Privacy policy

1. An overview of data protection

General information

The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit this website. The term “personal data” comprises all data that can be used to personally identify you. For detailed information about the subject matter of data protection, please consult our Data Protection Declaration, which we have included beneath this copy.

Data recording on this website

Who is the responsible party for the recording of data on this website (i.e., the “controller”)?

The data on this website is processed by the website operator. The operator’s contact details can be found in the section “Information about the responsible party (referred to as the ‘controller‘ in the GDPR)“ in this privacy policy.

How do we record your data?

We collect your data as a result of your sharing of your data with us. This may, for instance be information you enter into our contact form.

Other data is recorded automatically or after you consent to its recording by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time the page was accessed). This data is recorded automatically as soon as you enter this website.

What are the purposes we use your data for?

A portion of the information is generated to guarantee the error free provision of the website. Other data may be used to analyze your user patterns. If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders or other order enquiries.

What rights do you have as far as your information is concerned?

You have the right to receive information about the origin, recipients and purpose of your archived personal data at any time and free of charge. You also have the right to demand that this data be rectified or eradicated. If you have consented to data processing, you may revoke this consent at any time with effect for the future. Moreover, you have the right to demand that the processing of your personal data be restricted under certain circumstances.

Moreover, you have the right to log a complaint with the competent supervisory agency.

Please do not hesitate to contact us at any time if you have questions about this or any other data protection related issues.

Analysis tools and tools provided by third parties

There is a possibility that your browsing patterns will be statistically analyzed when your visit this website. Such analyses are performed primarily with what we refer to as analysis programs.

For detailed information about these analysis programs please consult our Data Protection Declaration below.

2. Hosting

We are hosting the content of our website at the following provider:

External Hosting

This website is hosted externally. Personal data collected on this website are stored on the servers of the host. These may include, but are not limited to, IP addresses, contact requests, metadata and communications, contract information, contact information, names, web page access, and other data generated through a web site.

The external hosting occurs for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of the secure, fast and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. This consent may be revoked at any time.

Our host(s) will only process your data to the extent necessary to fulfil its performance obligations and to follow our instructions with respect to such data.

We are using the following host(s):

Vercel Inc.
440 N Barranca Ave #4133
Covina, CA 91723

Sanity AS
Trondheimsveien 2K
0560 Oslo
Norway

Vercel Inc. holds a certification under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider under the following link: https://www.dataprivacyframework.gov/participant/6847.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration.

When you use this website, a variety of personal data is collected.

Personal data comprises data that can be used to personally identify you. This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this happens.

We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.

Information about the responsible party (referred to as the “controller” in the GDPR)

The data processing controller on this website is:

Evelan GmbH
Ballindamm 39
20095 Hamburg

Phone: +49 40 88215940
E-mail: datenschutz@evelan.de

The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).

Duration of storage

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

General information on the legal basis for the data processing on this website

If you have consented to the processing of data, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, insofar as special categories of data pursuant to Art. 9(1) GDPR are processed. In the event of explicit consent to the transfer of personal data to third countries, the data processing is additionally based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your end device (e.g. via device fingerprinting), the data processing is additionally based on Section 25(1) TDDDG. This consent may be revoked at any time. If your data is required for the fulfilment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data on the basis of Art. 6(1)(c) GDPR insofar as this is necessary for the fulfilment of a legal obligation.

The data processing may also be based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Information on the legal bases relevant in each individual case is provided in the following paragraphs of this privacy policy.

Designation of a data protection officer

We have appointed a data protection officer.

heyData GmbH
Schützenstr. 5
10117 Berlin

Phone: No customer hotline
E-mail: datenschutz@heydata.eu

Recipients of personal data

In the scope of our business activities, we cooperate with various external parties. In some cases this also requires the transfer of personal data to these external parties.

We only share personal data with external parties if this is required as part of the fulfilment of a contract, if we are legally obligated to do so (e.g. transfer of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or if another legal basis permits the sharing of data. When using processors, we share personal data of our customers only on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Revocation of your consent to the processing of data

A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.

Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to log a complaint with the competent supervisory agency

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

Information about, rectification and eradication of data

Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time.

Right to demand processing restrictions

You have the right to demand that the processing of your personal data be restricted.

You may contact us at any time to do so. The right to demand restriction of processing applies in the following cases:

• In the event that you should dispute the correctness of your data archived by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
• If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data instead of demanding the eradication of this data.
• If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its eradication.
• If you have raised an objection pursuant to Art. 21(1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.

Automated decision-making

Automated decision-making within the meaning of Art. 22 GDPR does not take place. The AI chatbot used on this website assists in answering your questions; it does not make any decisions that produce legal effects concerning you or similarly significantly affect you.

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://“ to “https://“ and by the lock symbol in your browser line.

If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.

Rejection of unsolicited e-mails

We herewith object to the use of contact information published in conjunction with the mandatory information to be provided in our Site Notice to send us promotional and information material that we have not expressly requested. The operators of this website and its pages reserve the express right to take legal action in the event of the unsolicited sending of promotional information, for instance via SPAM messages.

4. Recording of data on this website

Cookies

Our websites and pages use what the industry refers to as “cookies.” Cookies are small data packages that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or they are permanently archived on your device (permanent cookies). Session cookies are automatically deleted once you terminate your visit. Permanent cookies remain archived on your device until you actively delete them, or they are automatically eradicated by your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services of third-party companies within websites (e.g. cookies for handling payment services).

Cookies have a variety of functions. Many cookies are technically essential since certain website functions would not work in the absence of these cookies (e.g., the shopping cart function or the display of videos). Other cookies may be used to analyze user behavior or for promotional purposes.

Cookies that are required to carry out the electronic communication process, to provide certain functions you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies for measuring the web audience) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified.

The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of its services. If consent to the storage of cookies and comparable recognition technologies has been obtained, the processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); this consent may be revoked at any time.

You have the option to set up your browser in such a manner that you will be notified any time cookies are placed and to permit the acceptance of cookies only in specific cases. You may also exclude the acceptance of cookies in certain cases or in general or activate the delete-function for the automatic eradication of cookies when the browser closes. If cookies are deactivated, the functions of this website may be limited.

If further cookies and services are used on this website, you can find this information in this privacy policy.

Consent with Usercentrics

This website uses the consent technology of Usercentrics to obtain your consent to the storage of certain cookies on your device or for the use of specific technologies, and to document the former in a data protection compliant manner. The party offering this technology is Usercentrics GmbH, Sendlinger Straße 7, 80331 München, Germany, website: https://usercentrics.com/ (hereinafter referred to as “Usercentrics”).

Whenever you visit our website, the following personal data will be transferred to Usercentrics:

• Your declaration(s) of consent or your revocation of your declaration(s) of consent
• Your IP address
• Information about your browser
• Information about your device
• The date and time you visited our website
• Geolocation

Moreover, Usercentrics shall store a cookie in your browser to be able to allocate your declaration(s) of consent or any revocations of the former. The data that are recorded in this manner shall be stored until you ask us to eradicate them, delete the Usercentrics cookie or until the purpose for archiving the data no longer exists. This shall be without prejudice to any mandatory legal retention periods.

The Usercentrics banner on this website has been configured with the assistance of eRecht24. This can be identified by the eRecht24 logo. To display the eRecht24 logo in the banner, a connection to the image server of eRecht24 will be established. In conjunction with this, the IP address is also transferred; however, is only stored in anonymized form in the server logs. The image server of eRecht24 is located in Germany with a German provider. The banner as such is provided exclusively by Usercentrics.

Usercentrics uses cookies to obtain the declarations of consent mandated by law. The legal basis for the use of specific technologies is Art. 6(1)(c) GDPR.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• The type and version of browser used
• The used operating system
• Referrer URL
• The hostname of the accessing computer
• The time of the server inquiry
• The IP address

This data is not merged with other data sources.

This data is recorded on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded.

Contact form

If you submit inquiries to us via our contact form, the information provided in the contact form as well as any contact information provided therein will be stored by us in order to handle your inquiry and in the event that we have further questions. We will not share this information without your consent.

These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.

The information you have entered into the contact form shall remain with us until you ask us to eradicate the data, revoke your consent to the archiving of data or if the purpose for which the information is being archived no longer exists (e.g., after we have concluded our response to your inquiry). This shall be without prejudice to any mandatory legal provisions, in particular retention periods.

Request by e-mail, telephone, or fax

If you contact us by e-mail, telephone or fax, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.

These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.

The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

Use of chatbots

We use chatbots to communicate with you. Chatbots are able to respond to your questions and other inputs without human assistance. To do so, the chatbots analyse further data in addition to your inputs in order to provide suitable answers (e.g. names, e-mail addresses and other contact details, customer numbers and other identifiers, orders and chat histories). Furthermore, your IP address, log files, location information and other metadata may be recorded via the chatbot. This data is stored on the servers of our service provider Convex, Inc. The transfer is based on the standard contractual clauses of the EU Commission.

User profiles may be created on the basis of the recorded data. Furthermore, the data may be used to display interest-based advertising, provided that the other legal requirements (in particular consent) are met. For this purpose, the chatbots may be linked to analysis and advertising tools.

The recorded data may also be used to improve our chatbots and their response behaviour (machine learning).

The data you enter in the course of the communication remains with us or the chatbot operator until you request us to delete it, revoke your consent to its storage or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed).

Mandatory statutory provisions – in particular retention periods – remain unaffected.

The legal basis for the use of chatbots is Art. 6(1)(b) GDPR, insofar as the chatbot is used to initiate a contract or in the course of fulfilling a contract. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. This consent may be revoked at any time. In all other cases, the use is based on our legitimate interest in the most effective customer communication possible (Art. 6(1)(f) GDPR).

Use of AI applications in chatbot communication

Our chatbots use artificial intelligence (AI) in customer communication. The AI we use analyses the content of your message in order to autonomously generate a suitable response. In this context, the AI processes all the content of your message, including names, e-mail addresses, communication content or technical information (e.g. IP addresses, device information).

The AI software used is employed on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the most efficient customer communication possible using modern technical solutions. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

This consent may be revoked at any time.

We integrate the following AI applications into our chatbots:

ChatGPT

Our chatbots use ChatGPT for our customer communication. The provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, https://openai.com. If you therefore contact us via the chatbot, your enquiries including metadata may be transferred to and processed on the servers of ChatGPT in order to generate a suitable response.

We have configured ChatGPT in such a way that the data we forward to ChatGPT is not used to train the ChatGPT algorithm.

You can find further information here: https://openai.com/policies/privacy-policy.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Claude

Our chatbots use Claude for our customer communication. The provider is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. If you therefore contact us via the chatbot, your enquiries including metadata may be transferred to and processed on the servers of this provider in order to generate a suitable response.

You can find further information here: https://www.anthropic.com/legal/privacy.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

5. Analysis tools and advertising

Umami (self-hosted)

This website uses Umami for the statistical analysis of visitor access. Umami is open-source analysis software which we operate under our own responsibility on servers in Europe. The analysis script is delivered via our own domain. Your data is not transferred to an external analysis service provider.

Umami does not set any cookies. The data recorded comprises the page accessed, the previously visited page (referrer), browser type and browser version, operating system, device type, screen resolution, language setting and the country of origin. The data is analysed in anonymised form. No personal user profiles are created, and recognition across several websites does not take place.

This data is recorded on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in a data-minimising analysis of user behaviour in order to improve its web offering. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG. This consent may be revoked at any time.

The data recorded is stored for a period of one year and then deleted.

You can find further information on Umami at https://umami.is/docs/faq .

Meta Pixel (formerly Facebook Pixel)

This website uses the visitor action pixel of Meta for conversion measurement. The provider of this service is Meta Platforms Ireland Limited, Merrion Road Dublin 4, Dublin, D04 X2K5, Ireland. According to Meta, however, the data recorded is also transferred to the USA and to other third countries.

This makes it possible to track the behaviour of site visitors after they have been redirected to the provider’s website by clicking on a Meta advertisement. This allows the effectiveness of the Meta advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Meta, so that a connection to the respective user profile on Facebook or Instagram is possible and Meta can use the data for its own advertising purposes in accordance with the Meta data usage policy ( https://www.facebook.com/about/privacy/ ). This enables Meta to display advertisements on Facebook or Instagram pages and other advertising channels. We as the site operator have no influence over this use of the data.

The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

Insofar as personal data is recorded on our website and forwarded to Meta with the help of the tool described here, we and Meta Platforms Ireland Limited, Merrion Road Dublin 4, Dublin, D04 X2K5, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the recording of the data and its transfer to Meta. The processing carried out by Meta after the transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the wording of the agreement at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Meta tool and for implementing the tool on our website in a manner that is secure under data protection law. Meta is responsible for the data security of the Meta products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook or Instagram directly with Meta. If you assert the data subject rights with us, we are obliged to forward them to Meta.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

You can find further information on the protection of your privacy in Meta’s data protection notices: https://www.facebook.com/about/privacy/.

You can also deactivate the remarketing function “Custom Audiences“ in the settings for advertisements at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do so, you must be logged in to Facebook.

If you do not have an account with Facebook or Instagram, you can deactivate usage-based advertising from Meta on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

The company holds a certification under the “EU-US Data Privacy Framework“ (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider under the following link: https://www.dataprivacyframework.gov/participant/4452.

Meta Custom Audiences

We use Meta Custom Audiences. The provider of this service is Meta Platforms Ireland Limited, Merrion Road Dublin 4, Dublin, D04 X2K5, Ireland.

Whenever you visit or use our website and apps, utilize our portfolio (e.g., participation in sweepstakes), transfer data to us or interact with the Facebook or Instagram content of our company, we record related personal data. In the event that you have given us your consent to the use of Meta Custom Audiences, we will share these data with Meta to put Meta in a position to send you compatible ads. These data may also be used to defined target audiences (Lookalike Audiences).

Meta processes this data as our processor. Details can be found in Meta’s terms of use: https://www.facebook.com/legal/terms/customaudience.

The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

You can find details here: https://www.facebook.com/legal/terms/customaudience and https://www.facebook.com/legal/terms/dataprocessing.

The company holds a certification under the “EU-US Data Privacy Framework“ (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider under the following link: https://www.dataprivacyframework.gov/participant/4452.

6. Plug-ins and Tools

YouTube with expanded data protection integration

This website integrates videos from the YouTube website. The operator of the website is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of these websites on which YouTube is integrated, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in the expanded data protection mode. According to YouTube, videos played in the expanded data protection mode are not used to personalise browsing on YouTube. Advertisements played in the expanded data protection mode are also not personalised. In the expanded data protection mode, no cookies are set. Instead, however, so-called local storage elements are stored in the user’s browser, which, similar to cookies, contain personal data and can be used for recognition. You can find details on the expanded data protection mode here: https://support.google.com/youtube/answer/171780.

After activating a YouTube video, further data processing operations may be triggered over which we have no influence.

YouTube is used in the interest of an appealing presentation of our online offerings.

This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. This consent may be revoked at any time.

You can find further information on data protection at YouTube in their privacy policy at: https://policies.google.com/privacy?hl=en.

The company holds a certification under the “EU-US Data Privacy Framework“ (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider under the following link: https://www.dataprivacyframework.gov/participant/5780.

Mux

We embed videos via the Mux service. The provider is Mux, Inc., 88 Stevenson Street, San Francisco, CA 94105, USA (hereinafter “Mux“).

When you access a page containing a video embedded via Mux, a connection to Mux’s servers is established. In doing so, your IP address is transferred to Mux. Mux also records technical information about your browser and end device as well as usage data on playback quality (e.g. loading time, interruptions, video segments played) and stores a cookie with an identifier for this purpose, by means of which recurring visits can be recognised.

The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

The company holds a certification under the “EU-US Data Privacy Framework“ (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider under the following link: https://www.dataprivacyframework.gov/participant/8853.

You can find further information on data protection at Mux in their privacy policy at https://www.mux.com/privacy .

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Google Fonts (local embedding)

This website uses so-called Google Fonts provided by Google to ensure the uniform use of fonts on this site. These Google fonts are locally installed so that a connection to Google’s servers will not be established in conjunction with this application.

You can find further information on Google Fonts at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=en.

7. Online-based Audio and Video Conferences (Conference tools)

Data processing

Among other things, we use online conference tools for communication with our customers. The tools we use in detail are listed below. If you communicate with us by video or audio conference via the internet, your personal data will be recorded and processed by us and by the provider of the respective conference tool.

The conference tools record all data that you provide or use in order to use the tools (e-mail address and/or your telephone number). Furthermore, the conference tools process the duration of the conference, the beginning and end (time) of participation in the conference, the number of participants and other “contextual information“ in connection with the communication process (metadata).

Furthermore, the provider of the tool processes all technical data required to handle the online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker as well as the type of connection.

If content is exchanged, uploaded or otherwise provided within the tool, this is also stored on the servers of the tool providers. Such content includes in particular cloud recordings, chat and instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared during the use of the service.

Please note that we do not have full influence over the data processing operations of the tools used. Our options depend largely on the corporate policy of the respective provider. You can find further information on the data processing by the conference tools in the privacy policies of the tools used, which we have listed below this text.

Purpose and legal bases

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6(1)(b) GDPR). Furthermore, the use of the tools serves to generally simplify and accelerate communication with us or our company (legitimate interest in the meaning of Art. 6(1)(f) GDPR). Insofar as consent has been requested, the tools in question will be used on the basis of this consent; the consent may be revoked at any time with effect from that date.

Duration of storage

Data collected directly by us via the video and conference tools will be deleted from our systems immediately after you request us to delete it, revoke your consent to storage, or the reason for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory legal retention periods remain unaffected.

We have no influence on the duration of storage of your data that is stored by the operators of the conference tools for their own purposes. For details, please directly contact the operators of the conference tools.

Conference tools used

We employ the following conference tools:

Google Meet

We use Google Meet. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For details on the data processing, please refer to Google’s privacy policy: https://policies.google.com/privacy?hl=en.

The company holds a certification under the “EU-US Data Privacy Framework“ (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider under the following link: https://www.dataprivacyframework.gov/participant/5780.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

8. Custom Services

Handling applicant data

We offer you the opportunity to apply to us (e.g. by e-mail, by post or via an online application form). In the following, we inform you about the scope, purpose and use of the personal data collected from you in the course of the application process. We assure you that the collection, processing and use of your data will be carried out in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence.

Scope and purpose of the collection of data

If you submit a job application to us, we will process any affiliated personal data (e.g., contact and communications data, application documents, notes taken during job interviews, etc.), if they are required to make a decision concerning the establishment or an employment relationship. The legal grounds for the aforementioned are § 26 BDSG according to German Law (Negotiation of an Employment Relationship), Art. 6(1)(b) GDPR (General Contract Negotiations) and – provided you have given us your consent – Art. 6(1)(a) GDPR. You may revoke any consent given at any time. Within our company, your personal data will only be shared with individuals who are involved in the processing of your job application.

If your job application should result in your recruitment, the data you have submitted will be archived on the grounds of § 26 BDSG and Art. 6(1)(b) GDPR for the purpose of implementing the employment relationship in our data processing system.

As part of the application procedure, we may also carry out an internet search about your person. This primarily includes Google Search, LinkedIn and Xing. The legal basis for this type of processing is our legitimate interest in obtaining an overall impression of publicly available information about you pursuant to Art. 6(1)(f) GDPR.

Data Archiving Period

If we are unable to make you a job offer, you reject a job offer or withdraw your application, we reserve the right to retain the data you have transmitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application procedure (rejection or withdrawal of the application).

The data is then deleted and the physical application documents are destroyed. The retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be required after expiry of the 6-month period (e.g. due to an imminent or pending legal dispute), deletion will only take place when the purpose for further retention no longer applies.

Longer storage may also take place if you have given your agreement (Article 6(1)(a) GDPR) or if statutory data retention requirements preclude the deletion.

Admission to the applicant pool

If we do not make you a job offer, you may be able to join our applicant pool. In case of admission, all documents and information from the application will be transferred to the applicant pool in order to contact you in case of suitable vacancies.

Admission to the applicant pool is based exclusively on your express agreement (Art. 6(1)(a) GDPR). The submission agreement is voluntary and has no relation to the ongoing application procedure. The affected person can revoke his agreement at any time. In this case, the data from the applicant pool will be irrevocably deleted, provided there are no legal reasons for storage.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been granted.

Version of this privacy policy: 18 September 2026