Data Protection

PRIVACY POLICY

INTRODUCTION

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to briefly as “data”) that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in connection with the provision of our services and, in particular, on our websites, in mobile applications, and within external online presences such as our social-media profiles (hereinafter collectively referred to as the “online offering”). The terms used are not gender-specific.

Last updated: 13 December 2022

Introduction
Controller
Overview of Processing Activities
Relevant Legal Bases
Security Measures
Data Processing in Third Countries
Deletion of Data
Use of Cookies
Business Services
Payment Procedures
Provision of the Online Offering and Web Hosting
Registration, Login and User Account
Community Functions
Blogs and Publication Media
Contact and Inquiry Management
Push Notifications
Cloud Services
Newsletters and Electronic Notifications
Promotional Communication by Email, Post, Fax or Telephone
Web Analytics, Monitoring and Optimisation
Online Marketing
Customer Reviews and Rating Procedures
Presence on Social Networks (Social Media)
Plugins, Embedded Functions and Content
Amendment and Updating of the Privacy Policy
Definitions

CONTROLLER

Sunset Connect S.L
Calle Aragon 28, 1-1
07006 Palma de Mallorca

Persons authorised to represent the company: Aleksandar Stankovic
Email address: dsgvo[at]planet-randy.com
Legal notice: https://planet-randy.com

OVERVIEW OF PROCESSING ACTIVITIES

The following overview summarises the types of data processed and the purposes for which they are processed, and identifies the categories of data subjects concerned.

Types of Data Processed

Master data.
Payment data.
Location data.
Contact data.
Content data.
Contract data.
Usage data.
Meta/communication data.
Event data (Facebook).

Categories of Data Subjects

Customers.
Employees.
Prospective customers.
Communication partners.
Users.
Business and contractual partners.

Purposes of Processing

Provision of contractual services and customer support.
Contact inquiries and communication.
Security measures.
Direct marketing.
Reach measurement.
Tracking.
Office and organisational procedures.
Conversion measurement.
Target group formation.
Management of and response to inquiries.
Content Delivery Network (CDN).
Feedback.
Marketing.
Profiles containing user-related information.
Target group formation.
Provision of our online offering and user-friendliness.
Information technology infrastructure.

RELEVANT LEGAL BASES

Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data-protection requirements may apply in your or our country of residence or registered office. If more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

Consent (Art. 6(1), first sentence, point (a) GDPR) — The data subject has given consent to the processing of personal data relating to them for one or more specific purposes.
Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR) — Processing is necessary for the performance of a contract to which the data subject is party or in order to take pre-contractual steps at the request of the data subject.
Legal obligation (Art. 6(1), first sentence, point (c) GDPR) — Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Art. 6(1), first sentence, point (f) GDPR) — Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data.

SECURITY MEASURES

In accordance with statutory requirements and taking into account the state of the art, implementation costs, and the nature, scope, circumstances and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access, input, disclosure, availability and separation of the data. We have also established procedures to ensure the exercise of data-subject rights, the deletion of data, and responses to threats to data. Furthermore, we consider the protection of personal data when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and by default.

TLS encryption (https): To protect the data you transmit through our online offering, we use TLS encryption. You can recognise encrypted connections of this kind by the prefix https:// in your browser’s address bar.

DATA PROCESSING IN THIRD COUNTRIES

Where we process data in a third country, meaning outside the European Union (EU) or the European Economic Area (EEA), or where processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is done only in accordance with statutory requirements.

Subject to explicit consent or a transfer required by contract or law, we process data, or have data processed, only in third countries with a recognised level of data protection, on the basis of contractual obligations through the European Commission’s Standard Contractual Clauses, where certifications are in place, or on the basis of binding internal data-protection rules (Articles 44 to 49 GDPR; European Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

DELETION OF DATA

The data processed by us will be deleted in accordance with statutory requirements as soon as the consent permitting its processing is withdrawn or other permissions cease to apply, for example where the purpose of processing the data no longer applies or the data are no longer required for that purpose. Where data are not deleted because they are required for other legally permissible purposes, their processing will be restricted to those purposes. This means that the data will be blocked and will not be processed for other purposes. This applies, for example, to data that must be retained for commercial or tax-law reasons, or whose storage is necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

As part of our data-protection information, we may provide users with further information on deletion and data retention that applies specifically to the respective processing activities.

USE OF COOKIES

Cookies are small text files or other storage records that store information on end devices and read information from end devices. They may be used, for example, to store the login status in a user account, the contents of a shopping basket in an online shop, content accessed, or functions used within an online offering. Cookies may also be used for various purposes, such as ensuring the functionality, security and convenience of online offerings and analysing visitor flows.

Information on consent: We use cookies in accordance with statutory provisions. We therefore obtain users’ prior consent unless such consent is not required by law. In particular, consent is not required where storing and reading information, including cookies, is strictly necessary to provide users with a telemedia service expressly requested by them, namely our online offering. The revocable consent is clearly communicated to users and includes information on the relevant use of cookies.

Information on legal bases under data-protection law: The legal basis on which we process users’ personal data with the help of cookies depends on whether we ask users for consent. Where users consent, the legal basis for processing their data is the consent given. Otherwise, data processed with the help of cookies are processed on the basis of our legitimate interests, for example in the commercially efficient operation of our online offering and the improvement of its usability, or, where processing takes place in the performance of our contractual obligations, where the use of cookies is necessary to fulfil those contractual obligations. We explain the purposes for which cookies are processed in the course of this privacy policy or as part of our consent and processing procedures.

Storage period: With regard to storage periods, the following types of cookies are distinguished:

Temporary cookies, also known as session cookies: Temporary cookies are deleted no later than when a user leaves an online offering and closes their end device, for example the browser or mobile application.
Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status may be stored or preferred content may be displayed immediately when a user revisits a website. Data collected from users with the help of cookies may also be used for reach measurement. Unless we provide users with explicit information about the type and storage period of cookies, for example when obtaining consent, users should assume that cookies are permanent and may be stored for up to two years.

General information on withdrawal and objection (opt-out): Users may withdraw consent they have given at any time and may also object to processing in accordance with the statutory requirements of Article 21 GDPR. Users may also express their objection through their browser settings, for example by disabling cookies, although this may restrict the functionality of our online services. An objection to the use of cookies for online-marketing purposes may also be submitted through https://optout.aboutads.info and https://www.youronlinechoices.com/.

Further information on processing activities, procedures and services:

Processing of cookie data on the basis of consent: We use a cookie-consent management procedure through which users’ consent to the use of cookies, and to the processing activities and providers named within the cookie-consent management procedure, can be obtained, managed and withdrawn by users. The declaration of consent is stored so that the request does not have to be repeated and so that consent can be demonstrated in accordance with legal obligations. Storage may take place server-side and/or in a cookie, known as an opt-in cookie, or using comparable technologies, so that consent can be assigned to a user or their device. Subject to individual information concerning providers of cookie-management services, the following applies: Consent may be stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent, such as which cookie categories and/or service providers are covered, and information on the browser, system and end device used.

BUSINESS SERVICES

We process data relating to our contractual and business partners, such as customers and prospective customers, collectively referred to as “contractual partners”, in connection with contractual and comparable legal relationships, related measures, and communication with contractual partners, including at the pre-contractual stage, for example to respond to inquiries.

We process these data in order to fulfil our contractual obligations. These include, in particular, obligations to provide the agreed services, any updating obligations, and remedies for warranty defects and other disruptions to performance. We also process the data to safeguard our rights and for administrative tasks and business organisation associated with these obligations. In addition, we process the data on the basis of our legitimate interests in proper and commercially efficient business management and in security measures to protect our contractual partners and our business operations from misuse and from threats to their data, secrets, information and rights, for example through the involvement of telecommunications, transport and other auxiliary services, subcontractors, banks, tax and legal advisers, payment-service providers or tax authorities.

Within the limits of applicable law, we disclose contractual partners’ data to third parties only to the extent necessary for the aforementioned purposes or to comply with legal obligations. Contractual partners are informed about other forms of processing, such as processing for marketing purposes, within this privacy policy.

We inform contractual partners which data are required for the aforementioned purposes before or during collection, for example in online forms, through special markings such as colours or symbols such as asterisks, or in person.

We delete data after the expiry of statutory warranty and comparable obligations, generally after four years, unless the data are stored in a customer account, for example for as long as they must be retained for statutory archiving purposes. The statutory retention period is ten years for documents relevant for tax purposes and for commercial books, inventories, opening balance sheets, annual financial statements, work instructions and other organisational documents necessary to understand them, and accounting records; and six years for received commercial and business letters and reproductions of sent commercial and business letters. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, opening balance sheet, annual financial statements or management report was prepared, the commercial or business letter was received or sent, the accounting document was created, the record was made, or the other documents were created.

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply to the relationship between users and those providers.

Types of data processed: Master data, such as names and addresses; payment data, such as bank details, invoices and payment history; contact data, such as email addresses and telephone numbers; contract data, such as the subject matter of the contract, term and customer category; usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Customers; prospective customers; business and contractual partners.

Purposes of processing: Provision of contractual services and customer support; security measures; contact inquiries and communication; office and organisational procedures; management of and response to inquiries; conversion measurement, meaning measurement of the effectiveness of marketing activities; profiles containing user-related information, meaning the creation of user profiles.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR); legal obligation (Art. 6(1), first sentence, point (c) GDPR); legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Customer account: Contractual partners can create an account within our online offering, for example a customer or user account, hereinafter referred to as a “customer account”. Where registration of a customer account is required, contractual partners will be informed accordingly, together with the information required for registration. Customer accounts are not public and cannot be indexed by search engines. During registration and subsequent logins and use of the customer account, we store customers’ IP addresses and access times in order to demonstrate registration and prevent possible misuse of the customer account. When customers terminate their customer account, the data relating to the customer account will be deleted unless retention is required by law. Customers are responsible for backing up their data once the customer account has been terminated. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR)

Business analyses and market research: For business reasons and in order to identify market trends and the wishes of contractual partners and users, we analyse the data available to us concerning business transactions, contracts, inquiries and similar matters. The data subjects may include contractual partners, prospective customers, customers, visitors and users of our online offering. The analyses are carried out for business evaluations, marketing and market research, for example to identify customer groups with different characteristics. Where available, we may take into account the profiles of registered users and their information, such as services used. The analyses are for our use only and are not disclosed externally unless they are anonymous analyses containing aggregated, anonymised values. We also respect users’ privacy and process data for analytical purposes in pseudonymous form wherever possible and, where feasible, anonymously, for example as aggregated data. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Provision of the online community on rented storage space: To provide Planet Randy, we use storage space, computing capacity and software that we rent or otherwise obtain from an appropriate server provider, also known as a web host. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

PAYMENT PROCEDURES

In the context of contractual and other legal relationships, on the basis of legal obligations, or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use additional service providers alongside banks and credit institutions, collectively referred to as “payment-service providers”.

The data processed by payment-service providers include master data such as names and addresses; bank data such as account numbers or credit-card numbers; passwords, transaction authentication numbers and checksums; and information relating to contracts, amounts and recipients. This information is required to carry out transactions. However, the data entered are processed and stored only by the payment-service providers. This means that we do not receive account- or credit-card-related information, but only information confirming or rejecting the payment. In some circumstances, payment-service providers may transfer the data to credit-reference agencies. The purpose of this transfer is to verify identity and creditworthiness. Please refer to the payment-service providers’ terms and conditions and privacy notices.

The terms and conditions and privacy notices of the respective payment-service providers apply to payment transactions and can be accessed on their websites or within their transaction applications. We also refer to these for further information and for the exercise of rights of withdrawal, access and other data-subject rights.

Types of data processed: Master data, such as names and addresses; payment data, such as bank details, invoices and payment history; contract data, such as the subject matter of the contract, term and customer category; usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Customers; prospective customers.

Purposes of processing: Provision of contractual services and customer support.

Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

Further information on processing activities, procedures and services:

Klarna / Sofort transfer: Payment services, meaning the technical integration of online payment methods. Service provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR). Website: https://www.klarna.com/de. Privacy policy: https://www.klarna.com/de/datenschutz.
PayPal: Payment services, meaning the technical integration of online payment methods, including PayPal, PayPal Plus and Braintree. Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR). Website: https://www.paypal.com/de. Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Stripe: Payment services, meaning the technical integration of online payment methods. Service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR). Website: https://stripe.com. Privacy policy: https://stripe.com/de/privacy.

PROVISION OF THE ONLINE OFFERING AND WEB HOSTING

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

Types of data processed: Usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses; content data, such as entries in online forms.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure, meaning the operation and provision of information systems and technical devices such as computers and servers; security measures; Content Delivery Network (CDN).

Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Provision of the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from an appropriate server provider, also known as a web host. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Collection of access data and log files: Access to our online offering is recorded in so-called server log files. Server log files may include the address and name of the websites and files accessed, the date and time of access, the amount of data transferred, notification of successful access, the browser type and version, the user’s operating system, the referrer URL, meaning the previously visited page, and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, for example to prevent server overload, particularly in the event of abusive attacks known as DDoS attacks, and to ensure server utilisation and stability. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Deletion of data: Log-file information is stored for a maximum of 30 days and is then deleted or anonymised. Data whose further retention is required for evidentiary purposes are excluded from deletion until the relevant incident has been finally resolved.

Cloudflare: Content Delivery Network (CDN), a service that enables content within an online offering, particularly large media files such as graphics or program scripts, to be delivered more quickly and securely using regionally distributed servers connected through the internet. Service provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://www.cloudflare.com. Privacy policy: https://www.cloudflare.com/privacypolicy/. Data processing agreement: https://www.cloudflare.com/cloudflare-customer-dpa. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: https://www.cloudflare.com/cloudflare-customer-scc.

REGISTRATION, LOGIN AND USER ACCOUNT

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of contractual performance. The data processed include, in particular, login information such as username, password and email address.

When users use our registration and login functions and the user account, we store the IP address and the time of the relevant user action. Storage is based on our legitimate interests and those of users in protection against misuse and other unauthorised use. As a rule, these data are not disclosed to third parties unless disclosure is required to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about matters relevant to their user account, such as technical changes.

Types of data processed: Master data, such as names and addresses; contact data, such as email addresses and telephone numbers; content data, such as entries in online forms; meta/communication data, such as device information and IP addresses.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Provision of contractual services and customer support; security measures; management of and response to inquiries; provision of our online offering and user-friendliness.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR); legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Registration using pseudonyms: Users may use pseudonyms as usernames instead of their real names. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

Profile visibility settings: Users can use settings to determine the extent to which their profiles are visible or accessible to the public or only to particular groups of people. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

Deletion of data after termination: When users terminate their user account, data relating to the user account will be deleted, subject to statutory permission, a statutory obligation, or the users’ consent. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

No obligation to retain data: Users are responsible for backing up their data before the end of the contract once notice of termination has been given. We are entitled to irretrievably delete all user data stored during the term of the contract. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

COMMUNITY FUNCTIONS

The community functions we provide allow users to converse or otherwise exchange information with one another. Please note that the community functions may be used only in compliance with applicable law, our terms and guidelines, and the rights of other users and third parties.

Types of data processed: Usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Provision of contractual services and customer support; security measures.

Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

Further information on processing activities, procedures and services:

User contributions are public: Contributions and content created by users are publicly visible and accessible. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).
Contribution visibility settings: Users can use settings to determine the extent to which contributions and content they create are visible or accessible to the public or only to particular persons or groups. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).
Storage of data for security purposes: Users’ contributions and other entries are processed for the purposes of community and conversation functions and, subject to legal obligations or legal permission, are not disclosed to third parties. A duty to disclose may arise, in particular, in the case of unlawful contributions for law-enforcement purposes. Please note that, in addition to the content of contributions, the time of the contribution and the users’ IP addresses are stored. This is done so that appropriate measures can be taken to protect other users and the community. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).
Protection of users’ own data: Users decide which data about themselves they disclose within our online offering, for example when they provide personal information or participate in conversations. We ask users to protect their data and to publish personal data only with care and only to the extent necessary. In particular, users should protect their login credentials carefully and use secure passwords, especially combinations of characters that are as long and random as possible. Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

BLOGS AND PUBLICATION MEDIA

We use blogs or comparable means of online communication and publication, hereinafter referred to as “publication media”. Readers’ data are processed for the purposes of the publication medium only to the extent necessary for its presentation, for communication between authors and readers, or for security reasons. Otherwise, we refer to the information in this privacy policy concerning the processing of visitors to our publication media.

Types of data processed: Master data, such as names and addresses; contact data, such as email addresses and telephone numbers; content data, such as entries in online forms; usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Provision of contractual services and customer support; feedback, such as collecting feedback through online forms; provision of our online offering and user-friendliness; security measures; management of and response to inquiries.

Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Comments and contributions: When users leave comments or other contributions, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in case someone leaves unlawful content in comments or contributions, such as insults or prohibited political propaganda. In that event, we could ourselves be held liable for the comment or contribution and therefore have an interest in identifying the author. We also reserve the right, on the basis of our legitimate interests, to process user information for spam detection. On the same legal basis, in the case of surveys, we reserve the right to store users’ IP addresses for the duration of the survey and to use cookies to prevent multiple voting. Personal information provided in comments and contributions, any contact and website information, and the substantive content are stored permanently until the user objects. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).
Akismet anti-spam check: We use the “Akismet” service on the basis of our legitimate interests. Akismet distinguishes comments made by real people from spam comments. For this purpose, all comment information is sent to a server in the USA, where it is analysed and stored for four days for comparison purposes. Where a comment is classified as spam, the data are stored beyond that period. The information includes the name entered, email address, IP address, comment content, referrer, information about the browser and computer system used, and the time of the entry. Users may use pseudonyms or refrain from entering their name or email address. Users can prevent the transfer of data entirely by not using our commenting system. That would be regrettable, but we are unfortunately not aware of any alternatives that are equally effective. Service provider: Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://automattic.com. Privacy policy: https://automattic.com/privacy.
UpdraftPlus: Backup software and backup storage. Service provider: Simba Hosting Ltd., 11 Barringer Way, St. Neots, Cambs., PE19 1LW, United Kingdom. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://updraftplus.com/. Privacy policy: https://updraftplus.com/data-protection-and-privacy-centre/.

CONTACT AND INQUIRY MANAGEMENT

When users contact us, for example through a contact form, email, telephone or social media, and within existing user and business relationships, the information provided by the persons making the inquiry is processed to the extent necessary to respond to the contact inquiry and any requested measures.

Types of data processed: Contact data, such as email addresses and telephone numbers; content data, such as entries in online forms; usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Communication partners.

Purposes of processing: Contact inquiries and communication; management of and response to inquiries; feedback, such as collecting feedback through online forms; provision of our online offering and user-friendliness.

Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

Further information on processing activities, procedures and services:

Contact form: When users contact us through our contact form, by email, or through other communication channels, we process the data communicated to us in that context in order to deal with the matter raised. Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR); legitimate interests (Art. 6(1), first sentence, point (f) GDPR).
Zendesk: Management of contact inquiries and communication. Service provider: Zendesk, Inc., 989 Market Street #300, San Francisco, CA 94102, USA. Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR); legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://www.zendesk.de. Privacy policy: https://www.zendesk.de/company/customers-partners/privacy-policy/. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries; binding internal data-protection rules as a basis for transfers to the USA: https://www.zendesk.de/company/privacy-and-data-protection/#data-processing-agreement.

PUSH NOTIFICATIONS

With users’ consent, we may send them so-called push notifications. These are messages displayed on users’ screens, end devices or browsers even when our online service is not currently being actively used.

To subscribe to push notifications, users must confirm the browser or end-device prompt asking whether they wish to receive them. This consent process is documented and stored. Storage is necessary to determine whether users have consented to receive push notifications and to demonstrate that consent. For these purposes, a pseudonymous browser identifier, known as a push token, or an end device’s device ID is stored.

Push notifications may be necessary to fulfil contractual obligations, for example to provide technical and organisational information relevant to the use of our online offering. Otherwise, unless specifically stated below, they are sent on the basis of users’ consent. Users can change their receipt of push notifications at any time through the notification settings of their respective browsers or end devices.

Types of data processed: Usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Communication partners.

Purposes of processing: Provision of our online offering and user-friendliness; reach measurement, such as access statistics and recognition of returning visitors; direct marketing, such as by email or post.

Legal bases: Consent (Art. 6(1), first sentence, point (a) GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR).

Further information on processing activities, procedures and services:

Push notifications containing promotional content: The push notifications we send may contain promotional information. Promotional push notifications are processed on the basis of users’ consent. Where the content of promotional push notifications is specifically described as part of consent to receive them, those descriptions are decisive for the scope of users’ consent. Otherwise, our newsletters contain information about us and our services. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR).
Analysis and performance measurement: We statistically evaluate push notifications and can determine whether and when they were displayed and clicked. This information is used to improve our push notifications technically on the basis of technical data or target groups and their retrieval behaviour or retrieval times. The analysis also includes determining whether push notifications were opened, when they were opened, and whether users interacted with their content or buttons. For technical reasons, this information can be associated with individual recipients of push notifications. However, neither we nor, where used, the push-notification service provider seek to monitor individual users. Instead, the evaluations help us identify users’ usage habits and adapt our push notifications to them or send different push notifications based on users’ interests. The evaluation and performance measurement of push notifications are carried out on the basis of users’ explicit consent, given when they agree to receive push notifications. Users may object to analysis and performance measurement by unsubscribing from push notifications. Separate withdrawal from analysis and performance measurement is unfortunately not possible. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR).
OneSignal: Sending and management of push notifications. Service provider: OneSignal, Inc., 2850 S Delaware St, Suite 201, San Mateo, CA 94403, USA. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://onesignal.com. Privacy policy: https://onesignal.com/privacy_policy. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: to be concluded with the provider.

CLOUD SERVICES

We use software services accessible through the internet and operated on their providers’ servers, known as “cloud services” or “Software as a Service”, to store and manage content, for example document storage and management, the exchange of documents, content and information with specified recipients, or the publication of content and information.

In this context, personal data may be processed and stored on providers’ servers insofar as they form part of communications with us or are otherwise processed by us as described in this privacy policy. These data may include, in particular, users’ master and contact data, data relating to transactions, contracts and other processes, and their content. Cloud-service providers also process usage data and metadata, which they use for security purposes and service optimisation.

Where we use cloud services to provide forms or other documents and content for other users or publicly accessible websites, providers may store cookies on users’ devices for web-analytics purposes or to remember users’ settings, for example media-control settings.

Data subjects: Customers; employees, such as staff, applicants and former employees; prospective customers; communication partners.

Purposes of processing: Office and organisational procedures; information technology infrastructure, meaning the operation and provision of information systems and technical devices such as computers and servers.

Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Google Cloud services: Cloud-infrastructure services and cloud-based application software. Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://cloud.google.com/. Privacy policy: https://policies.google.com/privacy. Data processing agreement: https://cloud.google.com/terms/data-processing-addendum. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: https://cloud.google.com/terms/eu-model-contract-clause. Further information: https://cloud.google.com/privacy.
Google Cloud Storage: Cloud storage, cloud-infrastructure services and cloud-based application software. Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://cloud.google.com/. Privacy policy: https://policies.google.com/privacy. Data processing agreement: https://cloud.google.com/terms/data-processing-addendum. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: https://cloud.google.com/terms/eu-model-contract-clause. Further information: https://cloud.google.com/privacy.

NEWSLETTERS AND ELECTRONIC NOTIFICATIONS

We send newsletters, emails and other electronic notifications, hereinafter referred to as “newsletters”, only with recipients’ consent or where legally permitted. Where the content of a newsletter is specifically described during subscription, that description determines the scope of users’ consent. Otherwise, our newsletters contain information about us and our services.

To subscribe to our newsletters, it is generally sufficient to provide an email address. However, we may ask for a name in order to address the recipient personally in the newsletter, or for other information where this is necessary for the newsletter’s purposes.

Double opt-in procedure: Subscription to our newsletter generally uses a double opt-in procedure. This means that after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to prevent anyone from subscribing using another person’s email address. Newsletter subscriptions are logged so that the subscription process can be demonstrated in accordance with legal requirements. This includes storing the time of subscription and confirmation and the IP address. Changes to your data stored by the mailing service provider are also logged.

Deletion and restriction of processing: On the basis of our legitimate interests, we may store unsubscribed email addresses for up to three years before deleting them, in order to demonstrate consent previously given. Processing of these data is restricted to the possible defence of claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. Where we are required to observe objections permanently, we reserve the right to store the email address in a suppression list, also known as a blocklist, solely for that purpose.

Logging of the subscription process is carried out on the basis of our legitimate interests in demonstrating that it was conducted properly. Where we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure mailing system.

Content: Information about us, our services, campaigns and offers.

Types of data processed: Master data, such as names and addresses; contact data, such as email addresses and telephone numbers; meta/communication data, such as device information and IP addresses; usage data, such as websites visited, interest in content and access times.

Data subjects: Communication partners; users, such as website visitors and users of online services.

Purposes of processing: Direct marketing, such as by email or post; reach measurement, such as access statistics and recognition of returning visitors; conversion measurement, meaning measurement of the effectiveness of marketing activities; profiles containing user-related information, meaning the creation of user profiles.

Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR).

Right to object (opt-out): You may unsubscribe from our newsletter at any time, meaning that you may withdraw your consent or object to further receipt. You will find a link for unsubscribing at the end of every newsletter, or you may use one of the contact options provided above, preferably email.

Further information on processing activities, procedures and services:

Measurement of opening and click rates: Newsletters contain a so-called web beacon, a pixel-sized file that is retrieved from our server, or from the server of a mailing service provider where one is used, when the newsletter is opened. During this retrieval, technical information such as information about the browser and your system, your IP address, and the time of retrieval is initially collected.
This information is used to improve our newsletter technically on the basis of technical data or target groups and their reading behaviour, based on their locations, which can be determined with the help of the IP address, or access times. The analysis also includes determining whether newsletters are opened, when they are opened, and which links are clicked. This information is associated with individual newsletter recipients and stored in their profiles until those profiles are deleted. The evaluations help us identify users’ reading habits, adapt our content to them, or send different content based on users’ interests.
Measurement of opening and click rates, storage of the measurement results in users’ profiles, and further processing are based on users’ consent. Separate withdrawal from performance measurement is unfortunately not possible; in that event, the entire newsletter subscription must be cancelled or objected to. The stored profile information will then be deleted. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR).
Google Analytics: Measurement of the success of email campaigns and creation of user profiles with a storage period of up to two years. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://marketingplatform.google.com/intl/de/about/analytics/. Privacy policy: https://policies.google.com/privacy. Data processing agreement: https://business.safety.google/adsprocessorterms. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: https://business.safety.google/adsprocessorterms. Opt-out: Browser opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de. Advertising display settings: https://adssettings.google.com/authenticated. Further information: https://privacy.google.com/businesses/adsservices, concerning types of processing and data processed.

PROMOTIONAL COMMUNICATION BY EMAIL, POST, FAX OR TELEPHONE

We process personal data for promotional communication that may take place through various channels, such as email, telephone, post or fax, in accordance with statutory requirements.

Recipients have the right to withdraw consent they have given at any time or to object to promotional communication at any time.

After withdrawal or objection, on the basis of our legitimate interests, we store the data required to demonstrate the previous authorisation to contact or send communications for up to three years after the end of the year in which consent was withdrawn or the objection was made. Processing of these data is restricted to the possible defence of claims. On the basis of our legitimate interest in permanently observing users’ withdrawal or objection, we also store the data required to prevent renewed contact, such as the email address, telephone number or name, depending on the communication channel.

Types of data processed: Master data, such as names and addresses; contact data, such as email addresses and telephone numbers.

Data subjects: Communication partners.

Purposes of processing: Direct marketing, such as by email or post.

Legal bases: Consent (Art. 6(1), first sentence, point (a) GDPR); legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

WEB ANALYTICS, MONITORING AND OPTIMISATION

Web analytics, also referred to as reach measurement, are used to evaluate visitor flows within our online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, in the form of pseudonymous values. Reach analysis allows us, for example, to identify when our online offering, its functions or its content are used most frequently or encourage repeat use. We can also identify areas that require optimisation.

In addition to web analytics, we may use testing procedures, for example to test and optimise different versions of our online offering or its components.

Unless otherwise stated below, profiles may be created for these purposes, meaning data combined in relation to a usage event, and information may be stored in and read from a browser or end device. The information collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system, and usage times. Where users have consented to the collection of location data by us or by providers of services we use, location data may also be processed.

Users’ IP addresses are also stored. However, we use an IP-masking procedure, meaning pseudonymisation by shortening the IP address, to protect users. As a rule, no directly identifying user data, such as email addresses or names, are stored in connection with web analytics, A/B testing and optimisation; instead, pseudonyms are used. This means that neither we nor the providers of the software used know users’ actual identities, but only the information stored in their profiles for the purposes of the relevant procedures.

Types of data processed: Usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Reach measurement, such as access statistics and recognition of returning visitors; profiles containing user-related information, meaning the creation of user profiles; tracking, such as interest- or behaviour-based profiling and the use of cookies; provision of our online offering and user-friendliness.

Security measures: IP masking, meaning pseudonymisation of the IP address.

Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR).

Further information on processing activities, procedures and services:

Google Analytics: Web analytics, reach measurement and measurement of user flows. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://marketingplatform.google.com/intl/de/about/analytics/. Privacy policy: https://policies.google.com/privacy. Data processing agreement: https://business.safety.google/adsprocessorterms. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: https://business.safety.google/adsprocessorterms. Opt-out: Browser opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de. Advertising display settings: https://adssettings.google.com/authenticated. Further information: https://privacy.google.com/businesses/adsservices, concerning types of processing and data processed.
Google Tag Manager: Google Tag Manager is a solution that enables us to manage so-called website tags through an interface and thereby integrate other services into our online offering; please refer to the additional information in this privacy policy. Tag Manager itself, which implements the tags, does not create user profiles or store cookies. Google receives only the user’s IP address, which is necessary to run Google Tag Manager. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://marketingplatform.google.com. Privacy policy: https://policies.google.com/privacy. Data processing agreement: https://business.safety.google/adsprocessorterms. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: https://business.safety.google/adsprocessorterms. Further information: https://privacy.google.com/businesses/adsservices, concerning types of processing and data processed.

ONLINE MARKETING

We process personal data for online-marketing purposes. This may include, in particular, marketing advertising space or presenting promotional and other content, collectively referred to as “content”, on the basis of users’ potential interests, and measuring its effectiveness.

For these purposes, user profiles are created and stored in a file known as a cookie, or comparable procedures are used to store information about users that is relevant to the presentation of the aforementioned content. This information may include content viewed, websites visited, online networks used, communication partners, and technical information such as the browser and computer system used, usage times, and functions used. Where users have consented to the collection of their location data, these data may also be processed.

Users’ IP addresses are also stored. However, we use available IP-masking procedures, meaning pseudonymisation by shortening the IP address, to protect users. As a rule, no directly identifying user data, such as email addresses or names, are stored in online-marketing procedures; instead, pseudonyms are used. This means that neither we nor the providers of online-marketing procedures know users’ actual identities, but only the information stored in their profiles.

The information in profiles is generally stored in cookies or using similar procedures. These cookies may later also be read on other websites that use the same online-marketing procedure, analysed for the purpose of presenting content, supplemented with further data, and stored on the server of the online-marketing procedure provider.

In exceptional cases, directly identifying data may be associated with profiles. This is the case, for example, where users are members of a social network whose online-marketing procedures we use and the network links users’ profiles with the aforementioned information. Please note that users may enter into additional agreements with providers, for example by giving consent during registration.

As a rule, we have access only to aggregated information about the success of our advertisements. However, as part of conversion measurement, we may determine which of our online-marketing procedures led to a conversion, for example the conclusion of a contract with us. Conversion measurement is used solely to analyse the success of our marketing activities.

Unless otherwise stated, please assume that cookies used for these purposes are stored for two years.

Types of data processed: Content data, such as entries in online forms; usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses; Facebook event data. “Event data” are data that may be transmitted by us to Facebook, for example through the Facebook Pixel, through apps or by other means, and that relate to persons or their actions. They include information about website visits, interactions with content and functions, app installations, purchases of products and similar events. Event data are processed to create target groups for content and advertising information, known as Custom Audiences. Event data do not include the actual content, such as comments written, login information, or contact information such as names, email addresses and telephone numbers. Facebook deletes event data after no more than two years, and target groups created from them are deleted when our Facebook account is deleted.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Reach measurement, such as access statistics and recognition of returning visitors; tracking, such as interest- or behaviour-based profiling and the use of cookies; conversion measurement, meaning measurement of the effectiveness of marketing activities; target group formation; marketing; profiles containing user-related information, meaning the creation of user profiles; target group formation, meaning determination of target groups relevant for marketing purposes or other delivery of content; provision of our online offering and user-friendliness.

Security measures: IP masking, meaning pseudonymisation of the IP address.

Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR).

Right to object (opt-out): We refer to the privacy notices of the respective providers and the opt-out options specified for those providers. Where no explicit opt-out option is specified, you may disable cookies in your browser settings. However, this may restrict functions of our online offering. We therefore also recommend the following regional opt-out options: (a) Europe: https://www.youronlinechoices.eu. (b) Canada: https://www.youradchoices.ca/choices. (c) USA: https://www.aboutads.info/choices. (d) Cross-regional: https://optout.aboutads.info.

Further information on processing activities, procedures and services:

Facebook Pixel and target group formation (Custom Audiences): The Facebook Pixel, or comparable functions for transmitting event data or contact information through interfaces in apps, enables Facebook to identify visitors to our online offering as a target group for displaying advertisements known as Facebook Ads. We accordingly use the Facebook Pixel so that the Facebook Ads placed by us are shown on Facebook and within the services of partners cooperating with Facebook, known as the Audience Network at https://www.facebook.com/audiencenetwork/, only to users who have shown an interest in our online offering or who have particular characteristics, such as an interest in certain topics or products evident from websites visited, that we transmit to Facebook as Custom Audiences. We also use the Facebook Pixel to help ensure that our Facebook Ads correspond to users’ potential interests and are not perceived as intrusive. The Facebook Pixel also enables us to assess the effectiveness of Facebook advertisements for statistical and market-research purposes by determining whether users were redirected to our website after clicking on a Facebook advertisement, known as conversion measurement.
Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://www.facebook.com. Privacy policy: https://www.facebook.com/about/privacy. Further information: Users’ event data, meaning behavioural and interest information, are processed for targeted advertising and target group formation on the basis of the joint-controller agreement, the “Controller Addendum”, available at https://www.facebook.com/legal/controller_addendum. Joint controllership is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company established in the EU. Further processing is the sole responsibility of Meta Platforms Ireland Limited, including, in particular, transfers to its parent company Meta Platforms, Inc. in the USA, on the basis of Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.
Facebook advertisements: Placement of advertisements within the Facebook platform and evaluation of advertising results. Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://www.facebook.com. Privacy policy: https://www.facebook.com/about/privacy. Opt-out: We refer to the privacy and advertising settings in users’ profiles on Facebook platforms, Facebook’s consent procedures, and the contact options described in Facebook’s privacy policy for exercising rights of access and other data-subject rights. Further information: Users’ event data, meaning behavioural and interest information, are processed for targeted advertising and target group formation on the basis of the joint-controller agreement, the “Controller Addendum”, available at https://www.facebook.com/legal/controller_addendum. Joint controllership is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company established in the EU. Further processing is the sole responsibility of Meta Platforms Ireland Limited, including, in particular, transfers to its parent company Meta Platforms, Inc. in the USA, on the basis of Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.
Google Ads and conversion measurement: We use the “Google Ads” online-marketing procedure to place advertisements in Google’s advertising network, for example in search results, videos and websites, so that they are displayed to users who are presumed to be interested in the advertisements. We also measure advertising conversions. However, we receive only the anonymous total number of users who clicked on our advertisement and were redirected to a page equipped with a so-called conversion-tracking tag. We do not receive information that would enable us to identify users. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://marketingplatform.google.com. Privacy policy: https://policies.google.com/privacy. Further information on types of processing and data processed: https://privacy.google.com/businesses/adsservices. Data-processing terms between controllers and Standard Contractual Clauses for transfers to third countries: https://business.safety.google/adscontrollerterms.
Google AdSense with personalised advertisements: We use Google AdSense with personalised advertisements to display advertisements within our online offering and receive remuneration for their display or other use. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://marketingplatform.google.com. Privacy policy: https://policies.google.com/privacy. Further information on types of processing and data processed: https://privacy.google.com/businesses/adsservices. Data-processing terms for Google advertising products, including information about the services, terms between controllers and Standard Contractual Clauses for transfers to third countries: https://business.safety.google/adscontrollerterms.
Instagram advertisements: Placement of advertisements within the Instagram platform and evaluation of advertising results. Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Legal basis: Consent (Art. 6(1), first sentence, point (a) GDPR). Website: https://www.instagram.com. Privacy policy: https://instagram.com/about/legal/privacy. Opt-out: We refer to the privacy and advertising settings in users’ profiles on Instagram, Instagram’s consent procedures, and the contact options described in Instagram’s privacy policy for exercising rights of access and other data-subject rights. Further information: Users’ event data, meaning behavioural and interest information, are processed for targeted advertising and target group formation on the basis of the joint-controller agreement, the “Controller Addendum”, available at https://www.facebook.com/legal/controller_addendum. Joint controllership is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company established in the EU. Further processing is the sole responsibility of Meta Platforms Ireland Limited, including, in particular, transfers to its parent company Meta Platforms, Inc. in the USA, on the basis of Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.

CUSTOMER REVIEWS AND RATING PROCEDURES

We participate in review and rating procedures in order to evaluate, optimise and promote our services. Where users review us through the participating review platforms or procedures or otherwise provide feedback, the providers’ general terms and conditions or terms of use and privacy notices also apply. As a rule, submitting a review also requires registration with the respective provider.

To ensure that reviewers have actually used our services, with customers’ consent we transmit the necessary data concerning the customer and the service used to the respective review platform, including name, email address and order number or item number. These data are used solely to verify the user’s authenticity.

Types of data processed: Contract data, such as the subject matter of the contract, term and customer category; usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses.

Data subjects: Customers; users, such as website visitors and users of online services.

Purposes of processing: Feedback, such as collecting feedback through online forms; marketing.

Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Rating widget: We embed so-called rating widgets in our online offering. A widget is a functional and content element embedded in our online offering that displays changing information. It may be displayed, for example, as a seal or a comparable element, sometimes also called a badge. Although the widget’s content is displayed within our online offering, it is retrieved at that moment from the servers of the relevant widget provider. This is the only way to ensure that current content, particularly the current rating, is always displayed. For this purpose, a data connection must be established between the webpage accessed within our online offering and the widget provider’s server, and the widget provider receives certain technical data, including access data and the IP address, that are necessary to deliver the widget’s content to the user’s browser.
The widget provider also receives information that users have visited our online offering. This information may be stored in a cookie and used by the widget provider to identify which online offerings participating in the rating procedure have been visited by the user. The information may be stored in a user profile and used for advertising or market-research purposes. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).
Trustpilot: Review platform. Service provider: Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://de.trustpilot.com. Privacy policy: https://de.legal.trustpilot.com/end-user-privacy-terms.

PRESENCE ON SOCIAL NETWORKS (SOCIAL MEDIA)

We maintain online presences within social networks and process users’ data in this context in order to communicate with users active there or provide information about us.

Please note that users’ data may be processed outside the European Union. This may create risks for users, for example because it may make the enforcement of users’ rights more difficult.

In addition, users’ data within social networks are generally processed for market-research and advertising purposes. For example, usage profiles may be created on the basis of users’ usage behaviour and resulting interests. Usage profiles may then be used, for example, to display advertisements within and outside the networks that are presumed to correspond to users’ interests. For these purposes, cookies are generally stored on users’ computers containing information about their usage behaviour and interests. Data may also be stored in usage profiles independently of the devices used by users, particularly where users are members of the relevant platforms and are logged in.

For a detailed description of the relevant forms of processing and opt-out options, please refer to the privacy policies and information provided by the operators of the respective networks.

With regard to requests for access and the exercise of data-subject rights, we also point out that these can be exercised most effectively with the providers. Only the providers have access to users’ data and can take appropriate measures and provide information directly. Nevertheless, you may contact us if you require assistance.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Contact inquiries and communication; feedback, such as collecting feedback through online forms; marketing.

Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Instagram: Social network. Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://www.instagram.com. Privacy policy: https://instagram.com/about/legal/privacy.
Facebook Pages: Profiles within the Facebook social network. We and Meta Platforms Ireland Limited are jointly responsible for the collection, but not the further processing, of data relating to visitors to our Facebook Page, known as a fan page. These data include information about the types of content users view or interact with and actions they take; see “Things you and others do and provide” in Facebook’s Data Policy at https://www.facebook.com/policy. They also include information about the devices used by users, such as IP addresses, operating system, browser type, language settings and cookie data; see “Device information” in Facebook’s Data Policy at https://www.facebook.com/policy.
As explained under “How do we use this information?” in Facebook’s Data Policy, Facebook also collects and uses information to provide analytics services, known as Page Insights, to page operators so that they can understand how people interact with their pages and associated content. We have entered into a special agreement with Facebook, “Information about Page Insights”, available at https://www.facebook.com/legal/terms/page_controller_addendum. This agreement regulates, in particular, the security measures Facebook must observe, and Facebook has agreed to fulfil data-subject rights, meaning users may, for example, submit access or deletion requests directly to Facebook. Users’ rights, particularly rights of access, deletion, objection and complaint to the competent supervisory authority, are not restricted by the agreements with Facebook. Further information can be found in “Information about Page Insights” at https://www.facebook.com/legal/terms/information_about_page_insights_data.
Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://www.facebook.com. Privacy policy: https://www.facebook.com/about/privacy. Standard Contractual Clauses, ensuring an adequate level of data protection when processing data in third countries: https://www.facebook.com/legal/EU_data_transfer_addendum. Further information: Joint-controller agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. Joint controllership is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company established in the EU. Further processing is the sole responsibility of Meta Platforms Ireland Limited, including, in particular, transfers to its parent company Meta Platforms, Inc. in the USA, on the basis of Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.
Twitter: Social network. Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland. Parent company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Privacy policy: https://twitter.com/privacy. Settings: https://twitter.com/personalization.

PLUGINS, EMBEDDED FUNCTIONS AND CONTENT

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers, hereinafter referred to as “third-party providers”. These may include graphics, videos or maps, hereinafter collectively referred to as “content”.

Integration always requires the third-party providers of this content to process users’ IP addresses, because without the IP address they could not send the content to users’ browsers. The IP address is therefore required to display this content or these functions. We endeavour to use only content whose providers use the IP address solely to deliver the content.

Third-party providers may also use so-called pixel tags, meaning invisible graphics also known as web beacons, for statistical or marketing purposes. Pixel tags may be used to evaluate information such as visitor traffic on pages of this website. Pseudonymous information may also be stored in cookies on users’ devices and may contain technical information about the browser and operating system, referring websites, the time of the visit, and other information about use of our online offering. It may also be linked with comparable information from other sources.

Types of data processed: Usage data, such as websites visited, interest in content and access times; meta/communication data, such as device information and IP addresses; location data, meaning information about the geographical position of a device or person.

Data subjects: Users, such as website visitors and users of online services.

Purposes of processing: Provision of our online offering and user-friendliness; provision of contractual services and customer support.

Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

Integration of third-party software, scripts or frameworks, such as jQuery: We integrate software into our online offering that we retrieve from the servers of other providers, such as function libraries used to display our online offering or improve its user-friendliness. The respective providers collect users’ IP addresses and may process them to transmit the software to users’ browsers, for security purposes, and to evaluate and optimise their offering. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR).
Google Fonts, retrieved from Google’s server: Retrieval of fonts and symbols for the technically secure, maintenance-free and efficient use of fonts and symbols, taking account of currentness, loading times, consistent display and possible licensing restrictions. The font provider receives the user’s IP address so that the fonts can be made available in the user’s browser. Technical data, such as language settings, screen resolution, operating system and hardware used, are also transmitted where necessary to provide the fonts according to the devices and technical environment used. These data may be processed on a server of the font provider in the USA.
When users visit our online offering, their browsers send HTTP requests to the Google Fonts Web API, meaning a software interface for retrieving fonts. The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) for Google Fonts and then the fonts specified in the CSS. These HTTP requests include: (1) the IP address used by the relevant user to access the internet; (2) the requested URL on the Google server; and (3) the HTTP headers, including the user agent describing the browser and operating-system versions of website visitors, and the referrer URL, meaning the webpage on which the Google font is to be displayed.
IP addresses are neither logged nor stored on Google servers and are not analysed. The Google Fonts Web API logs details of HTTP requests, namely the requested URL, user agent and referrer URL. Access to these data is restricted and strictly controlled. The requested URL identifies the font families that the user wishes to load. These data are logged so that Google can determine how often a particular font family is requested. The Google Fonts Web API uses the user agent to adapt the font generated for the relevant browser type. The user agent is logged primarily for debugging and used to generate aggregated usage statistics measuring the popularity of font families. These aggregated usage statistics are published on Google Fonts’ “Analytics” page. Finally, the referrer URL is logged so that the data can be used for production maintenance and to generate an aggregated report on top integrations based on the number of font requests.
According to Google, none of the information collected by Google Fonts is used to create profiles of end users or display targeted advertisements. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://fonts.google.com/. Privacy policy: https://policies.google.com/privacy. Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
Google Maps: We integrate maps from Google’s “Google Maps” service. Data processed may include, in particular, users’ IP addresses and location data. Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://mapsplatform.google.com/. Privacy policy: https://policies.google.com/privacy.
reCAPTCHA: We integrate the “reCAPTCHA” function to determine whether entries, for example in online forms, are made by humans rather than automated machines known as bots. Data processed may include IP addresses; information about operating systems, devices or browsers used; language settings; location; mouse movements; keystrokes; time spent on websites; websites previously visited; interactions with reCAPTCHA on other websites; cookies in some circumstances; and the results of manual recognition procedures, such as answering questions or selecting objects in images. Processing is based on our legitimate interest in protecting our online offering against abusive automated crawling and spam. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR). Website: https://www.google.com/recaptcha/. Privacy policy: https://policies.google.com/privacy. Opt-out: Browser opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de. Advertising display settings: https://adssettings.google.com/authenticated.

AMENDMENT AND UPDATING OF THE PRIVACY POLICY

We ask you to review the content of our privacy policy regularly. We amend the privacy policy whenever changes to the data processing carried out by us make this necessary. We will inform you where changes require action on your part, such as consent, or another form of individual notification.

Where we provide addresses and contact details of companies and organisations in this privacy policy, please note that addresses may change over time and verify the information before making contact.

DEFINITIONS

This section provides an overview of the terms used in this privacy policy. Many terms are derived from the law and are defined, in particular, in Article 4 GDPR. The statutory definitions are binding. The explanations below are intended primarily to aid understanding. The terms are arranged alphabetically.

Content Delivery Network (CDN): A Content Delivery Network is a service that enables content within an online offering, particularly large media files such as graphics or program scripts, to be delivered more quickly and securely using regionally distributed servers connected through the internet.

Conversion measurement: Conversion measurement, also referred to as visit-action evaluation, is a procedure used to determine the effectiveness of marketing activities. As a rule, a cookie is stored on users’ devices within the websites on which the marketing activities take place and is then retrieved again on the target website. This enables us, for example, to determine whether advertisements placed by us on other websites were successful.

Personal data: “Personal data” means any information relating to an identified or identifiable natural person, hereinafter referred to as the “data subject”. An identifiable natural person is one who can be identified directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier such as a cookie, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Profiles containing user-related information: Processing of “profiles containing user-related information”, or “profiles” for short, includes any form of automated processing of personal data consisting of the use of those personal data to analyse, evaluate or predict certain personal aspects relating to a natural person. Depending on the type of profiling, this may include various information concerning demographics, behaviour and interests, such as interaction with websites and their content, interests in particular content or products, clicking behaviour on a website, or location. Cookies and web beacons are frequently used for profiling purposes.

Reach measurement: Reach measurement, also known as web analytics, is used to evaluate visitor flows within an online offering and may include visitors’ behaviour or interests in particular information, such as website content. Reach analysis allows website operators, for example, to identify when visitors access their website and which content interests them. This enables them to adapt website content more closely to visitors’ needs. Pseudonymous cookies and web beacons are frequently used for reach analysis to recognise returning visitors and obtain more accurate analyses of how an online offering is used.

Location data: Location data are generated when a mobile device, or another device with the technical capacity to determine location, connects to a mobile network cell, wireless network or comparable technical intermediary or location function. Location data indicate the geographically identifiable position on Earth at which the relevant device is located. They may be used, for example, to display map functions or other information dependent on a location.

Tracking: “Tracking” refers to the ability to trace users’ behaviour across several online offerings. As a rule, behavioural and interest information relating to the online offerings used is stored in cookies or on the servers of providers of tracking technologies, known as profiling. This information may then be used, for example, to display advertisements to users that are likely to correspond to their interests.

Controller: The “controller” is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data.

Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and includes practically any handling of data, including collection, evaluation, storage, transmission and deletion.

Target group formation: Target group formation, also known as “Custom Audiences”, refers to determining target groups for advertising purposes, such as the display of advertisements. For example, a user’s interest in particular products or topics on the internet may support an inference that the user is interested in advertisements for similar products or for the online shop in which the products were viewed. “Lookalike Audiences”, or similar target groups, refers to displaying content considered suitable to users whose profiles or interests are presumed to correspond to those of users for whom profiles have been created. Cookies and web beacons are generally used to create Custom Audiences and Lookalike Audiences.

Data Protection

PRIVACY POLICY

INTRODUCTION

TABLE OF CONTENTS

CONTROLLER

OVERVIEW OF PROCESSING ACTIVITIES

Types of Data Processed

Categories of Data Subjects

Purposes of Processing

RELEVANT LEGAL BASES

SECURITY MEASURES

DATA PROCESSING IN THIRD COUNTRIES

DELETION OF DATA

USE OF COOKIES

BUSINESS SERVICES

PAYMENT PROCEDURES

PROVISION OF THE ONLINE OFFERING AND WEB HOSTING

REGISTRATION, LOGIN AND USER ACCOUNT

COMMUNITY FUNCTIONS

BLOGS AND PUBLICATION MEDIA

CONTACT AND INQUIRY MANAGEMENT

PUSH NOTIFICATIONS

CLOUD SERVICES

NEWSLETTERS AND ELECTRONIC NOTIFICATIONS

PROMOTIONAL COMMUNICATION BY EMAIL, POST, FAX OR TELEPHONE

WEB ANALYTICS, MONITORING AND OPTIMISATION

ONLINE MARKETING

CUSTOMER REVIEWS AND RATING PROCEDURES

PRESENCE ON SOCIAL NETWORKS (SOCIAL MEDIA)

PLUGINS, EMBEDDED FUNCTIONS AND CONTENT

AMENDMENT AND UPDATING OF THE PRIVACY POLICY

DEFINITIONS