Luttersche Straße 8A
Phone: +49 40 75270650
Fax: +49 40 75270660
Executive Board: John Heidrich
Supervisory Board: Jonas Hary, Patrick Kriener
Types of data processed:
– Master data (for example, names, addresses).
– Contact details (e.g., e-mail, telephone numbers).
– Content data (e.g., text input, photographs, videos).
– Usage data (e.g., visited websites, interest in content, access times).
– Meta/communication data (e.g., device information, IP addresses).
Categories of data subjects
Besucher und Nutzer des Onlineangebotes (Nachfolgend bezeichnen wir die betroffenen Personen zusammenfassend auch als „Nutzer“).
– Provision of the online content, their functions and contents.
– Responding to contact requests and communication with users.
– Security measures.
– Reach measurement/marketing
“Personal data” refers to all information relating to an identified or identifiable natural person (hereinafter a “data subject”); a natural person is regarded as identifiable, if they can be directly or indirectly identified, especially by means of association with an identifier such as a name, with an identification number, with location data, with an online ID (e.g. cookies) or with one or several special features reflecting the physical, physiological, genetic, psychic, economic, cultural or social identity of that natural person.
“Processing” means any operation or series of operations carried out with or without the aid of automated procedures relating to personal data. The term is broad and covers virtually every aspect of dealing with data.
“Pseudonymisation” means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” means any automated processing of personal data consisting in the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or relocation of that natural person.
“Controller” refers to the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person, authority, institution or other body processing personal data on behalf of the controller.
Primary legal bases
We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the different probability of occurrence and severity of the risk to the rights and freedoms of natural persons, in accordance with Art. 32 GDPR.
Such measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, transmission, security of availability and its separation. Furthermore, we have established procedures that guarantee the exercise of data subjects’ rights, erasure of data and reaction to data risks. In addition, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default (Art. 25 GDPR).
Work with processors and third parties
If we disclose data to other persons and companies (processors or third parties) within the scope of our processing, transmit the data to them or otherwise grant them access to the data, this shall only take place on the basis of legal permission (e.g. if a transmission of the data to third parties, such as payment service providers, in accordance with Art. 6(1)(b) GDPR is necessary for performance of the contract), if you have consented, if a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).
If we commission third parties to process data on the basis of a so-called “contract data processing agreement”, this is done on the basis of Art. 28 GDPR.
Data transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services or disclosure or transfer of data to third parties, this will only be done if it occurs for the fulfilment of our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we only process the data in a third country or have the data processed in a third country if the particular requirements of Art. 44 ff. GDPR are met. This means, for example, processing is carried out on the basis of special guarantees, such as the officially recognised determination of a data protection level corresponding to the EU (e.g. for the USA by the “Privacy Shield”) or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).
Rights of data subjects
You have the right to request confirmation as to whether the data concerned is being processed and to request information about this data as well as further information and a copy of the data in accordance with Art. 15 GDPR.
In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
In accordance with Art. 17 GDPR, you have the right to demand that relevant data be erased immediately or, alternatively, to demand a restriction on the processing of the data in accordance with Art. 18 GDPR.
In accordance with Art. 20 GDPR, you have the right to request to receive data concerning you that you have provided to us and to request the transmission of this data to other controllers.
Furthermore, in accordance with Art. 77 GDPR you have the right to lodge a complaint with the competent supervisory authority.
Right of revocation
You have the right to revoke your consent according Art. 7(3) GDPR with effect for the future.
Right to object
You can object to the future processing of the data concerning you in accordance with Art. 21 GDPR at any time. In particular, you may object to processing for direct marketing purposes.
Cookies and right to object to direct advertising
“Cookies” refer to small files that are stored on the user’s computer. Different data can be stored within the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes their browser. For example, the content of a shopping cart in an online shop or the login status can be stored in a cookie of this nature. Cookies are referred to as “permanent” or “persistent” if they remain saved even after the browser is closed. For example, the login status can be saved if users visit a site even after several days have passed. Likewise, interests expressed by users may be stored in such a cookie for purposes of reach measurement or marketing purposes. “Third-party cookies” are cookies that are offered by providers other than the controller who operates the online offering (otherwise, if the only cookies are run by the controller, they are referred to as “first-party cookies”).
Erasure of data
According to applicable legal requirements in Germany, data is stored in particular for 10 years in accordance with sections 147 (1) German Fiscal Code (AO), section 257 (1) no. 1 and 4, (4) German Commercial Code (HGB) (books, records, management reports, accounting documents, trading books, documents relevant for taxation, etc.) and 6 years in accordance with section 257 (1) no. 2 and 3, (4) HGB (commercial letters).
In accordance with legal requirements in Austria, data is stored in particular for 7 years in accordance with section 132 (1) Federal Fiscal Code (BAO) (accounting documents, receipts/invoices, accounts, receipts, business papers, statement of income and expenses, etc.), for 22 years in connection with real estate and for 10 years for documents in connection with electronically provided services, telecommunications, radio and television services which are provided to non-entrepreneurs in EU member states and for which the Mini-One-Stop-Shop (MOSS) is used.
When contacting us (e.g. by contact form, e-mail, telephone or via social media), the user’s details are stored for the processing of the contact enquiry and its handling pursuant to Art. 6(1)(b) (within the scope of contractual/pre-contractual relationships) and Art. 6(1)(f) GDPR (other inquiries). User information can be stored in a Customer Relationship Management System (“CRM system”) or comparable enquiry organisation system.
We delete the requests if they are no longer necessary. We review this necessity every two years; the statutory archiving obligations also apply.
The following is to inform you about our newsletter, its content and procedures regarding registration, distribution and statistical evaluation, as well as your rights to object. By subscribing to our newsletter, you agree to receive the newsletter and agree to the related procedures for its distribution, etc.
Newsletter content: We send newsletters, emails and other electronic notifications containing advertising information (hereinafter referred to as “newsletters”) only with the express consent of recipients or with statutory permission. If registration for the newsletter involves a specific description of its content, then this description is the basis on which users agree to receive newsletters. In addition, our newsletters contain information about our services and us.
Double opt-in and logging: Subscription to our newsletter takes place using a process known as double opt-in. This means that after registration you will receive an e-mail asking you to confirm your registration. The confirmation is required to ensure that no one else can subscribe using your email address. A record of subscriptions to the newsletter is kept to fulfil the legal requirements for recording the subscription process. The record contains the time of subscription and confirmation as well as the relevant IP address. Any changes to the data registered with the service provider sending the newsletter will also be recorded.
Registration data: To subscribe to the newsletter, simply enter your e-mail address. Optionally, we ask you to enter a name for the newsletter, so that we can address you personally.
The dispatch of the newsletter, and associated performance measurements, are based on the recipient’s consent pursuant to Art. 6(1)(a), Art. 7 GDPR in conjunction with section 7 (2) no. 3 Act against Unfair Competition (UWG) or, if consent is not required, on the basis of our legitimate interests in direct marketing pursuant to Art. 6(1)(f) GDPR in conjunction with section 7 (3) UWG.
The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6 (1)(f) GDPR. Our interest lies in the use of a user-friendly and secure newsletter system, which serves both our business interests and the expectations of the users and also allows us to have verification of consent.
Cancellation/Revocation. You can cancel your subscription to our newsletter at any time by revoking your consent to receive it. You will find a link to unsubscribe at the end of each newsletter. We may store the e-mail addresses we have unsubscribed for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previous grant of consent. Processing of this data is limited to the use in the defence against potential claims. An individual request for deletion can be submitted at any time, provided that, at the same time, the grant of prior consent is confirmed.
Hosting and e-mail delivery
The hosting services we use are in furtherance of the provision of the following services: Infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services that we use for the purpose of operating this online offering.
In this context, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, metadata and communication data of customers, potential customers and visitors to this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering according to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a contract data processing agreement).
Collection of access data and log files
On the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, we, or our hosting provider collect data on each access to the server on which this service is located (so-called server log files). Access data includes the name of the requested website, file, date and time of access, amount of data transferred, report whether the site was successfully retrieved, browser type and version, the user’s operating system, the referrer URL (the site visited before coming to our site), the user’s IP address, and the requesting Internet service provider.
Log file information is stored for a maximum of 7 days for security reasons (e.g. to investigate misuse or fraud) and then deleted. Data, the further storage of which is required for evidence purposes, is excluded from deletion until the relevant incident has been ultimately clarified.
Google Tag Manager
Google is certified under the Privacy Shield Agreement and thus guarantees to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
On our behalf, Google will use this information to evaluate the use of our online content by the user, to compile reports on the activities within our online content and to provide us with other services related to the use of our online content and the Internet. Data processed for these purposes can be used to create pseudonymous usage profiles.
We use Google Analytics only with IP anonymisation enabled. This means that IP addresses of users within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area will be shortened by Google. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and shortened there.
The IP address transmitted by the user’s browser will not be merged with any other Google data. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online content and the processing of this data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
Users’ personal data will be deleted or made anonymous after 14 months.
Google AdWords and Conversion Measurement
We use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”) on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online content within the meaning of Art. 6(1)(f) GDPR).
Google is certified under the Privacy Shield Agreement and thus guarantees to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
We use the online marketing tool Google “AdWords” to place ads in the Google Advertising Network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the ads. This allows us to display ads for and within our online content more specifically in order to present users only ads that potentially correspond to their interests. For example, if a user sees ads for products they had been interested in on other websites, this is referred to as “re-marketing”. For these purposes, when our and other websites on which the Google Advertising Network is active are accessed, Google directly executes a code from Google and (re)marketing tags (invisible graphics or code, also known as “web beacons”) are integrated into the website. These are used to store an individual cookie, i.e. a small file on the user’s device (comparable technologies may also be used instead of cookies). This file keeps a record of which websites the user visited, which content they are interested in and which offers they have clicked on, as well as technical information about the browser and operating system, referring websites, visiting time and further information about the use of the online offering.
We also receive an individual “conversion cookie”. The information collected with the help of cookies is used by Google to generate conversion statistics for us. However, we only see the total number of anonymous users who clicked on our ad and were redirected to a page with a conversion tracking tag. We do not obtain any information that can be used to identify users personally.
User data is processed in pseudonymised form within the Google advertising network. This means that Google does not store and process, for example, the names or e-mail addresses of users, but processes the relevant data cookie-related within pseudonymous user profiles. This means that, from Google’s perspective, the advertisements are not managed and displayed for a specifically identifiable person, but for the holder of the cookie, irrespective of who the holder of this cookie is. This does not apply if a user has expressly permitted Google to process the data without pseudonymisation. The information about the user collected by Google Marketing Services is transferred to Google and stored on Google’s servers in the United States.
Jetpack (WordPress Stats)
We use the Jetpack plugin (in this case the sub-function “Wordpress Stats) which is provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA and includes a tool for statistical analysis of user visits on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online content within the meaning of Art. 6(1)(f) GDPR). Jetpack uses so-called “cookies” which are text files that are stored on your computer and enable to analyse how you use the website.
Online social media profiles
We maintain online profiles on social networks and platforms in order to communicate with active customers, prospective customers and users and to inform them about our services.
Please note that when using social networks, user data may be processed outside of the European Union. This may can pose risks for users because this might hinder the enforcement of users’ rights, for example. With regard to US-based providers certified under the Privacy Shield, please note that they have committed to comply with EU data protection standards.
Furthermore, user data is generally processed for market research and advertising purposes. Thus, for example, user profiles can be created from user behaviour and the resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements inside and outside the platforms that presumably correspond to the interests of the users. To this end, cookies are usually stored on the user’s computer that contain the user’s usage behaviour and interests. Furthermore, data can also be stored in user profiles separate from the devices used by the users (especially if the users are members of the respective platforms and are logged in).
The processing of users’ personal data is carried out on the basis of our legitimate interests in effective user notification and communication with users pursuant to Art. 6(1)(f) GDPR. If the users are asked by the respective providers for consent to data processing (i.e. to give their consent e.g. by ticking a checkbox or clicking on a button), the legal basis of processing is Art. 6(1)(a), Art. 7 GDPR.
For a detailed description of the respective processing and the opportunities to object (opt-out), please refer to the information made available by the respective providers indicated below.
Please note that requests for information and the assertion of user rights may be directed most effectively to the providers. Only the providers have access to user data and can directly take appropriate measures and provide information. You may nevertheless contact us should you still need further assistance.
Integration of third-party services and content
We use content or service offerings of third parties to incorporate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”) into our online content on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online content within the meaning of Art. 6(1)(f) GDPR).
Users should assume that the third parties providing this content can see their IP addresses, since they would not be able to send the content to the users’ browsers without the IP address. The IP address is therefore required for the presentation of the respective content. We strive to only use content whose respective provider uses the IP address solely for the delivery of content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online content, as well as be linked to such information from other sources.
Google Web Fonts
Use of Facebook Social Plugins
We use Social Plugins (“Plugins”) from the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”) on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online content within the meaning of Art. 6(1)(f) GDPR). This may include, for example, content such as images, videos or texts and buttons with which users can share content from our online content within Facebook. The list and appearance of Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/.
Facebook is certified under the Privacy Shield Agreement and thus guarantees to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
When users access a feature of this online offering that contain such a plug-in, their device establishes a direct connection to Facebook’s servers. The content of the plugin is transmitted by Facebook directly to the user’s device and integrated into the online offering. The processed data can be used to create user profiles. We therefore have no influence on the amount of data Facebook collects with the help of this plugin and therefore inform users based on our own information.
By including the plugin, Facebook receives the information that a user has accessed the corresponding page of the online offering. If the user is logged into Facebook, Facebook can associate the user’s visit with the user’s Facebook account. When users interact with the plugins, such as clicking the Like button or posting a comment, the information is sent directly from your device to Facebook and stored there. If a user is not a member of Facebook, it is still possible for Facebook to obtain and store their IP address. According to Facebook, only anonymised IP addresses are stored in Germany.
The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the relevant rights and setting options for the protection of users’ privacy, can be found in Facebook’s data protection information: https://www.facebook.com/about/privacy/.
If a user is a Facebook member and does not want Facebook to collect data about them via this online offering and associate it with their membership data stored on Facebook, they must log out of Facebook before using our online offering and delete cookies. More settings and ways to revoke permission to use your data for advertising purposes are available in your Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US page http://www.aboutads.info/choices/ or the EU page http://www.youronlinechoices.com/. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.