Cloud Services

We use software services that are accessible via the internet and run on the providers’ servers (so-called “cloud services,” also referred to as “Software as a Service”) for the storage and management of content (e.g., document storage and management, the exchange of documents, content, and information with specific recipients, or the publication of content and information).

In this context, personal data may be processed and stored on the providers’ servers, provided that such data is part of communication processes with us or is otherwise processed by us as described in this privacy policy. This data may include, in particular, user master data and contact details, as well as data relating to transactions, contracts, other processes, and their content. Furthermore, the providers of these cloud services process usage data and metadata, which they use for security purposes and to optimize their services.

If we use these cloud services to provide forms or other documents and content for other users or for publicly accessible websites, the providers may store cookies on the users’ devices for purposes such as web analytics or to remember user settings (e.g., in the case of media controls).

• Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image-based messages and posts, as well as information related to them, such as details regarding authorship or the time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, types of devices and operating systems used, and interactions with content and features).
• Data subjects: Prospective customers; communication partners; business and contractual partners.
• Purposes of processing and legitimate interests: Office and organizational procedures; information technology infrastructure (operation and provision of information systems and technical equipment, such as computers, servers, etc.).
• Retention and deletion: Deletion in accordance with the information provided in the section “General information on data storage and deletion.”
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

• Microsoft 365 and Microsoft cloud services: Provision of applications, protection of data and IT systems, and the use of system-generated log, diagnostic, and metadata by Microsoft for the purpose of contract execution.

The data processed includes contact information (name, e-mail address), content (files, comments, profiles), software setup and inventory data, device connectivity and configuration data, work-related interactions (badge swipes), as well as log and metadata. Processing is carried out for the purposes of increasing efficiency and productivity, achieving cost-effectiveness, enhancing flexibility and mobility, improving communication, integrating Microsoft services, ensuring IT security, and facilitating Microsoft’s business operations. Data retention periods depend on the specific documents and company policies; for example, data in Defender (used for protecting data and IT systems) is retained for up to 12 months, while data related to print management is kept for 10 days. Additionally, diagnostic data is collected to ensure product stability and facilitate improvements. Service providers: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f of the GDPR); Website: https://www.microsoft.com/de-de; Privacy statement: https://privacy.microsoft.com/de-de/privacystatement; security information: https://www.microsoft.com/de-de/trustcenter; Data Processing Agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

Newsletter and electronic notifications

We send newsletters, emails, and other electronic notifications (hereinafter referred to as “newsletters”) exclusively with the consent of the recipients or based on a legal authorization. If the content of a newsletter is specified during the subscription process, this content is definitive for the user’s consent. Generally, providing your email address is sufficient to subscribe to our newsletter. However, in order to offer you a personalized service, we may ask for your name—to allow for a personal address within the newsletter—or for other information, provided such data is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may store email addresses that have been unsubscribed for up to three years based on our legitimate interests before deleting them, in order to be able to provide proof of previously granted consent. The processing of this data is limited to the purpose of potentially defending against legal claims. An individual request for deletion is possible at any time, provided that the prior existence of consent is simultaneously confirmed. In cases where there is an obligation to permanently respect an objection (opt-out), we reserve the right to store the email address solely for this purpose in a “blocklist.”

The registration process is logged based on our legitimate interests for the purpose of demonstrating that it was conducted in a proper manner.

Insofar as we engage a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure delivery system.

Content:

Information about us, our services, promotions, and offers.

• Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact details (e.g., postal addresses, email addresses, or phone numbers); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Direct marketing (e.g., via email or post). Reach measurement (e.g., access statistics, recognition of returning visitors).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
• Right to object (opt-out): You may cancel the receipt of our newsletter at any time—that is, revoke your consent or object to receiving further communications. You can find a link to unsubscribe from the newsletter at the end of every newsletter, or you may use one of the contact methods provided above—email being the preferred option—to request an unsubscribe.

Further information on processing operations, procedures, and services:

• Measurement of open and click-through rates: The newsletters contain what are known as “web beacons”—pixel-sized files that are retrieved from our server (or the server of a third-party mailing service provider, if we use one) when the newsletter is opened. During this retrieval process, technical information—such as details about your browser and system—as well as your IP address and the time of access, are collected. This data is used to improve our newsletter from a technical standpoint, to analyze target audiences and reading habits based on access locations (determined via IP address), and to examine access times. This analysis also includes tracking whether and when newsletters are opened, as well as which links are clicked. The collected information is linked to individual newsletter recipients and stored in their respective profiles until such data is deleted. Based on this, user profiles are created that store usage behavior and user characteristics. The measurement of open and click-through rates, the storage of these results within user profiles, and any further processing are carried out based on the user’s consent. It is unfortunately not possible to opt out of this performance tracking separately; to stop it, you must cancel your entire newsletter subscription or object to the subscription as a whole. In such cases, the stored profile information will be deleted; Legal basis:Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
• Brevo: Email delivery and automation services; Service provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.brevo.com/; Privacy policy: https://www.brevo.com/legal/privacypolicy/. Data processing agreement: Provided by the service provider.

Promotional communication via email, post, fax, or telephone

We process personal data for the purpose of promotional communication, which may take place via various channels—such as email, telephone, post, or fax—in accordance with legal requirements.

Recipients have the right to withdraw any consent given or to object to promotional communication at any time, free of charge, by using the contact options mentioned above.

Following a withdrawal of consent or an objection, we will retain the data necessary to prove that the contact or communication was previously authorized. This data will be stored for up to three years after the end of the year in which the withdrawal or objection occurred, based on our legitimate interests. The processing of this data is limited to the purpose of potentially defending against legal claims. Based on our legitimate interest in ensuring that a user’s withdrawal of consent or objection is permanently respected, we also store the data necessary to prevent any further contact (e.g., depending on the communication channel, this may include an email address, phone number, or name).

• Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal addresses, email addresses, or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as authorship or the time of creation).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Direct marketing (e.g., via email or post); marketing; sales promotion.
• Retention and deletion: Deletion in accordance with the information provided in the section “General information on data storage and deletion.”
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Web Analytics, Monitoring, and Optimization

Web analytics (also referred to as “reach measurement”) is used to evaluate visitor traffic to our online services. It may encompass data regarding visitor behavior, interests, or demographic information—such as age or gender—presented as pseudonymous values. Reach analysis allows us, for example, to determine when our online services, or specific features and content within them, are most frequently accessed, or to encourage repeat visits. It also enables us to identify areas that require optimization.

In addition to web analytics, we may employ testing procedures to evaluate and optimize different versions of our online services or specific components thereof.

Unless otherwise stated below, these purposes may involve the creation of profiles—data aggregated in relation to a specific usage process—as well as the storage and subsequent retrieval of information within a browser or on an end device. The data collected typically includes the websites visited and the elements interacted with, alongside technical information such as the browser used, the computer system, and the timing of usage. If users have consented—either to us directly or to the providers of the services we utilize—to the collection of their location data, such data may also be processed.

Furthermore, users’ IP addresses are stored. However, we employ an IP-masking technique (i.e., pseudonymization by truncating the IP address) to protect our users. In general, no personally identifiable information (such as email addresses or names) is stored during web analytics, A/B testing, or optimization processes; instead, pseudonyms are used.

This means that neither we nor the providers of the software used know the actual identity of the users; instead, we only have access to the information stored in their profiles for the purposes of the respective processes.

Information on legal bases: In cases where we ask users for their consent to the use of third-party providers, such consent serves as the legal basis for data processing. Otherwise, user data is processed on the basis of our legitimate interests (i.e., our interest in providing efficient, economical, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies provided elsewhere in this privacy policy.

• Types of data processed: Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing and legitimate interests: Reach measurement (e.g., access statistics, recognition of returning visitors); profiles containing user-related information (creation of user profiles); tracking (e.g., interest-based/behavioral profiling, use of cookies). Provision of our online services and user-friendliness.
• Retention and deletion: Deletion in accordance with the information provided in the section “General information on data storage and deletion.” Storage of cookies for up to 2 years (unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

• Google Tag Manager: We use Google Tag Manager, a software provided by Google that allows us to manage website tags centrally via a user interface. Tags are small code elements on our website used to record and analyze visitor activity. This technology helps us improve our website and the content offered on it. Google Tag Manager itself does not create user profiles, store cookies containing user profiles, or perform independent analyses. Its function is limited to simplifying and streamlining the integration and management of the tools and services we use on our website. Nevertheless, when using Google Tag Manager, users’ IP addresses are transmitted to Google—a technical requirement for implementing the services we use. Cookies may also be set in the process. However, this data processing only occurs when services are integrated via the Tag Manager. For more detailed information regarding these services and their respective data processing, please refer to the subsequent sections of this privacy policy; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Data Processing Agreement:
  https://business.safety.google/adsprocessorterms. Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms).
• WP Statistics: WP Statistics is a privacy-friendly web analytics software that operates without cookies. It identifies returning users via a “digital fingerprint”—an anonymized identifier that changes every 24 hours. This “digital fingerprint” tracks user activity within our online services using pseudonymized IP addresses combined with browser settings; it is structured in such a way that it is impossible to draw conclusions about the identity of individual users. This data collection and storage is conducted solely for the purpose of site analysis. The analyses are based on log data (see “Server Log Files”), which are necessary for establishing a connection between the web browser and the web server. All IP addresses and data collected by WP Statistics are stored in a fully anonymized format on this web server. WP Statistics does not set any cookies. User data collected through the use of WP Statistics is processed exclusively by us and is not shared with third parties. Protecting your privacy and personal data is the top priority when using WP Statistics. WP Statistics does not collect any additional visitor data. No personal identification of visitors takes place; Service provider: Operated on servers and/or computers under our own responsibility with regard to data protection law; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) of the GDPR). Website: https://veronalabs.com/.
• RankMath: Analysis and optimization of meta titles and meta descriptions (text for search engines), generation of sitemaps (an overview of all pages on a website), monitoring of technical SEO errors (issues affecting discoverability by search engines), and management of structured data (additional information for search engines); Service provider: ONE.COM INDIA PRIVATE LIMITED, Office No. 2, 5th Floor, Tower A, Building 9, DLF Cyber ​​City Complex, Phase III, 122002 Gurgaon, India; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://rankmath.com. Privacy policy: https://rankmath.com/de/privacy-policy/.

Online Marketing

We process personal data for the purpose of online marketing, which may include, in particular, the marketing of advertising space or the display of promotional and other content (collectively referred to as “content”) based on the potential interests of users, as well as the measurement of the effectiveness of such content.

For these purposes, so-called user profiles are created and stored in a file (a “cookie”), or similar methods are used to store information about the user that is relevant for displaying the aforementioned content. This may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical details—such as the browser used, the computer system employed, and information regarding usage times and features accessed. If users have consented to the collection of their location data, this may also be processed.

In addition, users’ IP addresses are stored. However, we employ available IP-masking procedures (i.e., pseudonymization by truncating the IP address) to protect users. Generally, no clear-text user data (such as email addresses or names) are stored as part of these online marketing processes; instead, pseudonyms are used. This means that neither we nor the providers of these online marketing services know the actual identity of the user—only the information stored within their respective profiles.

The data contained in these profiles is typically stored in cookies or via similar mechanisms. These cookies can generally be accessed later on other websites that utilize the same online marketing service; the data can then be analyzed for the purpose of displaying content, supplemented with additional information, and stored on the server of the online marketing service provider.

In exceptional cases, it may be possible to link clear-text data to these profiles—primarily when users are, for example, members of a social network whose online marketing services we employ, and that network connects the user profiles with the aforementioned information.

Please note that users may enter into additional agreements with the providers, for example by providing consent during the registration process.

In principle, we only receive access to aggregated information regarding the success of our advertisements. However, through so-called conversion tracking, we can determine which of our online marketing methods have led to a “conversion”—for instance, the conclusion of a contract with us. Conversion tracking is used exclusively to analyze the success of our marketing efforts.

Unless otherwise stated, please assume that any cookies used will be stored for a period of two years.

Information on legal bases: In cases where we request user consent for the use of third-party providers, such consent serves as the legal basis for data processing. Otherwise, user data is processed on the basis of our legitimate interests (i.e., our interest in providing efficient, economical, and user-friendly services). In this context, we also draw your attention to the information regarding the use of cookies provided elsewhere in this privacy policy.

Notes on withdrawal and objection:

Please refer to the privacy policies of the respective providers and the objection options (so-called “opt-outs”) they offer. If no explicit opt-out option is provided, you may also disable cookies in your browser settings. Please note, however, that doing so may limit the functionality of our online services. We therefore also recommend the following opt-out options, which are organized by region:

a) Europe: https://youronlinechoices.eu/.

b) Canada: https://youradchoices.ca/.

c) USA: https://optout.aboutads.info/.

d) Cross-regional: https://optout.aboutads.info.

• Types of data processed: Content data (e.g., text or image-based messages and posts, along with related information such as authorship or the time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).

Event Data (Facebook) (“Event data” refers to information sent to the provider Meta—for instance, via the Meta Pixel, through apps, or via other channels—that relates to individuals or their actions. This data includes details such as website visits, interactions with content and features, app installations, and product purchases. Event data is processed for the purpose of creating target audiences for content and advertising messages (“Custom Audiences”). It is important to note that event data does not include actual content (such as written comments), login credentials, or contact information (such as names, email addresses, or phone numbers). Meta deletes “event data” after a maximum of two years, and any target audiences created from this data are removed if our Meta user accounts are deleted.)

Further information on processing operations, procedures, and services:

• Meta Pixel and audience creation (Custom Audiences): The Meta Pixel (or comparable functions used to transmit event data or contact information via interfaces in apps) enables Meta to identify visitors to our online services as a target group for the display of advertisements (“Meta Ads”). Accordingly, we use the Meta Pixel to ensure that the Meta Ads we place are shown only to users on Meta’s platforms and within the services of Meta’s partners (the “Audience Network”). https://www.facebook.com/audiencenetwork/) to individuals who have shown an interest in our online services or who possess specific characteristics (e.g., an interest in particular topics or products, as evidenced by the websites they have visited)—data which we transmit to Meta (so-called “Custom Audiences”). Through the Meta Pixel, we also aim to ensure that our Meta ads align with the potential interests of users and are not perceived as intrusive. Furthermore, the Meta Pixel allows us to track the effectiveness of our Meta ads for statistical and market research purposes by observing whether users are redirected to our website after clicking on a Meta ad (so-called “conversion measurement”); Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: User event data—specifically information regarding behavior and interests—is processed for the purposes of targeted advertising and audience segmentation based on a joint controllership agreement (“Controller Addendum,” https://www.facebook.com/legal/controller_addendum). This joint controllership is limited to the collection of data and its transmission to Meta Platforms Ireland Limited, a company based in the EU. Any further processing of the data is the sole responsibility of Meta Platforms Ireland Limited; this includes, in particular, the transfer of data to the parent company, Meta Platforms, Inc., in the USA (based on Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
• Google Ad Manager: We use the “Google Ad Manager” service to place advertisements within the Google advertising network (e.g., in search results, in videos, on websites, etc.). A key feature of Google Ad Manager is that advertisements are displayed in real time based on the inferred interests of users. This allows us to show ads for our online services to users who may have a potential interest in them—or who have shown interest in the past—and to measure the success of these advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Basis for transfers to third countries: Data Privacy Framework (DPF); Further information: Types of processing and data processed: https://business.safety.google/adsservices/; Data processing terms for Google advertising products: information on the services, data processing terms between controllers, and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms. In cases where Google acts as a processor, data processing terms for Google advertising products and standard contractual clauses for data transfers to third countries: https://business.safety.google/adsprocessorterms.
• Google Ads and conversion measurement: Online marketing methods used to place content and advertisements within the service provider’s advertising network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who are likely to have an interest in the ads. Furthermore, we measure the conversion of these ads—that is, whether users have interacted with the ads and taken advantage of the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Basis for third-country transfers: Data Privacy Framework (DPF); Further information: Types of processing and data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms.
• Enhanced Conversions for Google Ads: When users click on our Google ads and subsequently make use of the advertised service (a so-called “conversion”), data entered by the user—such as their email address, name, residential address, or phone number—may be transmitted to Google. The resulting hash values ​​are then matched against existing Google user accounts in order to better evaluate and improve user interaction with the ads (e.g., clicks or views) and, consequently, their performance; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Website: https://support.google.com/google-ads/answer/9888656.
• Instagram Ads: Displaying advertisements on the Instagram platform and evaluating ad performance; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/; Basis for transfers to third countries: Data Privacy Framework (DPF); Opt-out option: Please refer to the privacy and advertising settings within your user profile on the Instagram platform, as well as Instagram’s consent procedures and the contact channels provided in Instagram’s privacy policy for exercising your right to access information and other data subject rights. Further information: User event data—specifically information regarding behavior and interests—is processed for the purposes of targeted advertising and audience segmentation, based on an agreement on joint controllership (“Controller Addendum,” https://www.facebook.com/legal/controller_addendum). This joint controllership is limited to the collection of data and its transmission to Meta Platforms Ireland Limited, a company based in the EU. Any further processing of the data is the sole responsibility of Meta Platforms Ireland Limited; this includes, in particular, the transfer of such data to the parent company, Meta Platforms, Inc., in the United States.

Presence on Social Networks (Social Media)

We maintain an online presence on social networks, where we process user data to communicate with active users or to provide information about ourselves.

Please note that user data may be processed outside the European Union. This could pose risks to users—for example, by making it more difficult to enforce their legal rights.

Furthermore, user data on social networks is typically processed for market research and advertising purposes. Usage profiles may be created based on user behavior and the resulting interests. These profiles are often used to display advertisements—both within and outside the networks—that are presumed to align with the users’ interests. To this end, cookies are generally stored on users’ devices to record their usage behavior and interests. Additionally, data may be stored in these usage profiles regardless of the specific devices used (especially if the users are members of the respective platforms and are logged into them).

For a detailed explanation of the specific processing activities and the available options to object (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

Regarding requests for information or the exercise of data subject rights, please note that these are most effectively addressed directly to the service providers. Only the providers themselves have access to the user data and are in a position to take appropriate action or provide the requested information.

Should you nevertheless require assistance, you may contact us.

• Types of data processed: Contact data (e.g., postal addresses, email addresses, or phone numbers); content data (e.g., text or image-based messages and posts, along with related information such as authorship or the time of creation); usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, types of devices and operating systems used, and interactions with content and features).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing and legitimate interests: Communication; feedback (e.g., collecting feedback via an online form); public relations.
• Retention and deletion: Deletion in accordance with the information provided in the section “General information on data storage and deletion.”
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

• Instagram: Social network that allows for the sharing of photos and videos, commenting on and “liking” posts, sending messages, and subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/. Basis for transfers to third countries: Data Privacy Framework (DPF).
• Facebook Pages: Profiles within the social network Facebook – The controller, together with Meta Platforms Ireland Limited, is jointly responsible for the collection and transmission of data concerning visitors to our Facebook page (“fan page”). This includes, in particular, information about user behavior (e.g., content viewed or interacted with, actions taken) as well as device information (e.g., IP address, operating system, browser type, language settings, cookie data). Further details can be found in the Facebook Data Policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical analyses via the “Page Insights” service, which shed light on how individuals interact with our page and its content. This is based on an agreement with Facebook (“Page Insights Controller Addendum”: https://www.facebook.com/legal/terms/page_controller_addendum), which covers, among other things, security measures and the exercise of data subject rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users may therefore direct requests for access or deletion to Facebook. The rights of users (in particular the right to access, deletion, objection, and the right to lodge a complaint with a supervisory authority) remain unaffected. Joint controllership is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for any further processing, including potential transfers to Meta Platforms Inc. in the USA; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/. Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
• LinkedIn: Social network – Together with LinkedIn Ireland Unlimited Company, we are joint controllers for the collection (though not the subsequent processing) of visitor data used to generate “Page Insights” (statistics) for our LinkedIn profiles. This data includes information about the types of content users view or interact with, as well as the actions they take. Furthermore, details regarding the devices used—such as IP addresses, operating system, browser type, language settings, and cookie data—are collected, along with information from user profiles, including job title, country, industry, seniority level, company size, and employment status. Information regarding how LinkedIn processes user data can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.
  We have entered into a specific agreement with LinkedIn Ireland (the “Page Insights Joint Controller Addendum,” https://legal.linkedin.com/pages-joint-controller-addendum), which, among other things, stipulates the security measures LinkedIn must implement and confirms that LinkedIn will fulfill the rights of data subjects (i.e., users may, for example, submit requests for access or deletion directly to LinkedIn). The rights of users (in particular the right to access, erasure, objection, and lodging a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint controllership is limited to the collection and transmission of data to LinkedIn Ireland Unlimited Company, an entity based in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, particularly with regard to the transfer of data to the parent company, LinkedIn Corporation, in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/privacy-policy). Option to object (opt-out): <a href="https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out" target="_blank"
  

  Plug-ins and embedded functions and content

  We integrate functional and content elements into our online service that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or maps (collectively referred to as “content”).

  Such integration always requires that the third-party providers of this content process the users’ IP addresses, as they would otherwise be unable to send the content to the users’ browsers. The IP address is therefore necessary for the display of this content or these functions. We strive to use only content from providers that utilize IP addresses solely for the purpose of delivering said content. Furthermore, third-party providers may use “pixel tags” (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These pixel tags allow for the analysis of information, such as visitor traffic on the pages of this website. This pseudonymous information may also be stored in cookies on the user’s device and may include, among other things, technical details regarding the browser and operating system, referring websites, the time of the visit, and other data concerning the use of our online service; it may also be combined with information from other sources.

  Legal basis: In cases where we request user consent for the use of third-party providers, such consent serves as the legal basis for data processing. Otherwise, user data is processed on the basis of our legitimate interests (i.e., our interest in providing efficient, economical, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies provided in this privacy policy.

  • Types of data processed: Usage data (e.g., page views and duration of visits, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Location data (information regarding the geographical position of a device or an individual).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; reach measurement (e.g., access statistics, recognition of returning visitors); tracking (e.g., interest-based/behavioral profiling, use of cookies); creation of target groups; marketing; provision of contractual services and fulfillment of contractual obligations. Security measures.
  • Retention and deletion: Deletion in accordance with the information provided in the section “General information on data storage and deletion.” Storage of cookies for up to 2 years (unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years).
  • Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

  Further information on processing operations, procedures, and services:

  • Google Fonts (hosted on our own server): Provision of font files for the purpose of a user-friendly display of our online services; Service provider: The Google Fonts are hosted on our own server; no data is transmitted to Google; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Google Maps: We integrate maps from the service “Google Maps,” provided by Google. The data processed may include, in particular, users’ IP addresses and location data; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://business.safety.google/privacy/. Basis for transfers to third countries: Data Privacy Framework (DPF).
  • reCAPTCHA: We integrate the “reCAPTCHA” feature to determine whether input (e.g., in online forms) is provided by a human or by an automated machine (a so-called “bot”). The data processed may include IP addresses, information about operating systems, devices, or browsers used, language settings, location, mouse movements, keystrokes, time spent on websites, previously visited websites, interactions with reCAPTCHA on other websites, potentially cookies, as well as the results of manual identification tasks (e.g., answering questions or selecting objects in images). Data processing is based on our legitimate interest in protecting our online services from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://cloud.google.com/security/products/recaptcha; Privacy Policy: https://business.safety.google/privacy/; Data Processing Addendum: https://cloud.google.com/terms/data-processing-addendum. Basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/sccs/eu-c2p).
  • YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.youtube.com; Privacy policy: https://business.safety.google/privacy/; Basis for transfers to third countries: Data Privacy Framework (DPF). Option to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff.
  • CDN JS: A platform for providing JavaScript and CSS libraries via a Content Delivery Network (CDN). It offers frequently used open-source packages in versioned files, allowing developers to integrate them directly into websites and applications without having to host the files themselves. Typically, this involves processing retrieval data—such as the library accessed, the version number, the file path, and technical connection and log data. Usage primarily occurs via public CDN URLs embedded in HTML documents, scripts, or other front-end components. This enables browsers to load libraries more quickly and access stable, globally distributed delivery points as needed; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Website: https://cdnjs.com/.

  Application Process

  The application process requires applicants to provide us with the data necessary for their assessment and selection. The specific information required can be found in the job description or, in the case of online forms, in the details requested therein.

  Generally, the required information includes personal details—such as name, address, and contact information—as well as documentation of the qualifications necessary for the position. We are also happy to clarify which specific information is required upon request.

  Where available, applicants may submit their applications via our online form, which is encrypted according to state-of-the-art standards. Alternatively, applications may also be sent to us via email.

  Please note, however, that emails sent over the internet are generally not encrypted. Although emails are typically encrypted while in transit, this encryption does not apply on the servers from which they are sent or received. Consequently, we cannot assume responsibility for the security of an application during its transmission between the sender and our server.

  For the purposes of sourcing, receiving, and selecting applicants, we may—in compliance with legal requirements—utilize applicant management or recruitment software, as well as platforms and services provided by third parties.

  Applicants are welcome to contact us regarding the preferred method of submission or to send their application by postal mail.

  Processing of special categories of data: Insofar as special categories of personal data (Art. 9 para. 1 GDPR, e.g., health-related data such as information regarding a severe disability, or ethnic origin) are requested from or provided by applicants during the application process, such data are processed to enable the controller or the data subject to exercise their rights and fulfill their obligations arising from labor law, social security law, and social protection law; to protect the vital interests of the applicants or other persons; for purposes of preventive medicine or occupational medicine; to assess an applicant’s capacity for work; for medical diagnosis; to provide health or social care or treatment; or to manage health or social care systems and services.

  Deletion of data: If an application is successful, the data provided by the applicant may be further processed by us for the purposes of the employment relationship. Otherwise, if an application for a job vacancy is unsuccessful, the applicant’s data will be deleted. Applicant data will also be deleted if an application is withdrawn—a step that applicants are entitled to take at any time. Subject to any legitimate revocation by the applicant, the data will be deleted no later than six months after the application process concludes; this timeframe allows us to address any follow-up questions regarding the application and to fulfill our documentation obligations under regulations concerning the equal treatment of applicants.

  Invoices for any travel expense reimbursements are archived in accordance with tax law requirements.

  Inclusion in an applicant pool: Inclusion in an applicant pool, where offered, is based on consent. Applicants are informed that their consent to be included in the talent pool is voluntary, has no impact on the ongoing application process, and may be withdrawn at any time with effect for the future.

  • Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal addresses, email addresses, or phone numbers); content data (e.g., text or image-based messages and posts, as well as information related to them, such as authorship or the time of creation). Applicant data (e.g., personal details, postal and contact addresses, documents submitted as part of the application and the information contained therein—such as cover letters, resumes, certificates—as well as other information regarding a specific position or information voluntarily provided by applicants concerning themselves or their qualifications).
  • Data subjects: Applicants.
  • Purposes of processing and legitimate interests: Application process (establishment, potential subsequent execution, and possible future termination of an employment relationship).
  • Retention and deletion: Deletion in accordance with the information provided in the section “General information on data storage and deletion.”
  • Legal bases: Application process as a pre-contractual or contractual relationship (Art. 6 para. 1 sentence 1 lit. b) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

  Further information on processing operations, procedures, and services:

  • coveto: Processing and management of application documents (files, resumes), communication with applicants via email, scheduling of job interviews, status management within the selection process (e.g., application progress), documentation of interview notes, assignment of rights and roles to users (access control); Service provider: coveto ATS GmbH, Frankenstraße 45, 63667 Nidda, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.coveto.de; Privacy policy: https://www.coveto.de/datenschutz. Data processing agreement: Provided by the service provider.

  Definitions of Terms

  This section provides an overview of the terms used in this privacy policy. Where terms are defined by law, those legal definitions apply. The explanations provided below are intended primarily to facilitate understanding.

  • Inventory Data: Inventory data comprises essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar associations. This data may include, among other things, personal and demographic details such as names, contact information (addresses, telephone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Inventory data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling clear identification and communication.
  • Content Data: Content data includes information generated during the creation, editing, and publication of content of any kind. This category of data may encompass text, images, videos, audio files, and other multimedia content published across various platforms and media. Content data is not limited to the actual content itself but also includes metadata—information about the content—such as tags, descriptions, author information, and publication dates.
  • Contact Data: Contact data consists of essential information that enables communication with individuals or organizations. This includes, for example, telephone numbers, postal addresses, and email addresses, as well as other means of communication such as social media handles and instant messaging identifiers.
  • Conversion Measurement: Conversion measurement (also referred to as “visitor action analysis”) is a method used to determine the effectiveness of marketing initiatives. Typically, this involves placing a cookie on a user’s device—via the websites where the marketing activities take place—which is then retrieved when the user reaches the target website. For example, this allows us to track whether the advertisements we placed on other websites were successful.
  • Artificial Intelligence (AI): The purpose of processing data through Artificial Intelligence (AI) includes the automated analysis and processing of user data to identify patterns, make predictions, and improve the efficiency and quality of our services. This process encompasses the collection, cleaning, and structuring of data, the training and application of AI models, and the continuous review and optimization of results. Such processing is carried out exclusively with the user’s consent or based on legal grounds for authorization.
  • Meta, communication, and procedural data: Meta, communication, and procedural data are categories that contain information regarding how data is processed, transmitted, and managed. Meta-data—also known as “data about data”—includes information that describes the context, origin, and structure of other data. This may encompass details such as file size, creation date, the author of a document, and modification history. Communication data captures the exchange of information between users across various channels—such as email correspondence, call logs, social media messages, and chat histories—including the individuals involved, timestamps, and transmission paths. Procedural data describes the processes and workflows within systems or organizations, including workflow documentation, records of transactions and activities, and audit logs used to track and verify operations.
  • Usage data: Usage data refers to information that captures how users interact with digital products, services, or platforms. This data encompasses a wide range of information, revealing how users utilize applications, which features they prefer, how long they spend on specific pages, and the paths they take when navigating through an application. Usage data may also include the frequency of use, activity timestamps, IP addresses, device information, and location data. Such data is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services.

  Furthermore, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings.

  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly—in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Profiles containing user-related information: The processing of “profiles containing user-related information”—or simply “profiles”—encompasses any form of automated processing of personal data that involves using such data to analyze, evaluate, or predict specific personal aspects relating to a natural person (depending on the type of profiling, this may include various information regarding demographics, behavior, and interests—such as interaction with websites and their content, etc.). This can include predicting interests in specific content or products, click behavior on a website, or a person’s location. Cookies and web beacons are frequently used for the purpose of profiling.
  • Log data: Log data refers to information about events or activities recorded within a system or network. This data typically includes details such as timestamps, IP addresses, user actions, error messages, and other information regarding the usage or operation of a system. Log data is often used for analyzing system issues, security monitoring, or generating performance reports.
  • Reach measurement: Reach measurement (also known as web analytics) is used to evaluate visitor traffic to an online service and may encompass the behavior or interests of visitors regarding specific information, such as website content. Through reach analysis, operators of online services can, for example, determine when users visit their websites and which content they find interesting. This allows them to better tailor website content to the needs of their visitors.
  • Location data: Location data is generated when a mobile device (or any other device with the technical capability for location determination) connects to a cellular network, a Wi-Fi network, or other similar technical means and functions used to establish location. Location data indicates the specific geographical position of a device on Earth. Such data can be used, for instance, to provide map features or other location-dependent information.
  • Tracking: “Tracking” refers to the process of monitoring user behavior across multiple online services. Typically, information regarding user behavior and interests—collected from the online services accessed—is stored in cookies or on the servers of the companies providing the tracking technology (a process known as “profiling”). This information can subsequently be used, for example, to display advertisements to users that are likely to align with their interests.
  • Controller: A “controller” is a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” refers to any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, such as collection, analysis, storage, transmission, or deletion.
  • Contractual data: Contractual data refers to specific information relating to the formalization of an agreement between two or more parties. It documents the terms and conditions under which services or products are provided, exchanged, or sold. This category of data is essential for the management and fulfillment of contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contractual data may include the start and end dates of the contract, the nature of the agreed-upon services or products, pricing arrangements, payment terms, termination rights, renewal options, and specific conditions or clauses. It serves as the legal basis for the relationship between the parties and is crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.
  • Payment data: Payment data encompasses all information required to process financial transactions between buyers and sellers. This data is of critical importance for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank account information, payment amounts, transaction data, verification numbers, and billing information.

  Payment data may also include information regarding payment status, chargebacks, authorizations, and fees.

  • Target audience creation: The term “custom audiences” refers to the process of defining target groups for advertising purposes—for example, for the display of advertisements. Based on a user’s interest in specific products or topics online, it can be inferred that the user might also be interested in advertisements for similar products or for the online shop where they viewed those items. “Lookalike audiences” (or similar target groups) are created by displaying content deemed relevant to users whose profiles or interests are presumed to match those of the users upon whom the original audience segments were based. Cookies and web beacons are typically used for the purpose of creating custom audiences and lookalike audiences.