Privacy Policy

Introduction

The following privacy policy is intended to inform you about the types of personal data (hereinafter also referred to as ‘data’) that we process, the purposes for which we do so, and the extent to which we process it. This privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and, in particular, on our websites, in mobile applications and on external online platforms, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are not gender-specific.

Date: 27 July 2020

Table of contents

• Introduction
• Data controller
• Overview of data processing
• Relevant legal bases
• Security measures
• Transfer and disclosure of personal data
• Data processing in third countries
• Commercial and business services
• Provision of the online service and web hosting
• Social media presence
• Plugins, embedded functions and content
• Contact and enquiry management
• Deletion of data
• Amendments and updates to the privacy policy
• Rights of data subjects
• Definitions of terms

Data Controller

Kevin Schaumburg
Hauptstr. 45a
85551 Kirchheim near Munich

Email address: This email address is being protected from spambots. You need JavaScript enabled to view it.

Legal notice: https://Feedback-Terminal.com/impressum

Overview of data processing

The following overview summarises the types of data processed and the purposes of such processing, and identifies the data subjects.

Types of data processed

• Master data (e.g. names, addresses).
• Content data (e.g. text entries, photographs, videos).
• Contact details (e.g. email, telephone numbers).
• Meta/communication data (e.g. device information, IP addresses).
• Usage data (e.g. websites visited, interest in content, access times).
• Contract data (e.g. subject matter of the contract, term, customer category).
• Payment data (e.g. bank details, invoices, payment history).

Categories of data subjects

• Business and contractual partners.
• Prospective customers.
• Communication partners.
• Users (e.g. website visitors, users of online services).

Purposes of processing

• Provision of our online services and user-friendliness.
• Analysis of visitor activity.
• Administrative and organisational procedures.
• Direct marketing (e.g. by email or post).
• Interest-based and behavioural marketing.
• Enquiries and communication.
• Profiling (creation of user profiles).
• Remarketing.
• Audience measurement (e.g. traffic statistics, identification of returning visitors).
• Security measures.
• Tracking (e.g. interest-based/behavioural profiling, use of cookies).
• Contractual services.
• Administration and handling of enquiries.

Relevant legal bases

Below, we set out the legal bases under the General Data Protection Regulation (GDPR) on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations in your country of residence or our country of incorporation may apply. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1), first sentence, point (a) of the GDPR) – The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes.
• Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR) – The processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.
• Legal obligation (Article 6(1), first sentence, point (c) of the GDPR) – The processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection provisions of the General Data Protection Regulation, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against the Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, data transfers, and automated decision-making in individual cases, including profiling. Furthermore, it governs data processing for the purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, performance or termination of employment relationships, as well as the consent of employees. In addition, state data protection laws of the individual federal states may apply.

Security measures

We implement technical and organisational measures in accordance with statutory requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihoods and severity of threats to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input of, disclosure of, and safeguarding the availability of the data, and ensuring its segregation. Furthermore, we have established procedures to ensure that data subjects’ rights are upheld, that data is deleted and that appropriate action is taken in the event of a data breach. Furthermore, we take the protection of personal data into account right from the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and through privacy-friendly default settings.

SSL encryption (https): To protect the data you transmit via our online service, we use SSL encryption. You can recognise such encrypted connections by the prefix https:// in your browser’s address bar.

Transfer and disclosure of personal data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organisational units or individuals. Recipients of this data may include, for example, payment institutions in connection with payment transactions, service providers commissioned to carry out IT tasks, or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

Data transfer within the organisation: We may transfer personal data to other departments within our organisation or grant them access to this data. Where such disclosure is made for administrative purposes, it is based on our legitimate business and operational interests, or takes place where it is necessary to fulfil our contractual obligations, or where the data subjects have given their consent or where there is a legal basis for doing so.

Data processing in third countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other bodies or organisations, bodies or companies, this takes place only in accordance with the statutory requirements.

Subject to express consent or where transfer is required by contract or law, we shall only process data or allow it to be processed in third countries with a recognised level of data protection, contractual obligations through the European Commission’s so-called standard data protection clauses, where certifications are in place or binding internal data protection regulations apply (Articles 44 to 49 of the GDPR, European Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de ).

Commercial and business services

We process data relating to our contractual and business partners, e.g. customers and prospective customers (collectively referred to as ‘contractual partners’) within the framework of contractual and comparable legal relationships, as well as associated measures and in the context of communication with contractual partners (or at the pre-contractual stage), e.g. to respond to enquiries.

We process this data to fulfil our contractual obligations, to safeguard our rights, and for the purposes of the administrative tasks associated with this information, as well as for business organisation. We disclose the contractual partners’ data to third parties in accordance with applicable law only to the extent that this is necessary for the aforementioned purposes or to fulfil legal obligations, or where the data subjects have given their consent (e.g. to relevant telecommunications, transport and other support services, as well as subcontractors, banks, tax and legal advisers, payment service providers or tax authorities). Contractual partners are informed about other forms of processing, e.g. for marketing purposes, within the scope of this privacy policy.

We inform contractual partners of which data is required for the aforementioned purposes either prior to or during the collection of data, e.g. in online forms, by means of specific markings (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data once statutory warranty obligations and comparable obligations have expired, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. for as long as it must be retained for statutory archiving purposes (e.g. for tax purposes, usually 10 years). We delete data disclosed to us by the contractual partner in the context of a contract in accordance with the terms of that contract, generally upon completion of the contract.

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy policies of the respective third-party providers or platforms shall apply to the relationship between users and those providers.

Further information on commercial services: We process the data of our customers and clients (hereinafter collectively referred to as ‘customers’) in order to enable them to select, purchase or commission the chosen services or works, as well as related activities, and to facilitate their payment, delivery, execution or provision.

The required details are identified as such when the contract, order or similar agreement is concluded and include the information necessary for the provision of services and invoicing, as well as contact details to facilitate any necessary consultations.

• Types of data processed: Master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact details (e.g. email, telephone numbers), contract data (e.g. subject matter of the contract, term, customer category).
• Data subjects: Prospective customers, business and contractual partners.
• Purposes of processing: Contractual services, contact enquiries and communication, office and organisational procedures, administration and responding to enquiries.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR), legal obligation (Art. 6(1), first sentence, point (c) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Provision of the online service and web hosting

In order to provide our online service securely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online service can be accessed. For these purposes, we may utilise infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance services.

The data processed in connection with the provision of the hosting service may include all information relating to users of our online service that is generated during its use and in the course of communication. This regularly includes the IP address, which is necessary to deliver the content of online services to browsers, and all data entered within our online service or on websites.

Email dispatch and hosting: The web hosting services we use also include the sending, receiving and storage of emails. For these purposes, the addresses of the recipients and senders, as well as further information relating to email transmission (e.g. the providers involved) and the content of the respective emails, are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent in encrypted form over the internet. Although emails are usually encrypted whilst in transit, they are not encrypted on the servers from which they are sent and received (unless a so-called end-to-end encryption method is used). We are therefore unable to accept any responsibility for the transmission of emails between the sender and our server.

Collection of access data and log files: We (or our web hosting provider) collect data on every access to the server (so-called server log files). Server log files may include the address and name of the web pages and files accessed, the date and time of the request, the volume of data transferred, confirmation of a successful request, browser type and version, the user’s operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files may be used, on the one hand, for security purposes, e.g. to prevent the servers from becoming overloaded (particularly in the event of malicious attacks, known as DDoS attacks) and, on the other hand, to ensure the servers’ capacity utilisation and stability.

• Types of data processed: Content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

• To ensure the secure operation of our website, we use the Cloudflare Argo Tunnel service provided by Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA. Argo Tunnel establishes an encrypted connection between our server and the Cloudflare network, whilst ensuring that our servers are not directly accessible from the public internet. In doing so, your IP address may be transmitted to Cloudflare and processed there in order to provide a stable and secure connection.
• This processing is carried out on the basis of Article 6(1)(f) of the GDPR, based on our legitimate interest in the security and availability of our website. Further information can be found in Cloudflare’s privacy policy.

Web analytics, monitoring and optimisation

Web analytics (also known as ‘audience measurement’) is used to analyse visitor traffic to our online service and may include pseudonymised data on visitors’ behaviour, interests or demographic information, such as age or gender. With the help of audience measurement, we can, for example, identify at what times our online service, its functions or content are used most frequently, or encourage repeat visits. We can also identify which areas require optimisation.

In addition to web analytics, we may also use testing procedures to, for example, test and optimise different versions of our online service or its components.

Unless otherwise stated below, profiles – i.e. data aggregated to represent a usage session – may be created for these purposes, and information may be stored in a browser or on a device and retrieved from it. The data collected includes, in particular, the web pages visited and the elements used on them, as well as technical details such as the browser and computer system used, and information on usage times. Where users have given their consent to the collection of their location data, either to us or to the providers of the services we use, location data may also be processed.

Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. Generally, no personally identifiable data (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of users, but only the information stored in their profiles for the purposes of the respective processes.

• Types of data processed: usage data (e.g. webpages visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time stamps, identification numbers, consent status).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Audience measurement (e.g. access statistics, identification of returning visitors). Profiles containing user-related information (creation of user profiles).
• Security measures: IP masking (pseudonymisation of the IP address).
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Further information on processing procedures, methods and services:

• Matomo (without cookies): Matomo is a privacy-friendly web analytics software that operates without cookies; it identifies returning users using a so-called ‘digital fingerprint’, which is stored anonymously and changed every 24 hours; The ‘digital fingerprint’ records user activity within our online service using pseudonymised IP addresses in combination with the user’s browser settings in such a way that it is not possible to draw conclusions about the identity of individual users. The user data collected through the use of Matomo is processed solely by us and is not shared with third parties; legal basis: legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR). Website: https://matomo.org/.
• {matomo_opt_out}

Tracking and marketing tools

We use various tools on our website for analysis and marketing purposes. This is done exclusively on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.

Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited. Google Tag Manager is used to manage website tags via a single interface. The tool itself does not process any personal data, but it triggers other tags which may, in turn, collect data.

Google Ads

We use Google Ads, an online advertising programme provided by Google Ireland Limited. As part of Google Ads, we use what is known as conversion tracking. When you click on an advert placed by Google, a conversion tracking cookie is set. These cookies enable us to compile statistical analyses of the use of our website and to optimise our advertising activities.

The following data, amongst others, may be processed in this context:

• Pages visited
• Click behaviour
• IP address (truncated)
• Device and browser information

The data may be transferred to Google’s servers in the USA.

Meta Pixel (Facebook Pixel)

We use the Meta Pixel from Meta Platforms Ireland Limited on our website. The Meta Pixel enables us to track the behaviour of visitors to our website after they have been redirected here by clicking on a Facebook or Instagram advert.

This enables us to:

• measure the effectiveness of Facebook and Instagram adverts
• to define target groups for future advertising campaigns (retargeting)

The following data may be processed in this context:

• Pages visited
• Interactions on the website
• Device information
• IP address

The data may also be transferred to the USA.

Withdrawal of consent

You may withdraw your consent at any time with future effect, e.g. via our cookie banner.

Social media presence

We maintain an online presence on social media platforms and, in this context, process users’ data in order to communicate with users active on these platforms or to provide information about us.

Please note that this may involve the processing of users’ data outside the European Union. This may entail risks for users, as it could, for example, make it more difficult to enforce their rights.

Furthermore, users’ data within social media platforms is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behaviour and the resulting interests. These user profiles may in turn be used, for example, to display adverts both within and outside the networks that are presumed to correspond to users’ interests. For these purposes, cookies are usually stored on users’ computers, in which their usage behaviour and interests are recorded. Furthermore, data may also be stored in the usage profiles regardless of the devices used by users (in particular, if users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the options for objecting (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

We would also like to point out that, in the case of requests for information and the exercise of data subjects’ rights, these can most effectively be exercised with the providers themselves. Only the providers have access to users’ data in each case and can take appropriate action and provide information directly. Should you nevertheless require assistance, please do not hesitate to contact us.

• Types of data processed: Master data (e.g. names, addresses), contact details (e.g. email, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: contact enquiries and communication, tracking (e.g. interest-based/behavioural profiling, use of cookies), remarketing, audience measurement (e.g. access statistics, identification of returning visitors).
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Services and service providers used:

• Instagram: social network; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.instagram.com. Privacy policy: https://instagram.com/about/legal/privacy.
• Facebook pages: Profiles within the Facebook social network; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Basis for transfers to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Further information: We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data relating to visitors to our Facebook page (known as a ‘fan page’). This data includes information on the types of content that users view or interact with, or the actions they take (see ‘Things you and others do and share’ in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see ‘Device Information’ in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under ‘How do we use this information?’ , Facebook also collects and uses information to provide analytics services, known as ‘Page Insights’, to page administrators, so that they can gain insights into how people interact with their pages and the content associated with them. We have entered into a specific agreement with Facebook (“Information on Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which specifically sets out the security measures Facebook must observe and in which Facebook has agreed to comply with data subjects’ rights (i.e. users can, for example, submit requests for information or erasure directly to Facebook). Users’ rights (in particular the rights to access, erasure, objection and to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Page Insights Information” (https://www.facebook.com/legal/terms/information_about_page_insights_data). Joint controllership is limited to the collection of and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company, Meta Platforms, Inc., in the USA.
• LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for transfers to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa); Right to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out; Further information: Together with LinkedIn Ireland Unlimited Company, we are responsible for the collection (but not the further processing) of visitors’ data for the purpose of generating ‘Page Insights’ (statistics) for our LinkedIn profiles.
  This data includes information on the types of content that users view or interact with, or the actions they take, as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data) and details from users’ profiles, such as job title, country, industry, hierarchical level, company size and employment status. Information on data protection relating to the processing of users’ data by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy
  We have entered into a specific agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum” (the ‘Addendum’), https://legal.linkedin.com/pages-joint-controller-addendum), which specifically sets out the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfil data subjects’ rights (i.e. users may, for e.g. submit requests for information or erasure directly to LinkedIn). Users’ rights (in particular the rights to access, erasure, objection and to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection of data by and its transfer to Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of Ireland Unlimited Company, in particular with regard to the transfer of data to the parent company, LinkedIn Corporation, in the USA.
• Pinterest: Social network; service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.pinterest.com. Privacy policy: https://policy.pinterest.com/de/privacy-policy.
• X: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). Privacy policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
• YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Privacy policy: https://policies.google.com/privacy; Basis for transfers to third countries: EU-US Data Privacy Framework (DPF). Right to object (opt-out): https://myadcenter.google.com/personalizationoff.
• Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.xing.com/. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plugins, embedded functions and content

We incorporate functional and content elements into our online offering which are sourced from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, social media buttons and posts (hereinafter collectively referred to as ‘content’).

This integration always requires the third-party providers of this content to process users’ IP addresses, as they would be unable to send the content to users’ browsers without them. The IP address is therefore necessary for the display of this content or these functions. We endeavour to use only such content where the respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as ‘web beacons’) for statistical or marketing purposes. These ‘pixel tags’ enable information, such as visitor traffic on the pages of this website, to be analysed. This pseudonymous information may also be stored in cookies on the user’s device and may include, amongst other things, technical information about the browser and operating system, referring websites, the time of the visit and further details regarding the use of our online service, as well as being linked to such information from other sources.

Notes on legal bases: Where we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. an interest in providing efficient, cost-effective and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Types of data processed: usage data (e.g. webpages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), contact details (e.g. email, telephone numbers), content data (e.g. text entries, photographs, videos), master data (e.g. names, addresses).
• Data subjects: Users (e.g. website visitors, users of online services), communication partners.
• Purposes of processing: Provision of our online services and user-friendliness, contractual services, contact enquiries and communication, direct marketing (e.g. by email or post), tracking (e.g. interest-based/behavioural profiling, use of cookies), interest-based and behavioural marketing, profiling (creation of user profiles), security measures, administration and responding to enquiries.
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR), consent (Article 6(1), first sentence, point (a) of the GDPR), performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR).

Services and service providers used:

• Facebook plugins and content: Facebook social plugins and content – this may include, for example, content such as images, videos or text, and buttons that allow users to share content from this website on Facebook. The list and appearance of the Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/; Service provider: https://www.facebook.com, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; opt-out option: ad settings: https://www.facebook.com/settings?tab=ads.
• Google Fonts: We incorporate fonts (“Google Fonts”) from the provider Google, whereby users’ data is used solely for the purpose of displaying the fonts in the user’s browser. This integration is based on our legitimate interests in the technically secure, maintenance-free and efficient use of fonts, their consistent display, and in taking into account any licence restrictions that may apply to their integration. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://fonts.google.com/; privacy policy: https://policies.google.com/privacy.
• Instagram plugins and content: Instagram plugins and content – this may include, for example, content such as images, videos or text, as well as buttons that allow users to share content from this website on Instagram. Service provider: https://www.instagram.com, Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
• Pinterest plugins and content: Pinterest plugins and content – This may include, for example, content such as images, videos or text, as well as buttons that allow users to share content from this website on Pinterest. Service provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Website: https://www.pinterest.com; Privacy policy: https://about.pinterest.com/de/privacy-policy.
• Twitter plugins and content: Twitter plugins and buttons – These may include, for example, content such as images, videos or text, as well as buttons that allow users to share content from this website on Twitter. Service provider: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Website: https://twitter.com/de; Privacy policy: https://twitter.com/de/privacy.
• YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of adverts: https://adssettings.google.com/authenticated.

Contact and enquiry management

When you contact us (e.g. by post, contact form, email, telephone or via social media), and in the context of existing user and business relationships, the details provided by the enquirers are processed to the extent necessary to respond to contact enquiries and any requested actions.

• Types of data processed: contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time stamps, identification numbers, consent status).
• Data subjects: Communication partners.
• Purposes of processing: Contact enquiries and communication; managing and responding to enquiries; feedback (e.g. collecting feedback via online forms); provision of our online services and user-friendliness.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Further information on processing procedures, methods and services:

• To protect our forms from automated access (spam), we use the Cloudflare Turnstile service provided by Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile verifies that the input is being made by a human, without relying on cookies or user behaviour. In doing so, your IP address may be transmitted to Cloudflare. Processing is carried out on the basis of Article 6(1)(f) of the GDPR, based on our legitimate interest in the security of our website. Further information can be found in Cloudflare’s privacy policy.
• Contact form: When users contact us via our contact form, email or other means of communication, we process the data provided to us in this context in order to deal with the enquiry submitted; Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Deletion of data

The data we process will be erased in accordance with statutory requirements as soon as the consent permitting its processing is withdrawn or other authorisations cease to apply (e.g. if the purpose for which the data is processed no longer applies or if the data is no longer necessary for that purpose).

Where the data is not deleted because it is required for other, legally permissible purposes, its processing is restricted to those purposes. This means that the data is blocked and not processed for any other purposes. This applies, for example, to data which must be retained for commercial or tax law reasons, or where its storage is necessary to assert, exercise or defend legal claims, or to protect the rights of another natural or legal person.

Further information on the erasure of personal data may also be provided in the individual data protection notices within this privacy policy.

Amendments and updates to the privacy policy

We ask you to check the content of our privacy policy regularly. We will amend this privacy policy as soon as changes to the data processing activities we carry out make this necessary. We will inform you as soon as the changes require action on your part (e.g. consent) or any other individual notification.

Where we provide addresses and contact details of companies and organisations in this privacy policy, please note that these details may change over time; we therefore ask you to check the information before making contact.

Rights of data subjects

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. Where personal data relating to you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to obtain access to this data, as well as further information and a copy of the data in accordance with statutory requirements.
• Right to rectification: In accordance with the statutory provisions, you have the right to request that data relating to you be completed or that any inaccurate data relating to you be rectified.
• Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to request that data relating to you be erased without delay or, alternatively, in accordance with the statutory provisions, to request a restriction on the processing of the data.
• Right to data portability: You have the right, in accordance with the statutory provisions, to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transferred to another data controller.
• Complaints to a supervisory authority: You also have the right, in accordance with the statutory provisions, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place where the alleged infringement occurred, if you consider that the processing of your personal data infringes the GDPR.

Definitions

This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined, in particular, in Article 4 of the GDPR. The legal definitions are binding. The explanations below, however, are primarily intended to aid understanding. The terms are listed in alphabetical order.

• Conversion tracking: ‘Conversion tracking’ refers to a method used to determine the effectiveness of marketing measures. To this end, a cookie is usually stored on users’ devices whilst they are on the websites where the marketing measures are carried out, and is then retrieved again on the target website. For example, this enables us to determine whether the adverts we have placed on other websites were successful.
• Interest-based and behavioural marketing: The term ‘interest-based and/or behavioural marketing’ is used when users’ potential interests in adverts and other content are predicted as accurately as possible. This is done on the basis of information about their previous behaviour (e.g. visiting and spending time on specific websites, purchasing behaviour or interaction with other users), which is stored in a so-called profile. Cookies are generally used for these purposes.
• Personal data: ‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Profiling: ‘Profiling’ refers to any form of automated processing of personal data consisting of the use of such personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the nature of the profiling, this includes information concerning age, gender, location data and movement data, interaction with websites and their content, purchasing behaviour, and social interactions with other people), or to predict them (e.g. interests in specific content or products, clicking behaviour on a website, or whereabouts). Cookies and web beacons are frequently used for profiling purposes.
• Audience measurement: Audience measurement (also known as web analytics) is used to analyse visitor traffic to an online service and may include the behaviour or interests of visitors in relation to specific information, such as website content. With the help of audience analysis, website owners can, for example, identify at what times visitors access their website and what content they are interested in. This enables them, for example, to better tailor the website’s content to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are frequently used to recognise returning visitors and thus obtain more accurate analyses of how an online service is used.
• Remarketing: The terms ‘remarketing’ or ‘retargeting’ are used when, for example, a user’s interest in specific products on a website is recorded for advertising purposes, so that the user can be reminded of these products on other websites, for example via adverts.
• Tracking: The term ‘tracking’ is used when users’ behaviour can be tracked across multiple online services. As a rule, information regarding behaviour and interests in relation to the online services used is stored in cookies or on the servers of the providers of the tracking technologies (so-called ‘profiling’). This information can then be used, for example, to display adverts to users that are likely to match their interests.
• Data controller: The term ‘data controller’ refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: ‘Processing’ means any operation or set of operations which is carried out on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collection, analysis, storage, transmission or erasure.

Created using the free Datenschutz-Generator.de tool by Dr Thomas Schwenke