customers, personnel (e.g., employees, applicants, former employees), interested parties, communication partners.
  • Purposes of processing: office and organizational procedures.
  • Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. GDPR) performance of a contract and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Newsletters and electronic notifications

We send newsletters, emails, and other electronic notifications (hereinafter “newsletter”) only with the consent of the recipients or legal permission. Insofar as the content of the newsletter is specifically described during the registration process, this is decisive for the user’s consent. Moreover, our newsletters contain information about our services and us.

It is generally sufficient to enter your email address to subscribe to our newsletters. However, we may ask you to provide a name for the purpose of personal address in the newsletter or other information if required for the purposes of the newsletter.

Double opt-in procedure: Registration for our newsletter is always carried out in a so-called double opt-in process. This means that after registration you will receive an email asking you to confirm your registration. Confirmation is required to ensure no one can log in with third-party email addresses. Subscriptions to the newsletter are logged in order to be able to prove the subscription process in accordance with legal requirements. This includes the storage of the login and confirmation time as well as the IP address. Changes to your data stored with the shipping service provider are also logged.

Erasure and restriction of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before erasing them to prove that consent had previously been given. The processing of this data is restricted to the purpose of a possible defense against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address in a so-called “block list” solely for this purpose.

Logging of the registration process takes place on the basis of our legitimate interests for the purposes of proving its proper procedure. If we commission a service provider to send emails, we do so on the basis of our legitimate interests in an efficient and secure dispatch system.

Information regarding legal bases: The newsletters are sent on the basis of the recipients’ consent or, if consent is not required, on the basis of our legitimate interests in direct marketing, if and insofar as this is permitted by law, for example, in the case of existing customer advertising. Insofar as we commission a service provider to send emails, this is done on the basis of our legitimate interests. The registration process is recorded on the basis of our legitimate interests to demonstrate that it has been carried out in accordance with the law.

Contents: Information about us, our services, promotions and offers.

Measurement of open and click-through rates:

The newsletters contain a so-called “web beacon”, which is a pixel-sized file that is retrieved from our server when the newsletter is opened, or, if we use a dispatch service provider, from their server. During the process of this retrieval, technical information, such as information regarding the browser and your system, as well as your IP address and the time of the retrieval, are initially collected.

This information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. This analysis also includes determining whether the newsletters have been opened, when they were opened, and which ones

  • Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., email, telephone numbers), meta/communication data (e.g., device information, IP addresses), usage data (e.g., web pages visited, interest in content, access times).
  • Data subjects: communication partners.
  • Purposes of processing: direct marketing (e.g., by email or post).
  • Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. GDPR), legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).
  • Right to withdraw consent (opt-out): You can cancel the receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. A link to cancel the newsletter can be found either at the end of each newsletter or you can use one of the contact options given above, preferably email, for this purpose.

Online marketing

We process personal data for online marketing purposes, which may include, in particular, marketing advertising space or displaying promotional and other content (collectively, “content”) based on the potential interests of users and for measuring its effectiveness.

So-called user profiles are created for these purposes and stored in a file (so-called “cookies”) or similar procedures are used by means of which the user data relevant to the presentation of the aforementioned content is stored. This information may include, for example, the content viewed, web pages visited, online networks used, as well as communication partners and technical information, such as the browser used, the computer system used, and information on usage times. Location data can also be processed if users have consented to its collection.

Users’ IP addresses are also stored. However, we use available IP masking methods (i.e., pseudonymization by shortening the IP address) to protect users. In general, no user cleartext data (e.g., email addresses or names) is stored as part of the online marketing process, but only pseudonyms. This means that we, as well as the providers of the online marketing methods, do not know the actual identity of the users, but only the information stored in their profiles.

As a rule, the information in the profiles is stored in the cookies or by means of similar procedures. These cookies can later generally be read on other websites that use the same online marketing method and analyzed for the purpose of displaying content as well as supplemented with further data and stored on the server of the online marketing method provider.

As an exception, cleartext data is able to be assigned to profiles. This is the case if, for example, the users are members of a social network whose online marketing methods we use and the network links the profile of the users to the aforementioned information. Please note that users can make additional agreements with the providers, for example, by giving their consent during the registration process.

We generally only receive access to summarized information about the success of our advertisements. However, within the context of so-called conversion measurements, we can check which of our online marketing processes have led to a so-called conversion, i.e., that a contract has been concluded with us, for example. Conversion measurement is used solely to analyze the success of our marketing efforts.

Unless otherwise stated, we ask you to assume that cookies used will be stored for a period of two years.

Information regarding legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical, and recipient-friendly services). Within this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of data processed: usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
  • Data subjects: users (e.g., website visitors, users of online services).
  • Purposes of processing: marketing, profiles with user-related information (creating user profiles).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. GDPR), legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).
  • Right to withdraw consent (opt-out): We refer to the data protection information of the respective providers and the options to withdraw consent given to the providers (so-called “opt-out”). If no explicit opt-out option has been specified, you have the option of disabling cookies in your browser settings. This may restrict functions of our online offer, however. We therefore additionally recommend the following opt-out options, which are offered collectively for the respective territories: a) Europe: https://www.youronlinechoices.eu.
    b) Canada: https://www.youradchoices.ca/choices.
    c) USA: https://www.aboutads.info/choices.
    d) Cross-territory: https://optout.aboutads.info.

Services used and service providers:

Social network presence (social media)

We maintain online presences within social networks and process user data within this context in order to communicate with users who are active there or to offer information about us.

We would like to point out that in the process, user data may be processed outside the area of the European Union. This may give rise to risks for users as it could make it more difficult to enforce users’ rights, for example.

Moreover, user data within social networks is generally processed for market research and advertising purposes. This means that, for example, usage profiles can be created based on the usage behavior and resulting interests of the users. The usage profiles can in turn be used, for example, to display advertisements within and outside the networks that are assumed to correspond to the users’ interests. Cookies are generally stored on the users’ computers, in which the usage behavior and interests of the users are stored for these purposes. Moreover, data may also be stored in the usage profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged into them).

For a detailed presentation of the respective forms of processing and the options to withdraw consent (opt-out), we refer to the privacy policies and the information provided by the operators of the respective networks.

Also in the case of requests for information and the assertion of the rights of data subjects, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can then take direct and appropriate action and provide information. If you nevertheless require any other assistance, please get in contact with us.

Facebook: We are jointly responsible with Facebook Ireland Ltd. for the collection (but not the further processing) of the data of visitors to our Facebook page (so-called. “Fanpage”). This data includes information about the types of content that users view or interact with, or the actions they take (refer to “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices users use (e.g., IP addresses, operating system, browser type, language settings, cookie data; see under “Device information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, called “Page insights”, to website operators to provide them with insights into how people interact with their pages and with content associated with them. We have entered into a special agreement with Facebook (“Information about Page insights” https://www.facebook.com/legal/terms/page_controller_addendum), which specifically governs what security measures Facebook must observe and in which Facebook has agreed to comply with the data subject rights (that means that users can, for example, make requests for information or erasures directly to Facebook). The rights of users (in particular to information, erasure, objection, and complaint to the competent supervisory authority), are not restricted by the agreements with Facebook. For more information, see the “Information on Page insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data).

  • Types of data processed: contact data (e.g., email, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
  • Data subjects: users (e.g., website visitors, users of online services).
  • Purposes of processing: contact requests and communication, feedback (e.g., collecting feedback via online forms), marketing.
  • Legal bases: legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

Plug-ins, embedded functions, and content

We incorporate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). This may include, for example, graphics, videos, or city maps (hereinafter uniformly referred to as “content”).

The integration always requires that the third-party providers of this content process the IP address of the user, since without the IP address they could not send the content to their browser. The IP address is thus required to display these contents or functions. We make every effort to use only such content whose respective providers use the IP address only for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Information, such as visitor traffic on the pages of this website, can be evaluated using these “pixel tags”. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other information related to the use of our online offering, as well as being linked to such information from other sources.

Information regarding legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical, and recipient-friendly services). Within this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Google Maps APIs and SDKs:

reCAPTCHA:

  • Types of data processed: usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses) inventory data (e.g., names, addresses), inventory data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., entries in online forms).
  • Data subjects: users (e.g., website visitors, users of online services).
  • Purposes of processing: provision of our online offer and user-friendliness, provision of contractual services and customer service.
  • Legal bases: legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR), consent (Art. 6 para. 1 p. 1 lit. a. GDPR), performance of a contract and pre-contractual requests (Art. 6 para. 1 S. 1 lit. b. GDPR).

Services used and service providers:

  • Google Fonts: We integrate the fonts (“Google Fonts”) of the provider Google, whereby the user’s data is used solely for the purpose of displaying the fonts in the user’s browser. Integration is based on our legitimate interests in a technically secure, maintenance-free, and efficient use of fonts, their uniform display, and taking into consideration possible licensing restrictions for their integration. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://fonts.google.com/; privacy policy: https://policies.google.com/privacy.
  • Google Maps: We integrate the maps of the service “Google Maps” of the provider Google. The data processed may include, in particular, IP addresses and location data of the users, which, however, are not collected without their consent (generally performed within the settings of their mobile devices); service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://cloud.google.com/maps-platform; privacy policy: https://policies.google.com/privacy; right to withdraw consent (opt-out): Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, ad display settings of advertising: https://adssettings.google.com/authenticated.
  • 821343180.5632912 107191371.7843987 1822002678.4573863 9384866198.243244 2096992850.9801323 146090434.45384616 1389927783.7229729 571673013.1715893 220869049.98701298 3046528335.5898876 959545390.0168394 1560972948.3800426 6577813073.209091 1892882819.8717434 444368130.7616 55173245167.53846 537740980.2711865 376851592.0505618 7191312485.320611 1583625028.8138041
  • 219344447.2143685 570072123.9878198 177125558.7791209 857938237.3451144 562269266.4153847 433620715.94285715 17229981316.77193 972651989.4613822 986467665.5925926 1601254300.681431 841163165.9538106 1166536388.0498283 1092423956.5645714 3530497111.2289157 1009463020.9244604 947540481.7628726 1977652044.7950819 920393421.8512241 1203553468.7076461 72373733.79161373
  • YouTube videos: Video contents; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy; right to withdraw consent (opt-out): Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, ad display settings of advertising: https://adssettings.google.com/authenticated.

Changes and updates to the privacy policy

We would like to ask you to regularly inform yourself about the content of our privacy policy. We will adapt the privacy policy as soon as the changes to data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or other individual notification.

Where we provide addresses and the contact information of companies and organizations in this privacy policy, please note that addresses may change over time; please check the information before getting in contact.

Rights of the data subjects

As a data subject, you are entitled to a range of rights under the GDPR, which arise in particular from Art. 15 to 21 of the GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you that is carried out on the basis of Article 6 para. 1 lit. (e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; which includes profiling to the extent that it is related to such direct marketing.
  • Right of withdrawal of consent: You have the right to withdraw any consent you have given at any time.
  • Right to information: You have the right to request confirmation as to whether data in question is being processed and to information about this data, as well as further information and a copy of the data in accordance with the legal requirements.
  • Right of rectification: In accordance with the legal requirements, you have the right to request that the data concerning you be completed or that incorrect data concerning you be corrected.
  • Right to erasure and the restriction of processing: In accordance with the statutory provisions, you have the right to demand that data relating to you be erased immediately or, alternatively, to demand restriction of the processing of the data in accordance with the statutory provisions.
  • Right to data portability: You have the right to receive data that you have provided to us and that concerns you in a structured, common, and machine-readable format in accordance with the legal requirements, or to request that it be transferred to another controller.
  • Complaint to supervisory authority: In accordance with the law and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you usually reside, the supervisory authority of your place of work, or the place of the alleged infringement, if you consider that the processing of personal data that concerns you infringes the GDPR.

Definitions

This section provides you with an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined especially in Art. 4 GDPR. The legal definitions are binding. The explanations hereinafter, on the other hand, are intended primarily to aid understanding. The terms are sorted alphabetically.

  • IP masking: “IP masking” is a method in which the last octet, i.e., the last two numbers of an IP address, is deleted so that the IP address can no longer be used to uniquely identify a person. IP masking is thus a means of pseudonymizing processing procedures, especially in online marketing
  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Profiles with user-related information: The processing of “profiles with user-related information”, or “profiles” for short, includes any type of automated processing of personal data that consists in using such personal data to analyze, evaluate, or to predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various types of information concerning demographics, behavior, and interests, e.g., interaction with websites and their content, etc.) (e.g., interests in certain content or products, click behavior on a website or location). Cookies and web beacons are often used for profiling purposes.
  • Controller: “Controller” means the natural or legal person, public authority, agency, or other body who alone or jointly with others determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations that is performed upon personal data, whether or not by automatic means. The term is wide-ranging and encompasses practically every handling of data, be it collection, analysis, storage, transmission, or erasure.

Menu