Privacy policy

Introduction and overview

We have written this privacy policy (version 30.10.2023-112663248) to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we as the controller – and the processors commissioned by us (e.g. providers) – process, will process in the future and what legal options you have. The terms used are to be understood as gender-neutral.
In short: We inform you comprehensively about the data we process about you.

Privacy policies usually sound very technical and use legal jargon. This privacy policy, on the other hand, is intended to describe the most important things to you as simply and transparently as possible. Where it helps transparency, technical Terms explained in plain language, links to further information are provided and graphics are used. In this way, we inform you in clear and simple language that we only process personal data in the course of our business activities if there is a corresponding legal basis. This is certainly not possible with the shortest possible, unclear and legal-technical explanations that are often standard on the internet when it comes to data protection. I hope you find the following explanations interesting and informative and perhaps there is some information you did not know yet.
If you still have questions, we would like to ask you to contact the responsible office named below or in the imprint, follow the links provided and look at further information on third-party sites. You can of course also find our contact details in the imprint.

Scope

This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (processors). By personal data we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person's name, email address and postal address. The processing of personal data enables us to offer and invoice our services and products, whether online or offline. The scope of this privacy policy includes:

• all online presences (websites, online shops) that we operate
• social media presences and email communication
• mobile apps for smartphones and other devices

In short: This privacy policy applies to all areas in which personal data is processed in a structured manner within the company via the channels mentioned. Should we enter into legal relations with you outside these channels, we will inform you separately if necessary.

Legal bases

In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e. the legal bases of the General Data Protection Regulation, that allow us to process personal data.
As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can of course read this EU General Data Protection Regulation online on EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679 read it.

We only process your data if at least one of the following conditions applies:

1. Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be storing the data you entered in a contact form.
2. Contract (Article 6(1)(b) GDPR): We process your data in order to fulfil a contract or pre-contractual obligations with you. For example, if we conclude a purchase contract with you, we need personal information in advance.
3. Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally obliged to keep invoices for accounting purposes. These usually contain personal data.
4. Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Other conditions such as the performance of tasks in the public interest and the exercise of official authority as well as the protection of vital interests do not usually apply to us. If such a legal basis should be relevant, it will be indicated at the appropriate point.

In addition to the EU regulation, national laws also apply:

• In Austria this is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), in short DSG.
• In Germany the following applies: Federal Data Protection Act, in short BDSG.

If other regional or national laws apply, we will inform you about them in the following sections.

Contact details of the controller

If you have any questions about data protection or the processing of personal data, you will find the contact details of the responsible person or office below:
MaricaCouture dress rental
Meyra-Ring 3, 32689 Kalletal, Germany

Email info@maricacouture.com
Imprint: https://maricacouture.com/en/impressum/

Storage period

As a general criterion, we only store personal data for as long as is absolutely necessary to provide our services and products. This means that we delete personal data as soon as the reason for the data processing no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose no longer applies, for example for accounting purposes.

If you wish your data to be deleted or revoke your consent to data processing, the data will be deleted as quickly as possible, provided there is no obligation to store it.

We will inform you below about the specific duration of the respective data processing, provided we have further information on this.

Rights under the General Data Protection Regulation

In accordance with Articles 13 and 14 GDPR, we inform you of the following rights to which you are entitled to ensure fair and transparent processing of data:

• According to Article 15 GDPR, you have the right to information as to whether we are processing your data. If this is the case, you have the right to receive a copy of the data and to know the following information:
  • the purpose for which we carry out the processing;
  • the categories, i.e. the types of data that are processed;
  • who receives this data and, if the data is transferred to third countries, how security can be guaranteed;
  • how long the data will be stored;
  • the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
  • that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
  • the origin of the data if we did not collect it from you;
  • whether profiling is carried out, i.e. whether data is automatically evaluated to create a personal profile of you.
• According to Article 16 GDPR, you have the right to rectification of data, which means that we must correct data if you find errors.
• According to Article 17 GDPR, you have the right to erasure (“right to be forgotten”), which specifically means that you may request the deletion of your data.
• According to Article 18 GDPR, you have the right to restriction of processing, which means that we may only store the data but not use it any further.
• According to Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data in a common format on request.
• According to Article 21 GDPR, you have a right to object which, once enforced, entails a change in processing.
  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then check as quickly as possible whether we can legally comply with this objection.
  • If data is used for direct marketing, you can object to this type of data processing at any time. We may then no longer use your data for direct marketing.
  • If data is used for profiling, you can object to this type of data processing at any time. We may then no longer use your data for profiling.
• According to Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example profiling).
• According to Article 77 GDPR, you have the right to lodge a complaint. This means you can complain to the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short: You have rights – don't hesitate to contact the responsible office listed above!

If you believe that the processing of your data violates data protection law or that your data protection rights have been infringed in any other way, you can lodge a complaint with the supervisory authority. For Austria, this is the data protection authority, whose website you can find at https://www.dsb.gv.at/ . In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI) . The following local data protection authority is responsible for our company:

Data transfer to third countries

We only transfer or process data in countries outside the scope of the GDPR (third countries) if you consent to this processing or there is another legal permission. This applies in particular if the processing is required by law or necessary to fulfil a contractual relationship, and in any case only to the extent that this is generally permitted. In most cases, your consent is the most important reason for us to have data processed in third countries. The processing of personal data in third countries such as the USA, where many software manufacturers offer services and have their server locations, can mean that personal data is processed and stored in unexpected ways.

We expressly point out that, according to the European Court of Justice, there is currently only an adequate level of protection for data transfers to the USA if a US company that processes personal data of EU citizens in the USA is an active participant in the EU-US Data Privacy Framework. You can find more information on this at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Data processing by US services that are not active participants in the EU-US Data Privacy Framework may result in data not being processed and stored anonymously. Furthermore, US government authorities may be able to access individual data. It may also happen that collected data is linked to data from other services of the same provider if you have a corresponding user account. Where possible, we try to use server locations within the EU if this is offered.
We will inform you in more detail about data transfers to third countries at the appropriate points in this privacy policy, if applicable.

Security of data processing

To protect personal data, we have implemented both technical and organisational measures. Where possible, we encrypt or pseudonymise personal data. In this way, within the scope of our possibilities, we make it as difficult as possible for third parties to infer personal information from our data.

Art. 25 GDPR speaks here of “data protection by design and by default” and means that security should always be considered for both software (e.g. forms) and hardware (e.g. access to the server room) and appropriate measures taken. Below, we go into specific measures where necessary.

TLS encryption with https

TLS, encryption and https sound very technical, and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transfer data securely over the internet.
This means that the complete transfer of all data from your browser to our web server is secured – no one can “listen in”.

In doing so, we have introduced an additional layer of security and fulfil data protection by design (Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transfer on the internet, we can ensure the protection of confidential data.
You can recognise the use of this secured data transfer by the small lock symbol  at the top left of the browser, to the left of the web address (e.g. examplepage.com), and by the use of the https scheme (instead of http) as part of our web address.
If you would like to know more about encryption, we recommend searching Google for “Hypertext Transfer Protocol Secure wiki” to find good links to further information.

Communication

Communication summary 👥 Data subjects: everyone who communicates with us by phone, email or online form 📓 Data processed: e.g. phone number, name, email address, form data entered. You can find more details under the respective type of contact used 🤝 Purpose: handling communication with customers, business partners, etc. 📅 Storage period: duration of the business case and statutory requirements ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interests)

If you contact us and communicate by phone, email or online form, personal data may be processed.

The data is processed to handle and deal with your question and the related business transaction. The data is stored for as long as this takes or as long as the law requires.

Data subjects

The processes mentioned affect everyone who contacts us via the communication channels we provide.

Phone

If you call us, the call data is stored pseudonymously on the respective device and with the telecommunications provider used. In addition, data such as name and phone number may subsequently be sent by email and stored to answer the enquiry. The data is deleted as soon as the business case has been completed and legal requirements permit.

Email

If you communicate with us by email, data may be stored on the respective device (computer, laptop, smartphone, …) and data is stored on the email server. The data is deleted as soon as the business case has been completed and legal requirements permit.

Online forms

If you communicate with us via an online form, data is stored on our web server and, if necessary, forwarded to one of our email addresses. The data is deleted as soon as the business case has been completed and legal requirements permit.

Legal bases

The processing of the data is based on the following legal bases:

• Art. 6(1)(a) GDPR (consent): you give us your consent to store your data and continue to use it for purposes relating to the business case;
• Art. 6(1)(b) GDPR (contract): it is necessary for the performance of a contract with you or a processor such as the telephone provider, or we need to process the data for pre-contractual activities, such as preparing an offer;
• Art. 6(1)(f) GDPR (legitimate interests): we want to handle customer enquiries and business communication in a professional manner. For this, certain technical facilities such as email programs, Exchange servers and mobile network operators are necessary in order to communicate efficiently.

Cookies

Cookies summary 👥 Data subjects: website visitors 🤝 Purpose: depends on the respective cookie. You can find more details below or from the manufacturer of the software that sets the cookie. 📓 Data processed: depends on the cookie used. You can find more details below or from the manufacturer of the software that sets the cookie. 📅 Storage period: depends on the respective cookie, can vary from hours to years ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are cookies?

Our website uses HTTP cookies to store user-specific data.
Below we explain what cookies are and why they are used so that you can better understand the following privacy policy.

Whenever you surf the internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing cannot be denied: cookies are really useful little helpers. Almost all websites use cookies. More precisely, they are HTTP cookies, as there are also other cookies for other applications. HTTP cookies are small files that are stored on your computer by our website. These cookie files are automatically placed in the cookie folder, effectively the “brain” of your browser. A cookie consists of a name and a value. When a cookie is defined, one or more attributes must also be specified.

Cookies store certain user data, such as language or personal page settings. When you visit our site again, your browser transmits the “user-related” information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to. In some browsers each cookie has its own file, in others, such as Firefox, all cookies are stored in a single file.

The following graphic shows a possible interaction between a web browser such as Chrome and the web server. The web browser requests a website and receives a cookie back from the server, which the browser uses again as soon as another page is requested.

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, third-party cookies are created by partner websites (e.g. Google Analytics). Each cookie must be assessed individually, as each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, Trojans or other “pests”. Cookies also cannot access information on your PC.

This is what cookie data can look like, for example:

Name: _ga
Value: GA1.2.1326744211.152112663248-9
Purpose: Distinguishing website visitors
Expiry date: after 2 years

A browser should be able to support these minimum sizes:

• At least 4096 bytes per cookie
• At least 50 cookies per domain
• At least 3000 cookies in total

What types of cookies are there?

The question of which cookies we use in particular depends on the services used and is explained in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.

There are 4 types of cookies:

Essential cookies
These cookies are necessary to ensure the basic functions of the website. For example, these cookies are needed when a user puts a product in the shopping cart, then continues surfing on other pages and only goes to the checkout later. These cookies ensure that the shopping cart is not deleted, even if the user closes their browser window.

Functional cookies
These cookies collect information about user behaviour and whether the user receives any error messages. In addition, these cookies also measure the loading time and behaviour of the website in different browsers.

Target-oriented cookies
These cookies ensure better user-friendliness. For example, entered locations, font sizes or form data are stored.

Advertising cookies
These cookies are also called targeting cookies. They are used to deliver individually tailored advertising to the user. This can be very practical, but also very annoying.

You are usually asked which of these types of cookies you want to allow the first time you visit a website. And of course this decision is also stored in a cookie.

If you want to know more about cookies and are not afraid of technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments of the Internet Engineering Task Force (IETF) called “HTTP State Management Mechanism”.

Purpose of processing via cookies

The purpose ultimately depends on the respective cookie. You can find more details below or from the manufacturer of the software that sets the cookie.

What data is processed?

Cookies are little helpers for many different tasks. Unfortunately, it is not possible to generalise which data is stored in cookies, but we will inform you about the data processed or stored in the following privacy policy.

Storage period of cookies

The storage period depends on the respective cookie and is specified further below. Some cookies are deleted after less than an hour, others can remain stored on a computer for several years.

You also have an influence on the storage period yourself. You can delete all cookies manually at any time via your browser (see also “Right to object” below). Furthermore, cookies based on consent are deleted at the latest after you revoke your consent, whereby the lawfulness of storage up to that point remains unaffected.

Right to object – how can I delete cookies?

You decide for yourself how and whether you want to use cookies. Regardless of which service or website the cookies come from, you always have the option of deleting, deactivating or only partially allowing cookies. For example, you can block third-party cookies but allow all other cookies.

If you want to find out which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings:

Chrome: Delete, enable and manage cookies in Chrome

Safari: Manage cookies and website data with Safari

Firefox: Clear cookies to remove data that websites have stored on your computer

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete and manage cookies

If you generally do not want cookies, you can set up your browser so that it always informs you when a cookie is to be set. This allows you to decide for each individual cookie whether or not to allow it. The procedure varies depending on the browser. It is best to search for the instructions in Google with the search term “delete cookies Chrome” or “disable cookies Chrome” in the case of a Chrome browser.

Legal basis

The so-called “Cookie Directive” has existed since 2009. It states that storing cookies requires your Consent (Article 6(1)(a) GDPR). Within the EU countries, however, there are still very different reactions to this directive. In Austria, the directive was implemented in § 96(3) of the Telecommunications Act (TKG). In Germany, the Cookie Directive was not implemented as national law. Instead, the directive was largely implemented in § 15(3) of the Telemedia Act (TMG).

For strictly necessary cookies, even where no consent has been given, there are legitimate interests (Article 6(1)(f) GDPR), which in most cases are of an economic nature. We want to offer visitors to the website a pleasant user experience, and certain cookies are often strictly necessary for this.

Insofar as cookies that are not strictly necessary are used, this only happens with your consent. The legal basis in this respect is Art. 6(1)(a) GDPR.

In the following sections, you will be informed in more detail about the use of cookies, insofar as the software used uses cookies.

Web hosting introduction

Web hosting summary 👥 Data subjects: website visitors 🤝 Purpose: professional hosting of the website and securing its operation 📓 Data processed: IP address, time of website visit, browser used and other data. You can find more details below or from the web hosting provider used. 📅 Storage period: depends on the respective provider, but usually 2 weeks ⚖️ Legal bases: Art. 6(1)(f) GDPR (legitimate interests)

What is web hosting?

When you visit websites nowadays, certain information – including personal data – is automatically created and stored, including on this website. This data should be processed as sparingly as possible and only with justification. By website, by the way, we mean the entirety of all web pages on a domain, i.e. everything from the start page (homepage) to the very last subpage (like this one). By domain we mean, for example, example.de or example.com.

If you want to view a website on a computer, tablet or smartphone, you use a program called a web browser. You probably know some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox and Apple Safari. We simply call it a browser or web browser.

To display the website, the browser has to connect to another computer where the website's code is stored: the web server. Operating a web server is a complicated and time-consuming task, which is why it is usually taken on by professional providers. They offer web hosting and thus ensure reliable and error-free storage of website data. That's a lot of technical terms, but please stay with us, it gets even better!

When the browser on your computer (desktop, laptop, tablet or smartphone) connects and during data transfer to and from the web server, personal data may be processed. On the one hand, your computer stores data; on the other hand, the web server also has to store data for a while to ensure proper operation.

A picture is worth a thousand words, so the following graphic illustrates the interaction between the browser, the internet and the hosting provider.

Why do we process personal data?

The purposes of data processing are:

1. Professional hosting of the website and securing its operation
2. to maintain operational and IT security
3. Anonymous evaluation of access behaviour to improve our offer and, if necessary, for criminal prosecution or the pursuit of claims

What data is processed?

Even while you are visiting our website right now, our web server – the computer on which this website is stored – usually automatically stores data such as

• the complete internet address (URL) of the accessed web page
• browser and browser version (e.g. Chrome 87)
• the operating system used (e.g. Windows 10)
• the address (URL) of the previously visited page (referrer URL) (e.g. https://www.beispielquellsite.de/vondabinichgekommen/)
• the host name and IP address of the device from which the site is accessed (e.g. COMPUTERNAME and 194.23.43.121)
• Date and time
• in files, the so-called web server log files

How long is data stored?

As a rule, the above data is stored for two weeks and then automatically deleted. We do not pass this data on, but we cannot rule out that this data may be viewed by authorities in the event of unlawful behaviour.

In short: Your visit is logged by our provider (the company that runs our website on special computers (servers)), but we do not pass on your data without consent!

Legal basis

The lawfulness of processing personal data in the context of web hosting results from Art. 6(1)(f) GDPR (safeguarding legitimate interests), as the use of professional hosting with a provider is necessary to present the company on the internet in a secure and user-friendly manner and to be able to pursue attacks and claims arising from them if necessary.

There is usually a data processing agreement between us and the hosting provider in accordance with Art. 28 et seq. GDPR, which ensures compliance with data protection and guarantees data security.

HOSTINGER web hosting privacy policy

To host our website, we use the web hosting services of HOSTINGER INTERNATIONAL LIMITED. HOSTINGER has its registered office at 61 Lordou Vironos Street Lumiel Building, 4th floor CYP-6023 Larnaca, Cyprus.

What is Hostinger web hosting?

Hostinger offers a wide range of web hosting services that allow you to host your website or applications on the internet. The services include domain registration, website and shop hosting, WordPress hosting, marketing tools, email services, office applications, cloud hosting and server solutions. As one of the leading companies in the industry, Hostinger manages millions of domains, customer contracts and servers to offer its customers high-quality hosting services.

Why do we use Hostinger web hosting?

We chose Hostinger as our hosting provider because the company has a proven track record in the industry while constantly investing in innovative technologies. This combination of experience and innovation provides the basis for reliable and secure availability of our website. We appreciate the unlimited monthly data transfer and the generous storage space Hostinger provides. This allows our website to remain powerful even with high visitor numbers. The speed of our website meets our requirements, and the price-performance ratio is currently optimal for us.

For more information on data protection at Hostinger, please refer to Hostinger's privacy policy on its website at https://www.hostinger.de/datenschutz-bestimmungen. If you have further questions about data protection, you can also contact Hostinger's data protection team by email at info@maricacouture.com .

Website builder systems introduction

Website builder systems privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: optimising our service 📓 Data processed: data such as technical usage information like browser activity, clickstream activity, session heatmaps as well as contact details, IP address or your geographical location. You can find more details further down in this privacy policy and in the providers' privacy policies. 📅 Storage period: depends on the provider ⚖️ Legal bases: Art. 6(1)(f) GDPR (legitimate interests), Art. 6(1)(a) GDPR (consent)

What are website builder systems?

We use a website builder system for our website. Builder systems are special forms of a content management system (CMS). With a builder system, website operators can create a website very easily and without programming knowledge. In many cases, web hosts also offer builder systems. By using a builder system, personal data may also be collected, stored and processed. In this privacy text, we give you general information about data processing by builder systems. You can find more detailed information in the provider's privacy policy.

Why do we use website builder systems for our website?

The biggest advantage of a builder system is its ease of use. We want to offer you a clear, simple and well-organised website that we can easily operate and maintain ourselves – without external support. A builder system now offers many helpful functions that we can use even without programming knowledge. This allows us to design our web presence as we wish and offer you an informative and pleasant time on our website.

What data is stored by a builder system?

Exactly which data is stored naturally depends on the website builder system used. Each provider processes and collects different data from website visitors. As a rule, however, technical usage information such as operating system, browser, screen resolution, language and keyboard settings, hosting provider and the date of your website visit is collected. Tracking data (e.g. browser activity, clickstream activity, session heatmaps, etc.) may also be processed. In addition, personal data may be collected and stored. This is usually contact data such as email address, phone number (if you have provided it), IP address and geographical location data. You can find out exactly which data is stored in the provider's privacy policy.

How long and where is the data stored?

We will inform you about the duration of data processing below in connection with the website builder system used, provided we have further information on this. You can find detailed information on this in the provider's privacy policy. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. The provider may store your data according to its own specifications, over which we have no influence.

Right to object

You always have the right to information, rectification and erasure of your personal data. If you have any questions, you can also contact those responsible for the website builder system used at any time. You can find contact details either in our privacy policy or on the website of the respective provider.

You can delete, deactivate or manage cookies that providers use for their functions in your browser. This works in different ways depending on which browser you use. Please note, however, that not all functions may then work as usual.

Legal basis

We have a legitimate interest in using a website builder system to optimise our online service and present it to you efficiently and in a user-friendly way. The corresponding legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use the builder insofar as you have given your consent.

Insofar as the processing of data is not strictly necessary for the operation of the website, the data is only processed on the basis of your consent. This applies in particular to tracking activities. The legal basis in this respect is Art. 6(1)(a) GDPR.

With this privacy policy, we have given you the most important general information about data processing. If you would like more detailed information, you can find further information – if available – in the following section or in the provider's privacy policy.

WordPress.com privacy policy

We use the well-known content management system WordPress.com for our website. The service provider is the American company Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.

What is WordPress?

The company was founded in 2003 and developed in a relatively short time into one of the best-known content management systems (CMS) worldwide. A CMS is software that helps us design our website and present content in an attractive and organised way. The content can be text, audio and video.
By using WordPress, personal data may also be collected, stored and processed. As a rule, mainly technical data such as operating system, browser, screen resolution or hosting provider is stored. However, personal data such as IP address, geographical data or contact data may also be processed.

Why do we use WordPress?

Programming is not one of our core competencies. Nevertheless, we want a powerful and attractive website that we can manage and maintain ourselves. With a website builder or a content management system like WordPress, that is exactly what is possible. With WordPress, we don't have to be programming experts to offer you a beautiful website. Thanks to WordPress, we can operate our website quickly and easily even without technical knowledge. If technical problems occur or we have special requirements for our website, we still have our specialists who are at home with HTML, PHP, CSS and the like.

How secure is data transfer with WordPress?

WordPress also processes your data in the USA, among other places. WordPress is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, WordPress uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, WordPress undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the data processing agreements, which correspond to the standard contractual clauses, at https://wordpress.com/support/data-processing-agreements/.

You can find out more about the data processed through the use of WordPress.com in the privacy policy at https://automattic.com/de/privacy/.

Web analytics introduction

Web analytics privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: evaluating visitor information to optimise the website. 📓 Data processed: access statistics containing data such as access locations, device data, access duration and time, navigation behaviour, click behaviour and IP addresses. You can find more details from the web analytics tool used. 📅 Storage period: depends on the web analytics tool used ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is web analytics?

We use software on our website to evaluate the behaviour of website visitors, known as web analytics. Data is collected which the respective analytics tool provider (also called tracking tool) stores, manages and processes. The data is used to create analyses of user behaviour on our website, which are made available to us as the website operator. In addition, most tools offer various testing options. For example, we can test which offers or content are best received by our visitors. To do this, we show you two different offers for a limited period of time. After the test (a so-called A/B test), we know which product or content our website visitors find more interesting. For such test procedures, as well as for other analytics procedures, user profiles can also be created and the data stored in cookies.

Why do we use web analytics?

With our website we have a clear goal in mind: we want to deliver the best web offer in our industry. To achieve this goal, we want to offer the best and most interesting range on the one hand, and on the other hand make sure that you feel completely comfortable on our website. With the help of web analysis tools, we can take a closer look at the behaviour of our website visitors and then improve our web offer for you and us accordingly. For example, we can see the average age of our visitors, where they come from, when our website is visited most or which content or products are particularly popular. All this information helps us to optimise the website and thus adapt it as well as possible to your needs, interests and wishes.

What data is processed?

Exactly which data is stored naturally depends on the analysis tools used. As a rule, however, it is stored, for example, which content you view on our website, which buttons or links you click, when you access a page, which browser you use, which device (PC, tablet, smartphone, etc.) you use to visit the website or which computer system you use. If you have agreed that location data may also be collected, this may also be processed by the web analysis tool provider.

Your IP address is also stored. According to the General Data Protection Regulation (GDPR), IP addresses are personal data. However, your IP address is usually stored pseudonymised (i.e. in an unrecognisable and shortened form). For the purpose of testing, web analysis and web optimisation, no direct data such as your name, age, address or email address is generally stored. All this data, if collected, is stored pseudonymised. This means that you cannot be identified as a person.

The following example schematically shows how Google Analytics works as an example of client-based web tracking with JavaScript code.

How long the respective data is stored always depends on the provider. Some cookies only store data for a few minutes or until you leave the website again, other cookies can store data for several years.

Duration of data processing

We will inform you about the duration of the data processing below, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. If required by law, as in the case of accounting, this storage period may also be exceeded.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser.

Legal basis

The use of web analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6(1)(a) GDPR (consent) , this consent constitutes the legal basis for the processing of personal data as may occur when collected by web analytics tools.

In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors in order to improve our offer technically and economically. With the help of web analytics, we can detect website errors, identify attacks and improve profitability. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use the tools insofar as you have given your consent.

As cookies are used with web analytics tools, we also recommend that you read our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Information on specific web analytics tools can be found – if available – in the following sections.

Google Analytics privacy policy

Google Analytics privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: evaluating visitor information to optimise the website. 📓 Data processed: access statistics containing data such as access locations, device data, access duration and time, navigation behaviour and click behaviour. You can find more details further down in this privacy policy. 📅 Storage period: individually adjustable; by default, Google Analytics 4 stores data for 14 months ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is Google Analytics?

On our website we use the analysis tracking tool Google Analytics in the version Google Analytics 4 (GA4) from the American company Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your actions on our website. Through the combination of various technologies such as cookies, device IDs and login information, you as a user can be identified across different devices. This means your actions can also be analysed across platforms.

For example, if you click on a link, this event is stored in a cookie and sent to Google Analytics. With the help of the reports we receive from Google Analytics, we can better adapt our website and our service to your wishes. Below we go into more detail about the tracking tool and above all inform you about which data is processed and how you can prevent this.

Google Analytics is a tracking tool used to analyse traffic on our website. These measurements and analyses are based on a pseudonymous user identification number. This number does not contain any personal data such as name or address, but is used to assign events to a device. GA4 uses an event-based model that captures detailed information about user interactions such as page views, clicks, scrolling and conversion events. In addition, various machine learning functions have been built into GA4 to better understand user behaviour and certain trends. GA4 relies on modelling with the help of machine learning functions. This means that, on the basis of the collected data, missing data can also be extrapolated in order to optimise the analysis and also to be able to make forecasts.

For Google Analytics to work, a tracking code is built into the code of our website. When you visit our website, this code records various events that you perform on our website. With GA4's event-based data model, we as the website operator can define and track specific events to obtain analyses of user interactions. In addition to general information such as clicks or page views, special events that are important for our business can also be tracked. Such special events can be, for example, submitting a contact form or purchasing a product.

As soon as you leave our website, this data is sent to the Google Analytics servers and stored there.

Google processes the data and we receive reports on your user behaviour. These may include the following reports:

• Audience reports: audience reports help us get to know our users better and know more precisely who is interested in our service.
• Ad reports: ad reports make it easier for us to analyse and improve our online advertising.
• Acquisition reports: acquisition reports give us helpful information on how we can get more people excited about our service.
• Behaviour reports: here we find out how you interact with our website. We can see which path you take on our site and which links you click.
• Conversion reports: a conversion is a process in which you carry out a desired action as a result of a marketing message. For example, when you go from being a mere website visitor to a buyer or newsletter subscriber. These reports help us learn more about how our marketing measures are received by you. In this way we want to increase our conversion rate.
• Real-time reports: here we always find out immediately what is happening on our website right now. For example, we can see how many users are reading this text right now.

In addition to the analysis reports mentioned above, Google Analytics 4 also offers the following functions, among others:

• Event-based data model: this model captures very specific events that can take place on our website. For example, playing a video, buying a product or signing up for our newsletter.
• Advanced analysis functions: with these functions we can understand your behaviour on our website or certain general trends even better. For example, we can segment user groups, carry out comparative analyses of target groups or trace your path on our website.
• Predictive modelling: on the basis of collected data, machine learning can extrapolate missing data to predict future events and trends. This can help us develop better marketing strategies.
• Cross-platform analysis: data can be collected and analysed from both websites and apps. This gives us the opportunity to analyse user behaviour across platforms, provided of course that you have consented to the data processing.

Why do we use Google Analytics on our website?

Our goal with this website is clear: we want to offer you the best possible service. The statistics and data from Google Analytics help us achieve this goal.

The statistically evaluated data gives us a clear picture of the strengths and weaknesses of our website. On the one hand, we can optimise our site so that it is found more easily on Google by interested people. On the other hand, the data helps us to better understand you as a visitor. We therefore know very precisely what we need to improve on our website in order to offer you the best possible service. The data also helps us to carry out our advertising and marketing measures in a more individual and cost-effective way. After all, it only makes sense to show our products and services to people who are interested in them.

What data is stored by Google Analytics?

Using a tracking code, Google Analytics creates a random, unique ID that is linked to your browser cookie. This is how Google Analytics recognises you as a new user and a user ID is assigned to you. The next time you visit our site, you will be recognised as a “returning” user. All collected data is stored together with this user ID. This is what makes it possible to evaluate pseudonymous user profiles.

In order to analyse our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. The Google Analytics 4 property is the default for every newly created property. Depending on the property used, data is stored for different lengths of time.

Through identifiers such as cookies, app instance IDs, user IDs or custom event parameters, your interactions are measured across platforms, provided you have given your consent. Interactions are all types of actions that you carry out on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics can be linked to third-party cookies. Google does not pass on any Google Analytics data unless we as the website operator approve it. Exceptions may occur if required by law.

According to Google, no IP addresses are logged or stored in Google Analytics 4. However, Google uses the IP address data to derive location data and deletes it immediately afterwards. All IP addresses collected from users in the EU are therefore deleted before the data is stored in a data centre or on a server.

As Google Analytics 4 focuses on event-based data, the tool uses significantly fewer cookies compared to previous versions (such as Google Universal Analytics).

Here we show you an overview of the most important types of data collected with Google Analytics:

Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly the areas you click on. This gives us information about where you are “moving around” on our site.

Session duration: Google defines session duration as the time you spend on our site without leaving it. If you have been inactive for 20 minutes, the session ends automatically.

Bounce rate : a bounce is when you only view one page on our website and then leave our website again.

Account creation: If you create an account or place an order on our website, Google Analytics collects this data.

Location: IP addresses are not logged or stored in Google Analytics. However, shortly before the IP address is deleted, it is used to derive location data.

Technical information: Technical information includes your browser type, your internet provider or your screen resolution, among other things.

Referral source: Of course, Google Analytics – and we – are also interested in which website or which advertisement brought you to our site.

Other data includes contact details, any ratings, playing media (e.g. when you play a video via our site), sharing content via social media or adding to your favourites. The list is not exhaustive and only serves as a general guide to data storage by Google Analytics.

How long and where is the data stored?

Google has its servers distributed all over the world. Here you can read exactly where Google's data centres are located: https://www.google.com/about/datacenters/locations/?hl=de

Your data is distributed across various physical data carriers. This has the advantage that the data can be accessed more quickly and is better protected against manipulation. Every Google data centre has appropriate emergency programs for your data. For example, if hardware at Google fails or natural disasters paralyse servers, the risk of a service interruption at Google still remains low.

The retention period of the data depends on the properties used. The storage period is always set separately for each individual property. Google Analytics offers us four options for controlling the storage period:

• 2 months: this is the shortest storage period.
• 14 months: by default, data remains stored in GA4 for 14 months.
• 26 months: data can also be stored for 26 months.
• Data is only deleted when we delete it manually

There is also the option that data is only deleted if you no longer visit our website within the period we have chosen. In this case, the retention period is reset each time you visit our website again within the specified period.

When the specified period has expired, the data is deleted once a month. This retention period applies to your data linked to cookies, user recognition and advertising IDs (e.g. cookies of the DoubleClick domain). Report results are based on aggregated data and are stored independently of user data. Aggregated data is a merging of individual data into a larger unit.

How can I delete my data or prevent data storage?

Under the data protection law of the European Union, you have the right to obtain information about your data, to update, delete or restrict it. With the browser add-on to deactivate Google Analytics JavaScript (analytics.js, gtag.js), you prevent Google Analytics 4 from using your data. You can download and install the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de . Please note that this add-on only deactivates data collection by Google Analytics.

If you generally want to deactivate, delete or manage cookies, you will find the corresponding links to the instructions for the best-known browsers in the “Cookies” section.

Legal basis

The use of Google Analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6(1)(a) GDPR (consent) , this consent constitutes the legal basis for the processing of personal data as may occur when collected by web analytics tools.

In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors in order to improve our offer technically and economically. With the help of Google Analytics, we can detect website errors, identify attacks and improve profitability. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use Google Analytics insofar as you have given your consent.

Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the Google Ads Data Processing Terms, which refer to the standard contractual clauses, at https://business.safety.google/intl/de/adsprocessorterms/.

We hope we have been able to give you the most important information about data processing by Google Analytics. If you would like to learn more about the tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.

If you want to learn more about data processing, use the Google privacy policy at https://policies.google.com/privacy?hl=de.

Email marketing introduction

Email marketing summary 👥 Data subjects: newsletter subscribers 🤝 Purpose: direct advertising by email, notification of system-relevant events 📓 Data processed: data entered during registration, but at least the email address. You can find more details from the email marketing tool used. 📅 Storage period: duration of the subscription ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is email marketing?

To keep you up to date, we also use email marketing. If you have agreed to receive our emails or newsletters, your data is also processed and stored. Email marketing is a part of online marketing. News or general information about a company, products or services is sent by email to a specific group of people who are interested in it.

If you want to take part in our email marketing (usually via newsletter), you normally just need to sign up with your email address. To do this, you fill out an online form and submit it. However, we may also ask you for your title and name so that we can address you personally.

In principle, signing up for newsletters works using the so-called “double opt-in procedure”. After you have signed up for our newsletter on our website, you will receive an email with which you confirm the newsletter registration. This ensures that the email address belongs to you and that nobody has signed up with someone else's email address. We or a notification tool used by us log every single registration. This is necessary so that we can prove the legally correct registration process. As a rule, the time of registration, the time of confirmation and your IP address are stored. In addition, changes you make to your stored data are also logged.

Why do we use email marketing?

Of course, we want to stay in touch with you and always present you with the most important news about our company. For this we use, among other things, email marketing – often simply called a “newsletter” – as an essential part of our online marketing. If you agree or it is permitted by law, we send you newsletters, system emails or other notifications by email. When we use the term “newsletter” in the following text, we mainly mean regularly sent emails. Of course, we do not want to bother you with our newsletters in any way. That is why we always try to offer only relevant and interesting content. For example, you will learn more about our company, our services or products. As we are always improving our offers, our newsletter will also always tell you when there is news or when we are offering special, attractive promotions. If we commission a service provider offering a professional mailing tool for our email marketing, we do so in order to offer you fast and secure newsletters. The purpose of our email marketing is basically to inform you about new offers and to come closer to our business goals.

What data is processed?

If you become a subscriber to our newsletter via our website, you confirm membership of an email list by email. In addition to your IP address and email address, your title, name, address and phone number may also be stored – but only if you agree to this data storage. The data marked as such is necessary for you to be able to take part in the service offered. Providing it is voluntary, but not providing it means that you cannot use the service. In addition, information about your device or your preferred content on our website may also be stored. You can find out more about the storage of data when you visit a website in the section “Automatic data storage”. We record your declaration of consent so that we can always prove that it complies with our laws.

Duration of data processing

If you unsubscribe your email address from our email/newsletter list, we may store your address for up to three years on the basis of our legitimate interests so that we can still prove your consent at the time. We may only process this data if we have to defend ourselves against any claims.

However, if you confirm that you gave us your consent to the newsletter registration, you can submit an individual deletion request at any time. If you permanently object to the consent, we reserve the right to store your email address on a block list. As long as you have voluntarily subscribed to our newsletter, we will of course also keep your email address.

Right to object

You can cancel your newsletter subscription at any time. All you have to do is revoke your consent to the newsletter registration. This usually only takes a few seconds or one or two clicks. In most cases, you will find a link to cancel the newsletter subscription directly at the end of each email. If you really cannot find the link in the newsletter, please contact us by email and we will cancel your newsletter subscription immediately.

Legal basis

Our newsletter is sent on the basis of your consent (Article 6(1)(a) GDPR). This means that we may only send you a newsletter if you have actively signed up for it beforehand. If applicable, we may also send you advertising messages if you have become our customer and have not objected to the use of your email address for direct advertising.

Information on specific email marketing services and how they process personal data can be found – if available – in the following sections.

Push notifications introduction

Push notifications summary 👥 Data subjects: push notification subscribers 🤝 Purpose: notification of system-relevant and interesting events 📓 Data processed: data entered during registration, usually also location data. You can find more details from the push notification tool used. 📅 Storage period: data is usually stored for as long as is necessary to provide the services. ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract)

What are push notifications?

We also use so-called push notification services on our website, with which we can keep our users up to date. This means that if you have agreed to the use of such push notifications, we can send you short news with the help of a software tool. Push notifications are a form of text message that appears directly on your smartphone or on other devices such as tablets or PCs if you have signed up for them. You will also receive these messages if you are not on our website or are not actively using our offer. Data about your location and usage behaviour may also be collected and stored.

Why do we use push notifications?

On the one hand, we use push notifications to be able to fully provide the services we have contractually agreed with you. On the other hand, the messages also serve our online marketing. With the help of these messages, we can introduce you to our service or our products. Especially when there is news in our company, we can inform you about it immediately. We want to get to know the preferences and habits of all our users as well as possible in order to continuously improve our offer.

What data is processed?

In order to receive push notifications, you must also confirm that you want to receive these messages. The data collected during the consent process is also stored, managed and processed. This is necessary so that it can be proven and recognised that a user has agreed to receive the push notifications. For this purpose, a so-called device token or push token is stored in your browser. Usually, the data of your location or the location of the device you are using is also stored.

To ensure that we always send interesting and important push notifications, the handling of the messages is also statistically evaluated. For example, we can then see whether and when you open the message. With the help of these findings, we can adapt our communication strategy to your wishes and interests. Although this stored data can be assigned to you, we do not want to check you as an individual. Rather, we are interested in the collected data of all our users so that we can make optimisations. You can find out exactly which data is stored in the privacy policies of the respective service providers.

Duration of data processing

How long the data is processed and stored depends primarily on the tool we use. You can find out more about the data processing of the individual tools below. The providers' privacy policies usually state exactly which data is stored and processed and for how long. In principle, personal data is only processed for as long as is necessary to provide our services. If data is stored in cookies, the storage period varies greatly. The data can be deleted immediately after leaving a website, but it can also remain stored for several years. You should therefore look at each individual cookie in detail if you want to know more about data storage. In most cases, you will also find informative information about the individual cookies in the privacy policies of the individual providers.

Legal basis

It may also be that the push notifications are necessary in order to fulfil certain obligations set out in a contract, for example so that we can inform you of technical or organisational news. In that case, the legal basis is Art. 6(1)(b) GDPR.

If this is not the case, the push notifications are only sent on the basis of your consent. Our push notifications may in particular have advertising content. The push notifications may also be sent depending on the location shown by your device. The analytical evaluations mentioned above are also based on your consent to receive such messages. The legal basis in this respect is Art. 6(1)(a) GDPR. You can of course revoke your consent or change various settings at any time in the settings.

Messenger & communication introduction

Messenger & communication privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: contact enquiries and general communication between us and you 📓 Data processed: data such as name, address, email address, phone number, general content data, IP address if applicable You can find more details from the respective tools used. 📅 Storage period: depends on the messenger & communication functions used ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests), Art. 6(1)(1)(b) GDPR (contractual or pre-contractual obligations)

What are messenger & communication features?

We offer various ways of communicating with us on our website (such as messenger and chat functions, online or contact forms, email, phone). Your data is also processed and stored to the extent necessary to answer your enquiry and for our subsequent measures.

In addition to classic means of communication such as email, contact forms or phone, we also use chats or messengers. The most commonly used messenger function at the moment is WhatsApp, but there are of course many different providers that offer messenger functions specifically for websites. If content is end-to-end encrypted, this is indicated in the individual privacy texts or in the privacy policy of the respective provider. End-to-end encryption simply means that the content of a message is not visible even to the provider. However, information about your device, location settings and other technical data may still be processed and stored.

Why do we use messenger & communication functions?

Ways of communicating with you are very important to us. After all, we want to talk to you and answer all possible questions about our service as well as possible. Well-functioning communication is an important part of our service. With the practical messenger & communication functions, you can always choose the one you like best. In exceptional cases, however, we may not answer certain questions via chat or messenger. This is the case, for example, when internal contractual matters are concerned. Here we recommend other means of communication such as email or phone.

We generally assume that we remain responsible under data protection law even if we use the services of a social media platform. However, the European Court of Justice has ruled that in certain cases the operator of the social media platform can be jointly responsible with us within the meaning of Art. 26 GDPR. Where this is the case, we will point this out separately and work on the basis of a corresponding agreement. The essence of the agreement is given below for the platform concerned.

Please note that when you use our integrated elements, your data may also be processed outside the European Union, as many providers, such as Facebook Messenger or WhatsApp, are American companies. As a result, you may no longer be able to claim or enforce your rights regarding your personal data as easily.

What data is processed?

Exactly which data is stored and processed depends on the respective provider of the messenger & communication functions. Basically, it is data such as name, address, phone number, email address and content data such as all information you enter in a contact form. In most cases, information about your device and the IP address are also stored. Data collected via a messenger & communication function is also stored on the providers' servers.

If you want to know exactly which data is stored and processed by the respective providers and how you can object to the data processing, you should carefully read the respective company's privacy policy.

How long is data stored?

How long the data is processed and stored depends primarily on the tools we use. You can find out more about the data processing of the individual tools below. The providers' privacy policies usually state exactly which data is stored and processed and for how long. In principle, personal data is only processed for as long as is necessary to provide our services. If data is stored in cookies, the storage period varies greatly. The data can be deleted immediately after leaving a website, but it can also remain stored for several years. You should therefore look at each individual cookie in detail if you want to know more about data storage. In most cases, you will also find informative information about the individual cookies in the privacy policies of the individual providers.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser. For further information, please refer to the section on consent.

As cookies may be used with messenger & communication functions, we also recommend our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal basis

If you have consented to your data being processed and stored by integrated messenger & communication functions, this consent is the legal basis for the data processing (Art. 6(1)(a) GDPR). We process your enquiry and manage your data within the framework of contractual or pre-contractual relationships in order to fulfil our pre-contractual and contractual obligations or to answer enquiries. The basis for this is Art. 6(1)(1)(b) GDPR. In principle, if consent has been given, your data is also stored and processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in fast and good communication with you or other customers and business partners.

Facebook Messenger privacy policy

We use the instant messaging service Facebook Messenger on our website. The service provider is the American company Meta Platforms Inc. For the European region, Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) is responsible.

What is Facebook Messenger?

Facebook Messenger is a chat messaging function developed by Facebook with which you can send and receive text messages, voice and video calls, photos and other media files to and from other Facebook users.
When you use Facebook Messenger, your personal data is also processed on Facebook's servers. In addition to your phone number and chat messages, this includes photos and videos sent, profile data, your address or your location.

Why do we use Facebook Messenger?

We want to stay in touch with you, and this works best via messaging services such as Facebook Messenger. On the one hand because the service works perfectly, and on the other hand because Facebook is still one of the best-known social media platforms. The service is practical and enables uncomplicated and fast communication with you.

How secure is data transfer with Facebook Messenger?

Facebook also processes your data in the USA, among other places. Facebook / Meta Platforms is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Facebook uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Facebook undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the Facebook data processing terms, which refer to the standard contractual clauses, at https://www.facebook.com/legal/terms/dataprocessing.

You can find out more about the data processed through the use of Facebook in the privacy policy at https://www.facebook.com/about/privacy.

WhatsApp privacy policy

We use the instant messaging service WhatsApp on our website. The service provider is the American company WhatsApp Inc., a subsidiary of Meta Platforms Inc. (until October 2021 Facebook Inc.). For the European region, WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland is responsible.

What is WhatsApp?

We probably don't need to introduce WhatsApp in detail. The probability that you use this well-known messaging service on your smartphone is relatively high. For many years there have been voices criticising WhatsApp and its parent company Meta Platforms regarding the handling of personal data. The main criticism in recent years related to merging WhatsApp user data with Facebook. Facebook responded in 2021 and adjusted its terms of use, stating that currently (as of 2021) no personal data of WhatsApp users is shared with Facebook.
Nevertheless, a lot of your personal data is of course processed by WhatsApp if you use WhatsApp and have consented to the data processing. In addition to your phone number and chat messages, this includes photos, videos and profile data sent. However, photos and videos are only supposed to be cached briefly, and all messages and calls are end-to-end encrypted, so they should not be visible even to Meta itself. In addition, information from your address book and other metadata is also stored by WhatsApp.

Why do we use WhatsApp?

We want to stay in touch with you, and this works best via WhatsApp. On the one hand because the service works perfectly, and on the other hand because WhatsApp is still the most widely used instant messaging tool in the world. The service is practical and enables uncomplicated and fast communication with you.

How secure is data transfer with WhatsApp?

WhatsApp also processes your data in the USA, among other places. WhatsApp is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, WhatsApp uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, WhatsApp undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

You can find information on data transfers at WhatsApp, which correspond to the standard contractual clauses, at https://www.whatsapp.com/legal/business-data-transfer-addendum-20210927

We hope we have given you the most important information about the use and data processing by WhatsApp. You can find out more about the data processed through the use of WhatsApp in the privacy policy at https://www.whatsapp.com/privacy.

Social media introduction

Social media privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: presenting and optimising our service, contact with visitors, interested parties, etc., advertising 📓 Data processed: data such as phone numbers, email addresses, contact details, data on user behaviour, information about your device and your IP address. You can find more details from the social media tool used. 📅 Storage period: depends on the social media platforms used ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is social media?

In addition to our website, we are also active on various social media platforms. User data may be processed so that we can specifically address users who are interested in us via social networks. In addition, elements of a social media platform may be embedded directly into our website. This is the case, for example, if you click on a so-called social button on our website and are forwarded directly to our social media presence. Social media are websites and apps through which registered members can produce content, share content openly or in certain groups and network with other members.

Why do we use social media?

For years, social media platforms have been the place where people communicate and get in touch online. With our social media presences, we can introduce our products and services to interested parties. The social media elements integrated on our website help you switch to our social media content quickly and without complications.

The data stored and processed through your use of a social media channel is primarily used to carry out web analyses. The aim of these analyses is to be able to develop more precise and personalised marketing and advertising strategies. Depending on your behaviour on a social media platform, appropriate conclusions about your interests can be drawn with the help of the evaluated data and so-called user profiles can be created. This also enables the platforms to present you with tailored advertisements. In most cases, cookies are set in your browser for this purpose, which store data on your usage behaviour.

We generally assume that we remain responsible under data protection law even if we use the services of a social media platform. However, the European Court of Justice has ruled that in certain cases the operator of the social media platform can be jointly responsible with us within the meaning of Art. 26 GDPR. Where this is the case, we will point this out separately and work on the basis of a corresponding agreement. The essence of the agreement is then given below for the platform concerned.

Please note that when you use social media platforms or our integrated elements, your data may also be processed outside the European Union, as many social media channels, such as Facebook or Twitter, are American companies. As a result, you may no longer be able to claim or enforce your rights regarding your personal data as easily.

What data is processed?

Exactly which data is stored and processed depends on the respective provider of the social media platform. Usually, however, it is data such as phone numbers, email addresses, data you enter in a contact form, user data such as which buttons you click, who you like or follow, when you visited which pages, information about your device and your IP address. Most of this data is stored in cookies. Especially if you have a profile on the social media channel you visit and are logged in, data may be linked to your profile.

All data collected via a social media platform is also stored on the providers' servers. This means that only the providers have access to the data and can give you the appropriate information or make changes.

If you want to know exactly which data is stored and processed by the social media providers and how you can object to the data processing, you should carefully read the respective company's privacy policy. If you have questions about data storage and data processing or want to assert corresponding rights, we recommend that you contact the provider directly.

Duration of data processing

We will inform you about the duration of the data processing below, provided we have further information on this. For example, the social media platform Facebook stores data until it is no longer needed for its own purposes. However, customer data that is compared with its own user data is deleted within two days. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. If required by law, as in the case of accounting, this storage period may also be exceeded.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers such as embedded social media elements at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser.

As cookies may be used with social media tools, we also recommend our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal basis

If you have consented to your data being processed and stored by integrated social media elements, this consent is the legal basis for the data processing (Art. 6(1)(a) GDPR). In principle, if consent has been given, your data is also stored and processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in fast and good communication with you or other customers and business partners. Nevertheless, we only use the tools insofar as you have given your consent. Most social media platforms also set cookies in your browser to store data. We therefore recommend that you read our privacy text on cookies carefully and look at the privacy policy or cookie policy of the respective service provider.

Information on specific social media platforms can be found – if available – in the following sections.

Facebook privacy policy

Facebook privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: optimising our service 📓 Data processed: data such as customer data, data on user behaviour, information about your device and your IP address. You can find more details further down in the privacy policy. 📅 Storage period: until the data is no longer useful for Facebook's purposes ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are Facebook tools?

We use selected Facebook tools on our website. Facebook is a social media network of Meta Platforms Inc. or, for the European region, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. With the help of these tools, we can offer you and people who are interested in our products and services the best possible offer.

If your data is collected and forwarded via our embedded Facebook elements or via our Facebook page (fan page), both we and Facebook Ireland Ltd. are responsible for this. Facebook alone is responsible for the further processing of this data. Our joint obligations have also been set out in a publicly accessible agreement at https://www.facebook.com/legal/controller_addendum . It states, for example, that we must clearly inform you about the use of Facebook tools on our site. We are also responsible for ensuring that the tools are integrated into our website in a way that is secure under data protection law. Facebook, on the other hand, is responsible, for example, for the data security of Facebook products. If you have any questions about data collection and data processing by Facebook, you can contact the company directly. If you address the question to us, we are obliged to forward it to Facebook.

Below we give an overview of the various Facebook tools, which data is sent to Facebook and how you can delete this data.

In addition to many other products, Facebook also offers the so-called “Facebook Business Tools”. This is Facebook's official name. However, as the term is hardly known, we have decided to simply call them Facebook tools. These include, among others:

• Facebook Pixel
• social plug-ins (such as the “Like” or “Share” button)
• Facebook Login
• Account Kit
• APIs (application programming interfaces)
• SDKs (collections of programming tools)
• Platform integrations
• Plugins
• Codes
• Specifications
• Documentation
• Technologies and services

Through these tools, Facebook extends its services and has the opportunity to obtain information about user activities outside Facebook.

Why do we use Facebook tools on our website?

We only want to show our services and products to people who are really interested in them. With the help of advertisements (Facebook ads), we can reach exactly these people. However, in order to show users suitable advertising, Facebook needs information about people's wishes and needs. Information about user behaviour (and contact details) on our website is therefore made available to the company. This allows Facebook to collect better user data and show interested people suitable advertising for our products or services. The tools thus enable tailored advertising campaigns on Facebook.

Facebook calls data about your behaviour on our website “event data”. This is also used for measurement and analysis services. Facebook can thus create “campaign reports” on our behalf about the effectiveness of our advertising campaigns. In addition, analyses give us a better insight into how you use our services, website or products. This allows us to optimise your user experience on our website with some of these tools. For example, you can use the social plug-ins to share content on our site directly on Facebook.

What data is stored by Facebook tools?

By using individual Facebook tools, personal data (customer data) may be sent to Facebook. Depending on the tools used, customer data such as name, address, phone number and IP address may be sent.

Facebook uses this information to compare the data with the data it has about you itself (if you are a Facebook member). Before customer data is transmitted to Facebook, so-called “hashing” takes place. This means that a data set of any size is transformed into a character string. This also serves to encrypt data.

In addition to contact details, “event data” is also transmitted. “Event data” means the information we receive about you on our website. For example, which subpages you visit or which products you buy from us. Facebook does not share the information received with third parties (such as advertisers) unless the company has explicit permission or is legally obliged to do so. “Event data” can also be linked to contact details. This allows Facebook to offer better personalised advertising. After the matching process mentioned above, Facebook deletes the contact details again.

In order to deliver optimised advertisements, Facebook only uses the event data if it has been combined with other data (collected by Facebook in other ways). Facebook also uses this event data for security, protection, development and research purposes. Much of this data is transmitted to Facebook via cookies. Cookies are small text files used to store data or information in browsers. Depending on the tools used and depending on whether you are a Facebook member, a different number of cookies are created in your browser. In the descriptions of the individual Facebook tools, we go into more detail about individual Facebook cookies. You can also find general information about the use of Facebook cookies at https://www.facebook.com/policies/cookies.

How long and where is the data stored?

In principle, Facebook stores data until it is no longer needed for its own services and Facebook products. Facebook has servers distributed around the world where its data is stored. However, customer data is deleted within 48 hours after it has been compared with its own user data.

How can I delete my data or prevent data storage?

In accordance with the General Data Protection Regulation, you have the right to information, rectification, portability and erasure of your data.

The data is only completely deleted when you delete your Facebook account completely. This is how deleting your Facebook account works:

1) Click on Settings on the right in Facebook.

2) Then click on “Your Facebook information” in the left column.

3) Now click “Deactivation and deletion”.

4) Now select “Delete account” and then click on “Continue to account deletion”

5) Now enter your password, click on “Continue” and then on “Delete account”

The data that Facebook receives via our site is stored, among other things, via cookies (e.g. with social plugins). In your browser you can deactivate, delete or manage individual or all cookies. This works in different ways depending on which browser you use. In the “Cookies” section you will find the corresponding links to the instructions for the best-known browsers.

If you generally do not want cookies, you can set up your browser so that it always informs you when a cookie is to be set. This allows you to decide for each individual cookie whether to allow it or not.

Legal basis

If you have consented to your data being processed and stored by integrated Facebook tools, this consent is the legal basis for the data processing (Art. 6(1)(a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in fast and good communication with you or other customers and business partners. Nevertheless, we only use the tools insofar as you have given your consent. Most social media platforms also set cookies in your browser to store data. We therefore recommend that you read our privacy text on cookies carefully and look at Facebook's privacy policy or cookie policy.

Facebook also processes your data in the USA, among other places. Facebook / Meta Platforms is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Facebook uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Facebook undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the Facebook data processing terms, which refer to the standard contractual clauses, at https://www.facebook.com/legal/terms/dataprocessing.

We hope we have given you the most important information about the use and data processing by Facebook tools. If you would like to learn more about how Facebook uses your data, we recommend the data policy at https://www.facebook.com/privacy/policy/.

Instagram privacy policy

Instagram privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: optimising our service 📓 Data processed: data such as data on user behaviour, information about your device and your IP address. You can find more details further down in the privacy policy. 📅 Storage period: until Instagram no longer needs the data for its purposes ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is Instagram?

We have integrated Instagram functions on our website. Instagram is a social media platform of Instagram LLC, 1601 Willow Rd, Menlo Park CA 94025, USA. Since 2012, Instagram has been a subsidiary of Meta Platforms Inc. and is one of the Facebook products. Including Instagram content on our website is called embedding. This allows us to show you content such as buttons, photos or videos from Instagram directly on our website. When you access pages of our website that have an Instagram function integrated, data is transmitted to Instagram, stored and processed. Instagram uses the same systems and technologies as Facebook. Your data is therefore processed across all Facebook companies.

Below we want to give you a more detailed insight into why Instagram collects data, what data is involved and how you can largely control the data processing. As Instagram belongs to Meta Platforms Inc., we obtain our information on the one hand from the Instagram guidelines and on the other hand from Meta's own privacy policies.

Instagram is one of the best-known social media networks in the world. Instagram combines the advantages of a blog with the advantages of audiovisual platforms such as YouTube or Vimeo. On “Insta” (as many users casually call the platform) you can upload photos and short videos, edit them with various filters and also share them on other social networks. And if you don't want to be active yourself, you can just follow other interesting users.

Why do we use Instagram on our website?

Instagram is the social media platform that has really taken off in recent years. And of course we have also reacted to this boom. We want you to feel as comfortable as possible on our website. That is why a varied presentation of our content is a matter of course for us. With the embedded Instagram functions, we can enrich our content with helpful, funny or exciting content from the world of Instagram. As Instagram is a subsidiary of Facebook, the collected data can also be useful to us for personalised advertising on Facebook. This way, only people who are really interested in our products or services see our ads.

Instagram also uses the collected data for measurement and analysis purposes. We receive summarised statistics and thus more insight into your wishes and interests. It is important to mention that these reports do not identify you personally.

What data is stored by Instagram?

When you come across one of our pages that has Instagram functions (such as Instagram pictures or plug-ins) built in, your browser automatically connects to Instagram's servers. Data is sent to Instagram, stored and processed – regardless of whether you have an Instagram account or not. This includes information about our website, about your computer, about purchases made, about advertisements you see and how you use our offer. The date and time of your interaction with Instagram are also stored. If you have an Instagram account or are logged in, Instagram stores significantly more data about you.

Facebook distinguishes between customer data and event data. We assume that this is exactly the same with Instagram. Customer data is, for example, name, address, phone number and IP address. This customer data is only transmitted to Instagram after it has been “hashed”. Hashing means that a data set is transformed into a character string. This allows the contact data to be encrypted. In addition, the “event data” mentioned above is also transmitted. By “event data”, Facebook – and consequently Instagram – means data about your user behaviour. Contact data may also be combined with event data. The collected contact data is compared with the data Instagram already has about you.

The collected data is transmitted to Facebook via small text files (cookies), which are usually set in your browser. Depending on the Instagram functions used and whether you have an Instagram account yourself, different amounts of data are stored.

We assume that data processing at Instagram works the same way as at Facebook. This means: if you have an Instagram account or have visited www.instagram.com , Instagram has set at least one cookie. If this is the case, your browser sends information to Instagram via the cookie as soon as you come into contact with an Instagram function. This data is deleted or anonymised again after 90 days at the latest (after matching). Although we have looked intensively at Instagram's data processing, we cannot say exactly which data Instagram collects and stores.

Below we show you cookies that are set in your browser at a minimum when you click on an Instagram function (such as a button or an Insta picture). In our test we assume that you do not have an Instagram account. If you are logged in to Instagram, significantly more cookies are of course set in your browser.

 

How long and where is the data stored?

Instagram shares the information received between the Facebook companies, with external partners and with people you connect with around the world. Data processing is carried out in compliance with its own data policy. Your data is distributed on Facebook servers around the world, partly for security reasons. Most of these servers are located in the USA.

How can I delete my data or prevent data storage?

Thanks to the General Data Protection Regulation, you have the right to information, portability, rectification and erasure of your data. You can manage your data in the Instagram settings. If you want to delete your data on Instagram completely, you must permanently delete your Instagram account.

This is how deleting your Instagram account works:

First open the Instagram app. On your profile page, scroll down and tap “Help Centre”. You will now be taken to the company's website. On the website, click on “Managing your account” and then on “Delete your account”.

If you delete your account completely, Instagram deletes posts such as your photos and status updates. Information that other people have shared about you does not belong to your account and is therefore not deleted.

As already mentioned above, Instagram stores your data primarily via cookies. You can manage, deactivate or delete these cookies in your browser. Depending on your browser, management always works a little differently. In the “Cookies” section you will find the corresponding links to the instructions for the best-known browsers.

You can also set up your browser so that you are always informed when a cookie is to be set. Then you can always decide individually whether you want to allow the cookie or not.

Legal basis

If you have consented to your data being processed and stored by integrated social media elements, this consent is the legal basis for the data processing (Art. 6(1)(a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in fast and good communication with you or other customers and business partners. Nevertheless, we only use the integrated social media elements insofar as you have given your consent. Most social media platforms also set cookies in your browser to store data. We therefore recommend that you read our privacy text on cookies carefully and look at the privacy policy or cookie policy of the respective service provider.

Instagram also processes your data in the USA, among other places. Instagram / Meta Platforms is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Instagram uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Instagram undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

We have tried to give you the most important information about data processing by Instagram. At https://privacycenter.instagram.com/policy/ you can take a closer look at Instagram's data policy.

TikTok privacy policy

TikTok privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: optimising our service 📓 Data processed: e.g. your IP address, browser data, date and time of your page view may be stored You can find more details further down in the privacy policy. 📅 Storage period: varies depending on the settings ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is TikTok?

We use the TikTok integration on our website. The service provider is the Chinese company Beijing Bytedance Technology Ltd. For the European region, the Irish company TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, is responsible. TikTok is a social media platform that is especially popular with young people, on which users can create, share and watch short video clips.

In this privacy policy we inform you which data is processed by TikTok, how long the data is stored and how you can manage your privacy settings.

Why do we use TikTok on our website?

We have integrated TikTok into our website so that you can watch TikTok videos if you feel like it and interact with the videos if necessary. TikTok is particularly known for funny and creative content, and of course we don't want to withhold such content from you. After all, we also like to watch one or two creative TikTok videos ourselves.

What data is processed by TikTok?

When you watch or interact with TikTok videos on our website, TikTok may collect information about your usage behaviour and your device. This can include data such as your IP address, browser type, operating system, location and other technical information. TikTok may also use cookies and similar technologies to collect information and personalise your user experience.

If you have a TikTok account yourself, further information may also be collected and processed. This includes user information (such as name, date of birth or your email address) and data about your communication with other TikTok users.

How long and where is the data stored?

The storage period and storage locations of the data collected by TikTok can vary greatly and are subject to TikTok's privacy policy. TikTok may also store data on servers in the USA and other countries. The storage period is generally based on the respective legal requirements and internal guidelines. However, we have not yet been able to find out exactly how long data is stored. As soon as we have more detailed information, we will of course inform you.

How can I delete my data or prevent data storage?

If you have a TikTok account, you can manage your privacy settings directly on TikTok. For example, you can specify in the settings of your TikTok account which information may and may not be shared. In addition, you can manage and deactivate cookies in your web browser to limit data collection. This is of course also possible without a TikTok account. Please note, however, that this may affect the functionality of our website and your TikTok experience.

Legal basis

If you have consented to your data being processed and stored by TikTok, this consent is the legal basis for the data processing (Art. 6(1)(a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in fast and good communication with you or other customers and business partners. Nevertheless, we only use the integrated social media elements insofar as you have given your consent. TikTok may also set cookies in your browser to store data. We therefore recommend that you read our privacy text on cookies carefully and look at the privacy policy or cookie policy of the respective service provider.

TikTok also processes your data in the USA, among other places. We would like to point out that, according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may involve various risks for the lawfulness and security of the data processing.

As the basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, i.e. in particular in the USA) or for data transfers there, TikTok uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through these clauses, TikTok undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find more information on TikTok's privacy policy and the collection of data by TikTok on the TikTok website at https://www.tiktok.com/legal/page/eea/privacy-policy/en as well as in the general information about TikTok at https://www.tiktok.com/en/.

Online marketing introduction

Online marketing privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: evaluating visitor information to optimise the website. 📓 Data processed: access statistics containing data such as access locations, device data, access duration and time, navigation behaviour, click behaviour and IP addresses. Personal data such as name or email address may also be processed. You can find more details from the online marketing tool used. 📅 Storage period: depends on the online marketing tools used ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is online marketing?

Online marketing refers to all measures carried out online to achieve marketing goals such as increasing brand awareness or closing a deal. Furthermore, our online marketing measures aim to draw people's attention to our website. In order to show our offer to many interested people, we therefore carry out online marketing. This is usually online advertising, content marketing or search engine optimisation. So that we can use online marketing efficiently and in a targeted manner, personal data is also stored and processed. On the one hand, the data helps us to show our content only to those people who are really interested in it, and on the other hand we can measure the advertising success of our online marketing measures.

Why do we use online marketing tools?

We want to show our website to everyone who is interested in our offer. We are aware that this is not possible without deliberate measures. That is why we do online marketing. There are various tools that make working on our online marketing measures easier for us and also always provide suggestions for improvement based on data. This allows us to target our campaigns more precisely at our target group. The purpose of these online marketing tools is therefore ultimately to optimise our offer.

What data is processed?

In order for our online marketing to work and for the success of the measures to be measured, user profiles are created and data is stored, for example, in cookies (small text files). With the help of this data, we can not only place advertising in the classic sense, but also present our content directly on our website in the way you like best. There are various third-party tools that offer these functions and accordingly also collect and store your data. The cookies mentioned store, for example, which pages you visited on our website, how long you viewed these pages, which links or buttons you click or from which website you came to us. Technical information may also be stored, such as your IP address, which browser you use, from which device you visit our website or the time when you accessed our website and when you left it again. If you have agreed that we may also determine your location, we can also store and process this.

Your IP address is stored in pseudonymised form (i.e. shortened). Unique data that directly identifies you as a person, such as name, address or email address, is also only stored in pseudonymised form as part of the advertising and online marketing procedures. We therefore cannot identify you as a person, but only have the pseudonymised information stored in the user profiles.

Under certain circumstances, the cookies may also be used, analysed and used for advertising purposes on other websites that work with the same advertising tools. The data may then also be stored on the servers of the advertising tool providers.

In exceptional cases, unique data (names, email address, etc.) may also be stored in the user profiles. This storage occurs, for example, if you are a member of a social media channel that we use for our online marketing measures and the network links previously received data with the user profile.

With all the advertising tools we use that store your data on their servers, we only ever receive summarised information and never data that makes you recognisable as an individual. The data only shows how well placed advertising measures worked. For example, we see which measures prompted you or other users to come to our website and purchase a service or product there. On the basis of the analyses, we can improve our advertising in the future and adapt it even more precisely to the needs and wishes of interested people.

Duration of data processing

We will inform you about the duration of the data processing below, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. Data stored in cookies is stored for different lengths of time. Some cookies are deleted as soon as you leave the website, others can be stored in your browser for several years. The privacy policies of the individual providers usually give you exact information about the individual cookies the provider uses.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser. The lawfulness of processing up to the revocation remains unaffected.

As cookies can generally be used with online marketing tools, we also recommend our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal basis

If you have consented to the use of third-party providers, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent) , this consent constitutes the legal basis for the processing of personal data as may occur when collected by online marketing tools.

We also have a legitimate interest in measuring online marketing measures in anonymised form in order to optimise our offer and our measures with the help of the data obtained. The corresponding legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use the tools insofar as you have given your consent.

Information on specific online marketing tools can be found – if available – in the following sections.

Google AdMob privacy policy

We use Google AdMob, a tool for mobile advertising, on our website. The service provider is the American company Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.

Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the data processing terms for Google advertising products (Google Ads Controller-Controller Data Protection Terms), which refer to the standard contractual clauses, at https://business.safety.google/intl/de/adsprocessorterms/.

You can find out more about the data processed through the use of Google AdMob in the privacy policy at https://policies.google.com/privacy?hl=de.

Google Marketing Platform (formerly DoubleClick) privacy policy

We use Google Marketing Platform products on our website. These include various marketing tools such as Data Studio, Surveys, Campaign Manager 360, Display & Video 360 or Search Ads 360. The service provider is the American company Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.

Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the Google Ads Data Processing Terms, which refer to the standard contractual clauses, at https://business.safety.google/intl/de/adsprocessorterms/.

You can find out more about the data processed through the use of Google Marketing Platform products in the privacy policy at https://policies.google.com/privacy?hl=de.

Cookie consent management platform introduction

Cookie consent management platform summary 👥 Data subjects: website visitors 🤝 Purpose: obtaining and managing consent to certain cookies and thus the use of certain tools 📓 Data processed: data for managing the chosen cookie settings such as IP address, time of consent, type of consent, individual consents. You can find more details from the tool used. 📅 Storage period: depends on the tool used; you should expect periods of several years ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is a cookie consent management platform?

We use consent management platform (CMP) software on our website, which makes it easier for us and you to handle the scripts and cookies used correctly and securely. The software automatically creates a cookie pop-up, scans and controls all scripts and cookies, offers you the cookie consent required under data protection law and helps us and you keep an overview of all cookies. Most cookie consent management tools identify and categorise all existing cookies. You as a website visitor then decide for yourself whether and which scripts and cookies you allow or do not allow.

Why do we use a cookie management tool?

Our aim is to offer you the best possible transparency in the area of data protection. We are also legally obliged to do so. We want to inform you as well as possible about all tools and all cookies that can store and process your data. It is also your right to decide for yourself which cookies you accept and which you do not. In order to grant you this right, we first need to know exactly which cookies have ended up on our website at all. Thanks to a cookie management tool that regularly scans the website for all existing cookies, we know about all cookies and can give you GDPR-compliant information about them. You can then accept or reject cookies via the consent system.

What data is processed?

With our cookie management tool, you can manage each individual cookie yourself and have complete control over the storage and processing of your data. The declaration of your consent is stored so that we do not have to ask you every time you visit our website and so that we can also prove your consent if required by law. This is stored either in an opt-in cookie or on a server. The storage period of your cookie consent varies depending on the provider of the cookie management tool. This data (such as pseudonymous user ID, time of consent, details of the cookie categories or tools, browser, device information) is usually stored for up to two years.

Duration of data processing

We will inform you about the duration of the data processing below, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. Data stored in cookies is stored for different lengths of time. Some cookies are deleted as soon as you leave the website, others can be stored in your browser for several years. The exact duration of the data processing depends on the tool used; in most cases you should expect a storage period of several years. The privacy policies of the individual providers usually give you exact information about the duration of the data processing.

Right to object

You also have the right and the option to revoke your consent to the use of cookies at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser.

Information on specific cookie management tools can be found – if available – in the following sections.

Legal basis

If you agree to cookies, your personal data is processed and stored via these cookies. If we are allowed to use cookies through your Consent (Article 6(1)(a) GDPR), this consent is also the legal basis for the use of cookies and the processing of your data. Cookie consent management platform software is used to manage consent to cookies and to enable you to give your consent. The use of this software enables us to operate the website efficiently and in compliance with the law, which constitutes a legitimate interest (Art. 6(1)(f) GDPR).

CookieYes privacy policy

We use a cookie consent manager tool called CookieYes on our website. This tool is provided by CookieYes Limited, based at 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. You can find more information about the data processed by CookieYes in the privacy policy at https://www.cookieyes.com/privacy-policy/.

Cloud services

Cloud services privacy policy summary 👥 Data subjects: we as the website operator and you as a website visitor 🤝 Purpose: security and data storage 📓 Data processed: data such as your IP address, name or technical data such as browser version You can find more details below and in the individual privacy texts or in the providers' privacy policies 📅 Storage period: in most cases the data is stored until it is no longer needed to provide the service ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are cloud services?

Cloud services provide us as the website operator with storage space and computing power via the internet. Data can be transferred to an external system, processed and stored via the internet. The respective cloud provider takes care of managing this data. Depending on requirements, an individual or a company can choose the size of the storage space or the computing power. Cloud storage is accessed via an API or via storage protocols. API stands for application programming interface, a programming interface that connects software with hardware components.

Why do we use cloud services?

We use cloud services for several reasons. A cloud service gives us the opportunity to store our data securely. In addition, we have access to the data from different locations and devices and thus have more flexibility and make our work processes easier. Cloud storage also saves us costs because we do not have to set up and manage our own infrastructure for data storage and data security. By storing our data centrally in the cloud, we can also expand our fields of application and manage our information much better.

We as the website operator or as a company therefore use cloud services primarily for our own purposes. For example, we use the services to manage our calendar or to store documents or other important information in the cloud. However, your personal data may also be stored in the process. This is the case, for example, if you provide us with your contact details (such as name and email address) and we store our customer data with a cloud provider. Consequently, data that we process about you may also be stored and processed on external servers. If we offer certain forms or content from cloud services on our website, cookies may also be set for web analysis and advertising purposes. Furthermore, such cookies remember your settings (such as the language used) so that you find your usual web environment the next time you visit our website.

What data is processed by cloud services?

Much of the data we store in the cloud has no personal reference, but some data is personal data according to the GDPR definition. Often this is customer data such as name, address, IP address or phone number, or technical device information. Videos, images and audio files can also be stored in the cloud. Exactly how the data is collected and stored depends on the respective service. We try to use only services that handle data in a very trustworthy and professional manner. In principle, the services, such as Amazon Drive, have access to the stored files in order to be able to offer their own service accordingly. However, the services need permissions for this, such as the right to copy files for security reasons. This data is processed and managed within the framework of the services and in compliance with the applicable laws. For US providers, this also includes the GDPR (via the standard contractual clauses). In some cases, these cloud services also work with third-party providers who can process data under instruction and in accordance with the privacy policies and other security measures. We would like to emphasise once again at this point that all well-known cloud services (such as Amazon Drive, Google Drive or Microsoft OneDrive) obtain the right to access stored content in order to be able to offer and optimise their own service accordingly.

Duration of data processing

We will inform you about the duration of the data processing below, provided we have further information on this. In general, cloud services store data until you or we revoke the data storage or delete the data again. In general, personal data is only stored for as long as is absolutely necessary to provide the services. However, final deletion of data from the cloud can take several months. This is because the data is usually not stored on just one server but is distributed across different servers.

Right to object

You also have the right and the option to revoke your consent to data storage in a cloud at any time. If cookies are used, you also have a right of revocation here. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser. We also recommend our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective cloud providers.

Legal basis

We use cloud services mainly on the basis of our legitimate interests (Art. 6(1)(f) GDPR) in a good security and storage system.

Certain processing, in particular the use of cookies and the use of storage functions, requires your consent. If you have consented to your data being processed and stored by cloud services, this consent is the legal basis for the data processing (Art. 6(1)(a) GDPR). Most of the services we use set cookies in your browser to store data. We therefore recommend that you read our privacy text on cookies carefully and look at the privacy policy or cookie policy of the respective service provider.

Information on specific tools can be found – if available – in the following sections.

Google Cloud privacy policy

We use Google Cloud, an online storage service for files, photos and videos, for our website. The service provider is the American company Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.

Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

Google provides a data processing agreement in accordance with Art. 28 GDPR, which serves as the legal basis under data protection law for our customer relationship with Google. In terms of content, it refers to the EU standard contractual clauses. You can find the data processing terms here: https://business.safety.google/intl/de/adsprocessorterms/

You can find out more about the data processed through the use of Google Cloud in the privacy policy at https://policies.google.com/privacy?hl=de.

Web design introduction

Web design privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: improving the user experience 📓 Data processed: which data is processed depends heavily on the services used. It is usually IP address, technical data, language settings, browser version, screen resolution and name of the browser. You can find more details from the respective web design tools used. 📅 Storage period: depends on the tools used ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is web design?

We use various tools on our website that serve our web design. Web design is not just about making our website look pretty, as is often assumed, but also about functionality and performance. But of course the right look of a website is also one of the big goals of professional web design. Web design is a sub-area of media design and deals with the visual as well as the structural and functional design of a website. The aim is to use web design to improve your experience on our website. In web design jargon, this is referred to as user experience (UX) and usability. User experience means all the impressions and experiences that the website visitor has on a website. A sub-point of user experience is usability, which is about the user-friendliness of a website. The main emphasis here is on content, subpages or products being clearly structured so that you can find what you are looking for easily and quickly. In order to offer you the best possible experience on our website, we also use so-called web design tools from third-party providers. The category “web design” in this privacy policy therefore covers all services that improve the design of our website. These can be, for example, fonts, various plugins or other integrated web design functions.

Why do we use web design tools?

How you take in information on a website depends very much on the structure, functionality and visual perception of the website. That is why good and professional web design has become increasingly important for us too. We are constantly working on improving our website and also see this as an extended service for you as a website visitor. Furthermore, an attractive and functioning website also has economic advantages for us. After all, you will only visit us and use our offers if you feel completely comfortable.

What data is stored by web design tools?

When you visit our website, web design elements may be integrated into our pages that can also process data. Exactly which data is involved naturally depends heavily on the tools used. Below you can see exactly which tools we use for our website. For more detailed information about data processing, we also recommend that you read the privacy policy of the respective tools used. There you will usually find out which data is processed, whether cookies are used and how long the data is kept. Fonts such as Google Fonts, for example, also automatically transfer information such as language settings, IP address, browser version, screen resolution of the browser and name of the browser to the Google servers.

Duration of data processing

How long data is processed is very individual and depends on the web design elements used. If cookies are used, for example, the retention period can be just one minute but also a few years. Please find out about this. For this, we recommend on the one hand our general section on cookies and the privacy policies of the tools used. There you will usually find out exactly which cookies are used and which information is stored in them. Google font files, for example, are stored for one year. This is intended to improve the loading time of a website. In principle, data is only ever kept for as long as is necessary to provide the service. If required by law, data may also be stored for longer.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. This works either via our cookie management tool or via other opt-out functions. You can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser. With web design elements (mostly fonts), however, there is also data that cannot be deleted quite so easily. This is the case when data is automatically collected directly when a page is accessed and transmitted to a third-party provider (such as Google). In that case, please contact the support of the respective provider. In the case of Google, you can reach support at https://support.google.com/?hl=de.

Legal basis

If you have consented to the use of web design tools, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data as may occur when collected by web design tools. We also have a legitimate interest in improving the web design on our website. After all, this is the only way we can provide you with an attractive and professional website. The corresponding legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use web design tools insofar as you have given your consent. We definitely want to emphasise this again here.

Information on specific web design tools can be found – if available – in the following sections.

Adobe Fonts privacy policy

We use Adobe Fonts, a web font hosting service, on our website. The service provider is the American company Adobe Inc. For the European region, the Irish company Adobe Systems Software Ireland Companies, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, is responsible.

Adobe also processes your data in the USA, among other places. Adobe is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Adobe uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Adobe undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find more information on Adobe's standard contractual clauses at https://www.adobe.com/at/privacy/eudatatransfers.html.

You can find out more about the data processed through the use of Adobe Fonts in the privacy policy at https://www.adobe.com/at/privacy.html .

Google Fonts privacy policy

Google Fonts privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: optimising our service 📓 Data processed: data such as IP address and CSS and font requests You can find more details further down in this privacy policy. 📅 Storage period: font files are stored by Google for one year ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are Google Fonts?

We use Google Fonts on our website. These are the “Google fonts” of Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.

You do not need to register or enter a password to use Google fonts. Furthermore, no cookies are stored in your browser. The files (CSS, fonts) are requested via the Google domains fonts.googleapis.com and fonts.gstatic.com. According to Google, the requests for CSS and fonts are completely separate from all other Google services. If you have a Google account, you don't need to worry that your Google account data will be transmitted to Google while using Google Fonts. Google records the use of CSS (Cascading Style Sheets) and the fonts used and stores this data securely. We will take a detailed look at exactly what the data storage looks like.

Google Fonts (formerly Google Web Fonts) is a directory of over 800 fonts that Google makes available to its users free of charge.

Many of these fonts are published under the SIL Open Font License, while others are published under the Apache License. Both are free software licences.

Why do we use Google Fonts on our website?

With Google Fonts we can use fonts on our own website without having to upload them to our own server. Google Fonts is an important building block in keeping the quality of our website high. All Google fonts are automatically optimised for the web, which saves data volume and is a great advantage especially for use on mobile devices. When you visit our site, the small file size ensures a fast loading time. Furthermore, Google Fonts are secure web fonts. Different rendering systems in different browsers, operating systems and mobile devices can lead to errors. Such errors can visually distort texts or entire web pages. Thanks to the fast content delivery network (CDN), there are no cross-platform problems with Google Fonts. Google Fonts supports all common browsers (Google Chrome, Mozilla Firefox, Apple Safari, Opera) and works reliably on most modern mobile operating systems, including Android 2.2+ and iOS 4.2+ (iPhone, iPad, iPod). We therefore use Google Fonts so that we can present our entire online service as attractively and consistently as possible.

What data is stored by Google?

When you visit our website, the fonts are loaded via a Google server. Through this external request, data is transmitted to the Google servers. This is how Google also recognises that you or your IP address are visiting our website. The Google Fonts API was developed to reduce the use, storage and collection of end-user data to what is necessary for the proper provision of fonts. API, by the way, stands for “application programming interface” and serves, among other things, as a data transmitter in the software sector.

Google Fonts stores CSS and font requests securely at Google and is therefore protected. Through the collected usage figures, Google can determine how well the individual fonts are received. Google publishes the results on internal analysis pages such as Google Analytics. Google also uses data from its own web crawler to determine which websites use Google fonts. This data is published in the Google Fonts BigQuery database. Entrepreneurs and developers use the Google web service BigQuery to examine and move large amounts of data.

However, it should be borne in mind that with every Google Font request, information such as language settings, IP address, browser version, screen resolution of the browser and name of the browser is automatically transmitted to the Google servers. Whether this data is also stored cannot be clearly determined or is not clearly communicated by Google.

How long and where is the data stored?

Google stores requests for CSS assets for one day on its servers, which are mainly located outside the EU. This enables us to use the fonts with the help of a Google stylesheet. A stylesheet is a style template that can be used to quickly and easily change, for example, the design or font of a website.

The font files are stored by Google for one year. Google's aim is to improve the loading time of websites in general. If millions of websites refer to the same fonts, they are cached after the first visit and appear immediately again on all other websites visited later. Google sometimes updates font files to reduce file size, increase language coverage and improve design.

How can I delete my data or prevent data storage?

The data that Google stores for one day or one year cannot simply be deleted. The data is automatically transmitted to Google when the page is accessed. In order to delete this data early, you must contact Google support at https://support.google.com/?hl=de&tid=112663248 . In this case, you can only prevent data storage by not visiting our site.

Unlike other web fonts, Google allows us unrestricted access to all fonts. We can therefore access a sea of fonts without limit and get the best out of our website. You can find more about Google Fonts and other questions at https://developers.google.com/fonts/faq?tid=112663248. Although Google addresses data protection matters there, it does not contain really detailed information about data storage. It is relatively difficult to get really precise information about stored data from Google.

Legal basis

If you have consented to the use of Google Fonts, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent) , this consent constitutes the legal basis for the processing of personal data as may occur when collected by Google Fonts.

We also have a legitimate interest in using Google Fonts to optimise our online service. The corresponding legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use Google Fonts insofar as you have given your consent.

Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the Google Ads Data Processing Terms, which refer to the standard contractual clauses, at https://business.safety.google/intl/de/adsprocessorterms/.

You can also find out which data is generally collected by Google and what this data is used for at https://www.google.com/intl/de/policies/privacy/ read it.

Google Fonts (local) privacy policy

We use Google Fonts from Google Inc. on our website. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible. We have integrated the Google fonts locally, i.e. on our web server – not on Google's servers. As a result, there is no connection to Google servers and therefore no data transfer or storage.

What are Google Fonts?

Google Fonts used to be called Google Web Fonts. It is an interactive directory of over 800 fonts that Google provides free of charge. With Google Fonts, you could use fonts without uploading them to your own server. However, to prevent any transfer of information to Google servers in this regard, we have downloaded the fonts to our server. In this way, we act in compliance with data protection and do not pass any data on to Google Fonts.

Online booking systems introduction

Online booking systems privacy policy summary 👥 Data subjects: website visitors 🤝 Purpose: improving the user experience and organisation 📓 Data processed: which data is processed depends heavily on the services used. It is usually IP address, contact and payment data and/or technical data. You can find more details from the respective tools used. 📅 Storage period: depends on the tools used ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is an online booking system?

So that you can make bookings via our website, we use one or more booking systems. Appointments, for example, can be created very easily online in this way. A booking system is a software application integrated into our website that shows available resources (such as free appointments) and through which you can book directly online and usually also pay. You probably already know such booking systems from restaurants or hotels. Nowadays, however, such systems are used in a wide range of industries. Depending on the tool and settings, booking systems can be used both internally by us and by customers like you. As a rule, personal data is also collected and stored.

Booking usually works as follows: you find the booking system on our website, where you can book an appointment for a service directly with a mouse click and by entering your details, and usually pay straight away. You may be able to enter various details about yourself via a form. Please be aware that all data you enter can be stored and managed in a database.

Why do we use an online booking system?

In a way, we also see our website as a free service for you. You should receive helpful information and feel completely comfortable on our site. This also includes an online service that makes booking appointments or services as easy as possible for you. Gone are the days when you had to wait days for a booking confirmation via phone or email. With an online booking system, you have done everything in just a few clicks and can get on with other things. The system also makes it easier for us to manage all bookings and appointments. We therefore consider such a booking system to be absolutely sensible both for you and for us.

What data is processed?

Of course, we cannot tell you exactly which data is processed in this general information text about booking systems. This always depends on the tool used and the functions and options it contains. In addition to the conventional booking function, many booking systems also offer a range of other features. For example, many systems also have an external online payment system (e.g. from Stripe, Klarna or PayPal) and a calendar synchronisation function integrated. Accordingly, different types and amounts of data may be processed depending on the functions. Usually, data such as IP address, name and contact details, technical information about your device and the time of a booking is processed. If you also make a payment in the system, bank details such as account number, credit card number, passwords, TANs, etc. are also stored and passed on to the respective payment provider. We recommend that you carefully read the privacy policy of the tool used so that you know exactly which of your data is processed.

Duration of data processing

Each booking system stores data for a different length of time. We therefore cannot give any specific information about the duration of the data processing here. In principle, however, personal data is only ever stored for as long as is absolutely necessary to provide the services. Booking systems usually also use cookies, which store information for different lengths of time. Some cookies are deleted immediately after leaving the site, others can be stored for several years. You can find out more about this in our “Cookies” section. Please also look at the respective privacy policies of the providers. They should explain how long your data is stored in the specific case.

Right to object

If you have consented to data processing by a booking system, you of course always have the option and the right to revoke this consent. Please always be aware that you have rights in relation to your personal data and can exercise these rights at any time. If you do not want personal data to be processed, then no personal data may be processed. It's that simple. The easiest way to revoke data processing is via a cookie consent tool or via other opt-out functions offered. You can also manage data storage by cookies directly in your browser, for example. The lawfulness of the data processing remains unaffected until your revocation.

Legal basis

If you have consented to the use of booking systems, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent), it constitutes the legal basis for the processing of personal data as may occur through booking systems.

Furthermore, we also have a legitimate interest in using booking systems, because on the one hand we expand our customer service and on the other hand we optimise our internal booking organisation. The corresponding legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use the tools insofar as you have given your consent. We definitely want to state this again at this point.

Information on specific booking systems can be found – if available – in the following sections.

Amelia WP Booking Plugin privacy policy

We use the Amelia WP Booking Plugin, an appointment and organisation solution for our website. The service provider of Amelia is Touch Me Soft doo, with its registered office at Milutina Milankovica Street No. 11B, Belgrade, Serbia (hereinafter: “TMS”, “we” or “us”).

Please note that TMS, as data controller, processes your personal data in connection with the interaction on our website and the service. This serves to provide the service and to manage the website.

The TMS privacy policy, which applies from 01.05.2021, contains detailed information on how TMS collects and processes your personal data. We strongly recommend that you read the TMS privacy policy and make sure that you fully understand and accept it. You can view the full TMS privacy policy at https://wpamelia.com/ view it.

This privacy policy applies to all persons who access our website at https://wpamelia.com/privacy-policy/ , send us enquiries via the website or subscribe to our service. Please read this privacy policy together with our cookie policy, as it constitutes an agreement that applies to you.

If you have questions about the TMS privacy policy, you can contact TMS at support@tms-outsource.com .

Explanation of terms used

We always endeavour to write our privacy policy as clearly and comprehensibly as possible. However, this is not always easy, especially with technical and legal topics. It often makes sense to use legal terms (such as personal data) or certain technical expressions (such as cookies, IP address). However, we do not want to use them without explanation. Below you will find an alphabetical list of important terms used that we may not yet have sufficiently addressed in the privacy policy so far. If these terms were taken from the GDPR and are definitions, we will also quote the GDPR texts here and add our own explanations where necessary.

Processor

Definition according to Article 4 GDPR

For the purposes of this Regulation, the term means:

“Processor” a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data that we process about you. In addition to controllers, there may also be so-called processors. This includes every company or person that processes personal data on our behalf. In addition to service providers such as tax advisers, processors can therefore also be hosting or cloud providers, payment or newsletter providers or large companies such as Google or Microsoft.

Consent

Definition according to Article 4 GDPR

For the purposes of this Regulation, the term means:

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: On websites, such consent is usually given via a cookie consent tool. You are certainly familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree or consent to the data processing. In most cases you can also make individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data about you may be processed. In principle, consent can of course also be given in writing, i.e. not via a tool.

Personal data

Definition according to Article 4 GDPR

For the purposes of this Regulation, the term means:

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation: Personal data is therefore all data that can identify you as a person. This is usually data such as:

• Name
• Location
• Email address
• Postal address
• Phone
• Date of birth
• identification numbers such as social security number, tax identification number, ID card number or student number
• bank details such as account number, credit information, account balances and much more.

According to the European Court of Justice (ECJ), your IP address is also personal data. IT experts can use your IP address to determine at least the approximate location of your device and subsequently you as the connection owner. Storing an IP address therefore also requires a legal basis within the meaning of the GDPR. There are also so-called “Special categories” of personal data, which are particularly worthy of protection. These include:

• racial and ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data such as data taken from blood or saliva samples
• biometric data (information on psychological, physical or behavioural characteristics that can identify a person).
  health data
• data concerning sexual orientation or sex life

Profiling

Definition according to Article 4 GDPR

For the purposes of this Regulation, the term means:

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

Explanation: Profiling involves gathering various pieces of information about a person in order to learn more about that person. On the web, profiling is often used for advertising purposes or for credit checks. Web or advertising analysis programs, for example, collect data about your behaviour and interests on a website. This results in a special user profile, which can be used to target advertising at a specific audience.

Controller

Definition according to Article 4 GDPR

For the purposes of this Regulation, the term means:

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Explanation: In our case, we are responsible for the processing of your personal data and are therefore the “controller”. If we pass on collected data to other service providers for processing, they are “processors”. For this, a “data processing agreement (DPA)” must be signed.

Processing

Definition according to Article 4 GDPR

For the purposes of this Regulation, the term means:

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we speak of processing in our privacy policy, we mean any type of data processing. As mentioned above in the original GDPR definition, this includes not only the collection but also the storage and processing of data.

Closing remarks

Congratulations! If you are reading these lines, you have really “fought” your way through our entire privacy policy or at least scrolled down this far. As you can see from the length of our privacy policy, we take the protection of your personal data anything but lightly.
It is important to us to inform you about the processing of personal data to the best of our knowledge and belief. We not only want to tell you which data is processed, but also explain the reasons for using various software programs. Privacy policies usually sound very technical and legal. However, as most of you are not web developers or lawyers, we also wanted to take a different approach linguistically and explain the facts in simple and clear language. Of course, this is not always possible due to the subject matter. The most important terms are therefore explained in more detail at the end of the privacy policy.
If you have any questions about data protection on our website, please do not hesitate to contact us or the responsible office. We wish you a pleasant time and hope to welcome you back to our website soon.

All texts are protected by copyright.

Source: created in part with the privacy policy generator by AdSimple