Relevant Legal Bases
Relevant legal bases under the GDPR: Below you will find an overview of the
legal bases of the GDPR on the basis of which we process personal data. Please note that in
addition to the provisions of the GDPR, national data protection requirements may apply in your
or our country of residence or domicile. Should more specific legal bases be relevant in
individual cases, we will inform you of these in the privacy policy.
- Consent (Art. 6(1)(1)(a) GDPR) - The data subject has given consent
to the processing of the personal data concerning them for a specific purpose or several
specific purposes.
- Legitimate Interests (Art. 6(1)(1)(f) GDPR) - Processing is
necessary for the purposes of the legitimate interests pursued by the controller or by a
third party, except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject which require protection of personal data.
National data protection regulations in Germany: In addition to the data
protection regulations of the GDPR, national regulations on data protection apply in Germany.
This includes in particular the Act on Protection against the Misuse of Personal Data in Data
Processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains special
regulations on the right of access, the right to erasure, the right to object, the processing of
special categories of personal data, processing for other purposes, and transmission as well as
automated decision-making in individual cases, including profiling. Furthermore, the data
protection laws of the individual federal states may apply.
Security Measures
In accordance with the legal requirements and taking into account the state of the art, the
costs of implementation, and the nature, scope, circumstances, and purposes of the processing,
as well as the varying likelihood and severity of the threat to the rights and freedoms of
natural persons, we implement appropriate technical and organizational measures to ensure a
level of protection appropriate to the risk.
These measures include, in particular, safeguarding the confidentiality, integrity, and
availability of data by controlling physical and electronic access to the data as well as the
access, input, transfer, safeguarding of availability, and separation thereof. Furthermore, we
have established procedures that ensure the exercise of data subject rights, the deletion of
data, and responses to threats to the data. Moreover, we take the protection of personal data
into account as early as the development or selection of hardware, software, and procedures, in
accordance with the principle of data protection by design and by privacy-friendly default
settings.
Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data
of users transmitted via our online services from unauthorized access, we use TLS/SSL encryption
technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones
of secure data transmission on the Internet. These technologies encrypt the information
transmitted between the website or app and the user's browser (or between two servers), thereby
protecting the data from unauthorized access. TLS, as the more advanced and secure version of
SSL, ensures that all data transmissions meet the highest security standards. When a website is
secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This
serves as an indicator to users that their data is transmitted securely and encrypted.
Transmission of Personal Data
In the course of our processing of personal data, it may happen that such data is transmitted to
or disclosed to other bodies, companies, legally independent organizational units, or persons.
The recipients of this data may include, for example, service providers commissioned with IT
tasks or providers of services and content that are integrated into a website. In such cases, we
observe the legal requirements and, in particular, conclude corresponding contracts or
agreements that serve to protect your data with the recipients of your data.
International Data Transfers
Data processing in third countries: If we process data in a third country (i.e., outside the
European Union (EU) or the European Economic Area (EEA)), or if the processing takes place in
the context of using third-party services or the disclosure or transmission of data to other
persons, bodies, or companies, this only takes place in accordance with the legal requirements.
If the level of data protection in the third country has been recognized by means of an
adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise,
data transfers only take place if the level of data protection is otherwise ensured, in
particular through standard contractual clauses (Art. 46(2)(c) GDPR), explicit consent, or in
the case of contractually or legally required transmission (Art. 49(1) GDPR). Moreover, we
inform you of the bases of the third-country transfer for the individual providers from the
third country, whereby the adequacy decisions apply as bases with priority. Information on
third-country transfers and existing adequacy decisions can be found in the information provided
by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.
EU-US Trans-Atlantic Data Privacy Framework: Within the framework of the so-called "Data Privacy
Framework" (DPF), the EU Commission has also recognized the level of data protection as safe for
certain companies from the USA within the framework of the adequacy decision of July 10, 2023.
The list of certified companies as well as further information on the DPF can be found on the
website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in
English). We inform you within the data protection notices which of the service providers we use
are certified under the Data Privacy Framework.
Storage and Deletion of Data
We delete personal data that we process in accordance with the legal provisions as soon as the
underlying consents are revoked or there are no further legal grounds for the processing. This
concerns cases in which the original purpose of processing no longer applies or the data is no
longer needed. Exceptions to this rule exist where legal obligations or special interests
require a longer storage or archiving of the data.
In particular, data that must be retained for commercial or tax law reasons, or whose storage is
necessary for legal prosecution or to protect the rights of other natural or legal persons, must
be archived accordingly.
Our data protection notices contain additional information on the storage and deletion of data
that applies specifically to certain processing operations. In the case of several statements on
the storage period or deletion deadlines for a piece of data, the longest period is always
decisive. If a period does not expressly begin on a specific date and lasts at least one year,
it automatically starts at the end of the calendar year in which the event triggering the period
occurred.
Data that is no longer retained for its originally intended purpose but due to legal requirements
or other reasons, we process exclusively for the reasons that justify its retention.
Rights of Data Subjects
Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights
under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:
- Right to object: You have the right to object at any time, on grounds relating to
your particular situation, to the processing of personal data concerning you which is
carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling
based on these provisions. Where personal data concerning you is processed for the
purpose of direct marketing, you have the right to object at any time to the processing
of personal data concerning you for the purpose of such marketing; this also applies to
profiling insofar as it is related to such direct marketing.
- Right to withdraw consent: You have the right to withdraw consent you have
given at any time.
- Right of access: You have the right to request confirmation as to whether
data concerning you is being processed and to be informed about this data as well as to
receive further information and a copy of the data in accordance with the legal
requirements.
- Right to rectification: In accordance with the legal requirements, you have
the right to request the completion of the data concerning you or the rectification of
inaccurate data concerning you.
- Right to erasure and restriction of processing: In accordance with the
legal requirements, you have the right to demand that data concerning you be deleted without
delay, or, alternatively, to demand a restriction of the processing of the data in
accordance with the legal requirements.
- Right to data portability: You have the right to receive data concerning
you that you have provided to us, in accordance with the legal requirements, in a
structured, commonly used, and machine-readable format, or to request its transmission to
another controller.
- Complaint to a supervisory authority: Without prejudice to any other
administrative or judicial remedy, you have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of your habitual residence, place
of work, or place of the alleged infringement, if you consider that the processing of
personal data concerning you infringes the provisions of the GDPR.
Provision of the Online Offering and Web Hosting
We process the data of users in order to be able to provide them with our online services. For
this purpose, we process the user's IP address, which is necessary to transmit the content and
functions of our online services to the user's browser or device.
- Processed data types: Usage data (e.g., page views and duration of stay,
click paths, intensity and frequency of use, types of devices and operating systems used,
interactions with content and functions). Meta, communication, and procedural data (e.g., IP
addresses, time information, identification numbers, persons involved).
- Data subjects: Users (e.g., website visitors, users of online
services).
- Purposes of processing: Provision of our online offering and
user-friendliness; information technology infrastructure (operation and provision of
information systems and technical devices (computers, servers, etc.)). Security
measures.
- Legal bases: Legitimate interests (Art. 6(1)(1)(f)
GDPR).
Further notes on processing operations, procedures, and services:
- Provision of the online offering on rented storage space: For the
provision of our online offering, we use storage space, computing capacity, and software
that we rent or otherwise obtain from a corresponding server provider (also called a "web
host"); Legal bases: Legitimate interests (Art.
6(1)(1)(f) GDPR).
- Collection of access data and log files: Access to our online offering is
logged in the form of so-called "server log files." Server log files may include the address
and name of the accessed web pages and files, the date and time of access, the volume of
data transferred, notification of successful access, browser type and version, the user's
operating system, the referrer URL (the previously visited page), and usually IP addresses
and the requesting provider. The server log files can, on the one hand, be used for security
purposes, e.g., to avoid overloading the servers (especially in the case of abusive attacks,
so-called DDoS attacks), and, on the other hand, to ensure the utilization of the servers and
their stability; Legal bases: Legitimate interests (Art.
6(1)(1)(f) GDPR). Deletion of data: Log file information is
stored for a maximum period of 30 days and then deleted or anonymized. Data whose further
retention is required for evidentiary purposes is excluded from deletion until the final
clarification of the respective incident.
Use of Cookies
Cookies are small text files, or other storage notations, that store information on end devices
and read information from them. For example, to store the login status in a user account, the
contents of a shopping cart in an e-shop, the accessed content, or functions used of an online
offering. Cookies can also be used for various purposes, e.g., for the functionality, security,
and comfort of online offerings, as well as for the creation of analyses of visitor flows.
Notes on consent: We use cookies in accordance with the legal regulations.
Therefore, we obtain prior consent from users, unless it is not required by law. Consent is in
particular not required if the storage and reading of information, including cookies, is
absolutely necessary to provide users with a telemedia service (i.e., our online offering)
expressly requested by them. The revocable consent is clearly communicated to them and contains
the information on the respective use of cookies.
Notes on data protection legal bases: The data protection legal basis on which
we process the personal data of users with the help of cookies depends on whether we ask them
for consent. If users accept, the legal basis for the processing of their data is the declared
consent. Otherwise, the data processed with the help of cookies is processed on the basis of our
legitimate interests (e.g., in the economic operation of our online offering and the improvement
of its usability) or, if this takes place in the context of fulfilling our contractual
obligations, if the use of cookies is necessary to fulfill our contractual obligations. We
clarify the purposes for which we use cookies in the course of this privacy policy or in the
context of our consent and processing procedures.
Storage period: With regard to the storage period, the following types of
cookies are distinguished:
- Temporary cookies (also: session cookies): Temporary cookies are deleted
at the latest after a user has left an online offering and closed their end device (e.g.,
browser or mobile application).
- Permanent cookies: Permanent cookies remain stored even after the end
device has been closed. For example, the login status can be stored, and preferred content
can be displayed directly when the user visits a website again. Likewise, the user data
collected with the help of cookies can be used for reach measurement. Unless we provide
users with explicit information about the type and storage period of cookies (e.g., in the
course of obtaining consent), they should assume that these are permanent and that the
storage period can be up to two years.
General notes on withdrawal and objection (opt-out): Users can withdraw the
consents they have given at any time and also object to the processing in accordance with the
legal requirements, including by means of the privacy settings of their browser.
- Legal bases: Legitimate interests (Art. 6(1)(1)(f)
GDPR). Consent (Art. 6(1)(1)(a) GDPR).
Further notes on processing operations, procedures, and services:
- Processing of cookie data on the basis of consent: We use a consent
management solution in which the consent of users to the use of cookies, or to the
procedures and providers named within the consent management solution, is obtained. This
procedure serves to obtain, log, manage, and withdraw consents, in particular relating to
the use of cookies and comparable technologies that are used to store, read, and process
information on the end devices of users. In the context of this procedure, the consents of
users for the use of cookies and the associated processing of information, including the
specific processing and providers named in the consent management procedure, are obtained.
Users also have the option of managing and withdrawing their consents. The declarations of
consent are stored in order to avoid a repeated query and to be able to provide proof of
consent in accordance with the legal requirements. Storage takes place server-side and/or in
a cookie (so-called opt-in cookie) or by means of comparable technologies in order to be
able to assign the consent to a specific user or their device. If no specific information is
available on the providers of consent management services, the following general notes
apply: The duration of the storage of the consent is up to two years. A pseudonymous user
identifier is created, which is stored together with the time of consent, the details of the
scope of the consent (e.g., relevant categories of cookies and/or service providers), as
well as information about the browser, the system, and the end device used; Legal bases: Consent (Art. 6(1)(1)(a)
GDPR).
Newsletter and Electronic Notifications
We send newsletters, emails, and other electronic notifications (hereinafter "newsletter") only
with the consent of the recipients or on the basis of a legal permission. Insofar as the
contents of a newsletter are specifically described within the scope of a registration for the
newsletter, they are decisive for the consent of the users. For registration for our newsletter,
the provision of your email address is normally sufficient. However, in order to be able to
offer you a personalized service, we may ask you to provide your name for personal addressing in
the newsletter, or for further information, if this is necessary for the purpose of the
newsletter.
Deletion and restriction of processing: We may store the unsubscribed email addresses for up to
three years on the basis of our legitimate interests before deleting them, in order to be able
to prove a formerly given consent. The processing of this data is limited to the purpose of a
potential defense against claims. An individual request for deletion is possible at any time,
provided that the former existence of a consent is confirmed at the same time. In the case of
obligations to permanently observe objections, we reserve the right to store the email address
solely for this purpose in a blocklist.
The logging of the registration procedure takes place on the basis of our legitimate interests
for the purpose of proving its proper conduct. Insofar as we commission a service provider with
the sending of emails, this takes place on the basis of our legitimate interests in an efficient
and secure dispatch system.
Contents:
Information about us, our services, and new functions of our app.
- Processed data types: Inventory data (e.g., full name, residential
address, contact information, customer number, etc.); contact data (e.g., postal and email
addresses or telephone numbers); meta, communication, and procedural data (e.g., IP
addresses, time information, identification numbers, persons involved). Usage data (e.g.,
page views and duration of stay, click paths, intensity and frequency of use, types of
devices and operating systems used, interactions with content and functions).
- Data subjects: Communication partners.
- Purposes of processing: Direct marketing (e.g., by email or
post).
- Legal bases: Consent (Art. 6(1)(1)(a) GDPR).
- Option to object (opt-out): You can cancel the receipt of our newsletter at
any time, i.e., withdraw your consents or object to further receipt. You will find a link to
cancel the newsletter either at the end of each newsletter, or you can otherwise use one of
the contact options given above, preferably email, for this purpose.
Further notes on processing operations, procedures, and services:
- Measurement of open and click rates: The newsletters contain a so-called
"web beacon," i.e., a pixel-sized file that is retrieved from our server, or, if we use a
dispatch service provider, from its server, when the newsletter is opened. In the course of
this retrieval, technical information is initially collected, such as information about the
browser and your system, as well as your IP address and the time of retrieval. This
information is used for the technical improvement of our newsletter on the basis of the
technical data or the target groups and their reading behavior on the basis of their
retrieval locations (which can be determined with the help of the IP address) or the access
times. This analysis also includes determining whether and when the newsletters are opened
and which links are clicked. The information is assigned to the individual newsletter
recipients and stored in their profiles until deletion. The evaluations serve to recognize
the reading habits of our users and to adapt our content to them or to send different content
according to the interests of our users. The measurement of the open and click rates as well
as the storage of the measurement results in the profiles of the users. Legal bases: Consent (Art. 6(1)(1)(a)
GDPR).
Web Analysis, Monitoring, and Optimization
Web analysis (also referred to as "reach measurement") serves to evaluate the visitor flows of
our online offering and may include behavior, interests, or demographic information about the
visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can,
for example, recognize at what time our online offering or its functions or contents are used
most frequently, or invite reuse. Likewise, it is possible for us to comprehend which areas
require optimization.
In addition to web analysis, we can also use test procedures, e.g., to test and optimize
different versions of our online offering or its components.
Unless otherwise stated below, profiles, i.e., data summarized for a usage process, may be
created for these purposes and information may be stored in a browser or in an end device and
then read out. The information collected includes, in particular, visited websites and the
elements used there, as well as technical information such as the browser used, the computer
system used, and information on usage times. If users have consented to the collection of their
location data vis-à-vis us or vis-à-vis the providers of the services we use, the processing of
location data is also possible.
In addition, the IP addresses of the users are stored. However, we use an IP masking procedure
(i.e., pseudonymization by shortening the IP address) to protect the users. In general, no clear
data of the users (such as email addresses or names) is stored in the context of web analysis,
A/B testing, and optimization, but rather pseudonyms. This means that we, as well as the
providers of the software used, do not know the actual identity of the users, but only the
information stored in their profiles for the purpose of the respective procedures.
Notes on legal bases: Insofar as we ask the users for their consent to the use
of third-party providers, the legal basis for the data processing is consent. Otherwise, the
user data is processed on the basis of our legitimate interests (i.e., interest in efficient,
economical, and recipient-friendly services). In this context, we would also like to refer you
to the information on the use of cookies in this privacy policy.
- Processed data types: Usage data (e.g., page views and duration of stay,
click paths, intensity and frequency of use, types of devices and operating systems used,
interactions with content and functions). Meta, communication, and procedural data (e.g., IP
addresses, time information, identification numbers, persons involved).
- Data subjects: Users (e.g., website visitors, users of online
services).
- Purposes of processing: Reach measurement (e.g., access statistics,
recognition of returning visitors); profiles with user-related information (creation of user
profiles). Provision of our online offering and user-friendliness.
- Security measures: IP masking (pseudonymization of the IP address).
- Legal bases: Consent (Art. 6(1)(1)(a) GDPR).
Further notes on processing operations, procedures, and services:
- Google Analytics: We use Google Analytics to measure and analyze the use of
our online offering on the basis of a pseudonymous user identification number. This
identification number does not contain any unique data, such as names or email addresses. It
serves to assign analysis information to an end device in order to recognize which content
the users have accessed within one or several usage processes, which search terms they have
used, which they have accessed again, or with which they have interacted within our online
offering. Likewise, the time of use and its duration are stored, as well as the sources of
the users who refer to our online offering and technical aspects of their end devices and
browsers.
In doing so, pseudonymous profiles of users are created with information from
the use of various devices, whereby cookies can be used. Google Analytics does not log and
store any individual IP addresses for EU users. However, Analytics provides rough geographic
location data by deriving the following metadata from IP addresses: city (and the derived
latitude and longitude of the city), continent, country, region, subcontinent (and ID-based
counterparts). For EU traffic, the IP address data is used exclusively for this derivation of
geolocation data before it is immediately deleted. It is not logged, is not accessible, and
is not used for further purposes. When Google Analytics collects measurement data, all IP
queries are carried out on EU-based servers before the traffic is forwarded to Analytics
servers for processing; Service provider: Google Ireland Limited, Gordon
House, Barrow Street, Dublin 4, Ireland;
Legal bases: Consent (Art. 6(1)(1)(a)
GDPR);
Website: https://marketingplatform.google.com/intl/de/about/analytics/;
Security measures: IP masking (pseudonymization of the IP address);
Privacy policy: https://policies.google.com/privacy;
Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for
third-country transfers: Data Privacy Framework (DPF);
Option to object
(opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the
display of advertising: https://myadcenter.google.com/personalizationoff. Further
information: https://business.safety.google/adsservices/ (types of processing as
well as the processed data).
Privacy Policy for the Chat Function
In our mobile app, we offer a chat function that enables users to communicate with each other in
real time. In the context of this service, we collect and process various data in order to
ensure smooth and secure use.
- Processed data types:
- Content data (sent messages, chat histories, and media files such as images,
videos)
- Usage data (information about the use of the chat, such as timestamps of the
messages, frequency of use, and interactions within the chat)
- Meta, communication, and procedural data (IP addresses, device information such as
model, operating system, and identification numbers)
- Data subjects: Users of the chat function.
- Purposes of processing:
- Provision and optimization of the chat service
- Enabling communication between users
- Taking security measures to protect the integrity and confidentiality of the chat
conversations
- Security measures: Encryption of the communication in the chat; IP masking
(pseudonymization of the IP address); use of appropriate technical and organizational
security measures.
- Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests in the
provision of a functional and secure chat service (Art. 6(1)(f) GDPR).
Further notes on processing operations, procedures, and services:
- Data sharing and storage: We do not pass on any personal data to third
parties unless this is necessary for the fulfillment of our service or we are legally obliged
to do so. The chat histories are stored for the duration of use and are automatically deleted
after deactivation of the chat service.
- User rights: Users have the right to request information about the data
stored about them, to rectify it, or to delete it. In addition, they have the right to
object to the processing of their data and to withdraw their consent to the data processing
at any time. To exercise these rights, users can contact us.
Live Pin and Location Determination
The app offers a "Live Pin" function, with which users can voluntarily share their current
location on a map with other users. Location sharing is deactivated by default.
- Processed data types: Location data (GPS coordinates).
- Data subjects: Users who actively use the Live Pin function.
- Purposes of processing: Provision of the location-based Live Pin function
for the local networking of users; display of the location on a map of the surrounding
area.
- Functionality and privacy: The transmission of the location takes place
exclusively when the user manually checks in and places a Live Pin. There are no automatic
check-in functions in the background. When placing the pin, users can select the visibility
(e.g., "Public" or "Friends only"). A pin set by the user is visible for a limited time and
can be manually deleted early by the user at any time. Users have the option of blocking
other users in order to hide their Live Pins.
- Withdrawal: Users can deactivate the permission for location determination
(Location Services) at any time in the device settings of their operating system
(iOS/Android). The app can also be used without granting this permission; however,
location-based functions such as the Live Pin are then not available.
- Legal bases: Consent to location determination and publication on the map
in accordance with (Art. 6(1)(1)(a) GDPR).
Presence in Social Networks (Social Media)
We maintain online presences within social networks and, in this context, process user data in
order to communicate with the users active there or to offer information about us.
We would like to point out that user data may be processed outside the area of the European Union
in the process. This may result in risks for the users because, for example, the enforcement of
the users' rights could be made more difficult.
Furthermore, the data of users within social networks is generally processed for market research
and advertising purposes. For example, usage profiles can be created on the basis of the usage
behavior and the resulting interests of the users. The latter may in turn be used, for example,
to place advertisements within and outside the networks that presumably correspond to the
interests of the users. For this reason, cookies are generally stored on the computers of the
users, in which the usage behavior and the interests of the users are stored. In addition, data
can also be stored in the usage profiles independently of the devices used by the users (in
particular if they are members of the respective platforms and logged in there).
For a detailed presentation of the respective forms of processing and the options to object
(opt-out), we refer to the privacy policies and information of the operators of the respective
networks.
Also in the case of requests for information and the assertion of data subject rights, we would
like to point out that these can be asserted most effectively with the providers. Only the
latter have access to the users' data in each case and can directly take appropriate measures and
provide information. If you should nevertheless require assistance, then you can contact us.
- Processed data types: Contact data (e.g., postal and email addresses or
telephone numbers); content data (e.g., textual or pictorial messages and contributions as
well as the information concerning them, such as details of authorship or the time of
creation); usage data (e.g., page views and duration of stay, click paths, intensity and
frequency of use, types of devices and operating systems used, interactions with content and
functions). Meta, communication, and procedural data (e.g., IP addresses, time information,
identification numbers, persons involved).
- Data subjects: Users (e.g., website visitors, users of online
services).
- Purposes of processing: Contact requests and communication; feedback (e.g.,
collecting feedback via online form). Marketing.
- Legal bases: Legitimate interests (Art. 6(1)(1)(f)
GDPR).
Further notes on processing operations, procedures, and services:
- Instagram: Social network; Service provider: Meta
Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6(1)(1)(f)
GDPR); Website: https://www.instagram.com;
Privacy policy: https://instagram.com/about/legal/privacy. Basis for
third-country transfers: Data Privacy Framework (DPF).
- TikTok: Social network / video platform;
Service provider: TikTok Technology
Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies
UK Limited,
Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Legal bases: Legitimate interests (Art. 6(1)(1)(f)
GDPR);
Website: https://www.tiktok.com.
Privacy policy: https://www.tiktok.com/de/privacy-policy.
- YouTube: Social network and video platform;
Service provider: Google Ireland
Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases:
Legitimate interests (Art. 6(1)(1)(f) GDPR);
Privacy policy: https://policies.google.com/privacy;
Basis for third-country transfers: Data Privacy Framework (DPF).
Option to object
(opt-out): https://myadcenter.google.com/personalizationoff.
Plug-ins and Embedded Functions as well as Content
We integrate functional and content elements into our online offering that are obtained from the
servers of their respective providers (hereinafter referred to as "third-party providers").
These may, for example, be graphics, videos, or city maps (hereinafter uniformly referred to as
"content").
The integration always presupposes that the third-party providers of this content process the IP
address of the users, since without the IP address they could not send the content to their
browser. The IP address is thus required for the display of this content or functions. We
endeavor to use only such content whose respective providers use the IP address solely for the
delivery of the content. Third-party providers may furthermore use so-called pixel tags
(invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. By
means of the "pixel tags," information such as visitor traffic on the pages of this website can
be evaluated. The pseudonymous information may furthermore be stored in cookies on the user's
device and may contain, among other things, technical information about the browser and operating
system, referring websites, the time of the visit, as well as further information on the use of
our online offering, but may also be linked with such information from other sources.
Notes on legal bases: Insofar as we ask the users for their consent to the use
of the third-party providers, the legal basis for the data processing is permission. Otherwise,
the user data is processed on the basis of our legitimate interests (i.e., interest in efficient,
economical, and recipient-friendly services). In this context, we would also like to refer you
to the information on the use of cookies in this privacy policy.
- Processed data types: Usage data (e.g., page views and duration of stay,
click paths, intensity and frequency of use, types of devices and operating systems used,
interactions with content and functions); meta, communication, and procedural data (e.g., IP
addresses, time information, identification numbers, persons involved); inventory data (e.g.,
full name, residential address, contact information, customer number, etc.); contact data
(e.g., postal and email addresses or telephone numbers). Content data (e.g., textual or
pictorial messages and contributions as well as the information concerning them, such as
details of authorship or the time of creation).
- Data subjects: Users (e.g., website visitors, users of online
services).
- Purposes of processing: Provision of our online offering and
user-friendliness; marketing. Profiles with user-related information (creation of user
profiles).
- Legal bases: Consent (Art. 6(1)(1)(a) GDPR).
Legitimate interests (Art. 6(1)(1)(f) GDPR).
Further notes on processing operations, procedures, and services:
- Google Fonts (obtained from the Google server): Obtaining of fonts (and
symbols) for the purpose of a technically secure, maintenance-free, and efficient use of
fonts and symbols with regard to topicality and loading times, their uniform display, and
consideration of possible licensing restrictions. The provider of the fonts is informed of
the IP address of the user so that the fonts can be made available in the user's browser. In
addition, technical data (language settings, screen resolution, operating system, hardware
used) is transmitted, which is necessary for the provision of the fonts depending on the
devices used and the technical environment. This data may be processed on a server of the
provider of the fonts in the USA - When visiting our online offering, the users' browsers
send their browser HTTP requests to the Google Fonts Web API (i.e., a software interface for
retrieving the fonts). The Google Fonts Web API provides the users with the Cascading Style
Sheets (CSS) of Google Fonts and then the fonts specified in the CSS. These HTTP requests
include (1) the IP address used by the respective user to access the Internet, (2) the
requested URL on the Google server, and (3) the HTTP headers, including the user agent, which
describes the browser and operating system versions of the website visitors, as well as the
referring URL (i.e., the web page on which the Google font is to be displayed). IP addresses
are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts
Web API logs details of the HTTP requests (requested URL, user agent, and referring URL).
Access to this data is restricted and strictly controlled. The requested URL identifies the
font families for which the user wants to load fonts. This data is logged so that Google can
determine how often a particular font family is requested. With the Google Fonts Web API, the
user agent must adapt the font that is generated for the respective browser type. The user
agent is primarily logged for debugging and used to generate aggregated usage statistics with
which the popularity of font families is measured. These aggregated usage statistics are
published on the "Analytics" page of Google Fonts. Finally, the referring URL is logged so
that the data can be used for the maintenance of production and an aggregated report on the
top integrations based on the number of font requests can be generated. According to its own
information, Google does not use any of the information collected by Google Fonts to create
profiles of end users or to display targeted ads;
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin
4, Ireland; Legal bases: Legitimate interests (Art.
6(1)(1)(f) GDPR);
Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy;
Basis for third-country transfers: Data Privacy Framework (DPF).
Further
information: https://developers.google.com/fonts/faq/privacy?hl=de.
- Instagram plug-ins and content: Instagram plug-ins and content - This may
include, for example, content such as
images, videos, or texts and buttons with which users can share content of this online
offering
within Instagram. - Together with Meta Platforms Ireland Limited, we are jointly responsible
for the collection
or receipt in the context of a transmission (but not the further processing) of
"event data" that
Facebook collects by means of functions of Instagram (e.g., embedding functions for content)
that are executed on our
online offering, or receives in the context of a transmission, for the following
purposes: a) Display of content as well as advertising information that corresponds to the
presumed interests of the users; b) Delivery of commercial and transaction-related messages
(e.g., addressing users via
Facebook Messenger); c) Improvement of the delivery of ads and personalization of
functions and content
(e.g., improvement of the recognition of which content or advertising information presumably
corresponds to the
interests of the users). We have concluded a special agreement with Facebook ("Controller
Addendum," https://www.facebook.com/legal/controller_addendum), in which it is
regulated in particular
which security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in
which Facebook has
agreed to fulfill the data subject rights (i.e., users can, for example, direct requests for
information or deletion
directly to Facebook). Note: If Facebook provides us with measurements, analyses, and reports
(which are
aggregated, i.e., do not contain any information on individual users and are anonymous to
us), then this
processing does not take place within the framework of the joint responsibility, but on the
basis of a
data processing agreement ("Data Processing Terms," https://www.facebook.com/legal/terms/dataprocessing), the
"Data Security Terms"
(https://www.facebook.com/legal/terms/data_security_terms), as well as,
with regard to the
processing in the USA, on the basis of standard contractual clauses ("Facebook EU Data
Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). The rights
of the users
(in particular to information, deletion, objection, and complaint to the competent
supervisory authority) are not restricted by
the agreements with Facebook; Service provider: Meta
Platforms Ireland
Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate
interests (Art. 6(1)(1)(f) GDPR); Website: https://www.instagram.com.
Privacy policy: https://instagram.com/about/legal/privacy/.
- YouTube videos: Video content; Service provider: Google
Ireland Limited, Gordon
House, Barrow Street, Dublin 4, Ireland; Legal bases:
Consent (Art. 6(1)(1)(a) GDPR); Website: https://www.youtube.com;
Privacy policy: https://policies.google.com/privacy;
Basis for third-country transfers: Data Privacy Framework (DPF).
Option to object
(opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the
display of advertising: https://myadcenter.google.com/personalizationoff.
Change and Update of the Privacy Policy
We ask you to inform yourself regularly about the content of our privacy policy. We adapt the
privacy policy as soon as changes in the data processing carried out by us make this necessary.
We will inform you as soon as the changes require an act of cooperation on your part (e.g.,
consent) or another individual notification.
Insofar as we provide addresses and contact information of companies and organizations in this
privacy policy, we ask you to note that the addresses may change over time and ask you to check
the information before contacting them.
Definitions of Terms
In this section, you will find an overview of the terms used in this privacy policy. Insofar as
the terms are legally defined, their legal definitions apply. The following explanations, on the
other hand, are intended primarily to aid understanding.
- Inventory data: Inventory data comprises essential information necessary for
the identification and management of contractual partners, user accounts, profiles, and
similar assignments. This data may include, among other things, personal and demographic
information such as names, contact information (addresses, telephone numbers, email
addresses), dates of birth, and specific identifiers (user IDs). Inventory data forms the
basis for any formal interaction between persons and services, institutions, or systems by
enabling a clear assignment and communication.
- Content data: Content data comprises information that is generated in the
course of the creation, editing, and publication of content of all kinds. This category of
data may include texts, images, videos, audio files, and other multimedia content that is
published on various platforms and media. Content data is not limited to the actual content,
but also includes metadata that provides information about the content itself, such as tags,
descriptions, author information, and publication dates.
- Contact data: Contact data is essential information that enables
communication with persons or organizations. It comprises, among other things, telephone
numbers, postal addresses, and email addresses, as well as means of communication such as
social media handles and instant messaging identifiers.
- Meta, communication, and procedural data: Meta, communication, and
procedural data are categories that contain information about the manner in which data is
processed, transmitted, and managed. Metadata, also known as data about data, comprises
information that describes the context, the origin, and the structure of other data. It may
include details on the file size, the creation date, the author of a document, and the
revision histories. Communication data captures the exchange of information between users
via various channels, such as email traffic, call logs, messages in social networks, and
chat histories, including the persons involved, timestamps, and transmission paths.
Procedural data describes the processes and sequences within systems or organizations,
including workflow documentation, logs of transactions and activities, as well as audit logs
that are used for the tracking and verification of operations.
- Usage data: Usage data refers to information that captures how users
interact with digital products, services, or platforms. This data comprises a wide range of
information that shows how users use applications, which functions they prefer, how long they
stay on certain pages, and via which paths they navigate through an application. Usage data
may also include the frequency of use, timestamps of activities, IP addresses, device
information, and location data. It is particularly valuable for the analysis of user
behavior, the optimization of user experiences, the personalization of content, and the
improvement of products or services. Furthermore, usage data plays a decisive role in the
recognition of trends, preferences, and possible problem areas within digital offerings.
- Personal data: "Personal data" means any information relating to an
identified or identifiable natural person (hereinafter "data subject"); an identifiable
natural person is one who can be identified, directly or indirectly, in particular by
reference to an identifier such as a name, an identification number, location data, an online
identifier (e.g., cookie), or to one or more special characteristics that are an expression
of the physical, physiological, genetic, psychological, economic, cultural, or social
identity of that natural person.
- Profiles with user-related information: The processing of "profiles with
user-related information," or "profiles" for short, comprises any type of automated
processing of personal data consisting in the use of this personal data to analyze,
evaluate, or predict certain personal aspects relating to a natural person (depending on the
type of profiling, this may include different information regarding demographics, behavior,
and interests, such as interaction with websites and their content, etc.) (e.g., the
interests in certain content or products, the click behavior on a website, or the location).
Cookies and web beacons are frequently used for the purposes of profiling.
- Reach measurement: Reach measurement (also referred to as web analytics)
serves to evaluate the visitor flows of an online offering and may include the behavior or
interests of the visitors in certain information, such as content of web pages. With the help
of reach analysis, operators of online offerings can, for example, recognize at what time
users visit their web pages and which content they are interested in. This enables them, for
example, to better adapt the content of the web pages to the needs of their visitors. For the
purposes of reach analysis, pseudonymous cookies and web beacons are frequently used in order
to recognize returning visitors and thus to obtain more precise analyses on the use of an
online offering.
- Controller: The "controller" is the natural or legal person, public
authority, agency, or other body which, alone or jointly with others, determines the purposes
and means of the processing of personal data.
- Processing: "Processing" is any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not by automated means.
The term is broad and covers practically any handling of data, be it the collection, the
evaluation, the storage, the transmission, or the deletion.