Privacy Policy

Introduction

Types of Data Processed

• Master data (e.g., names, addresses).
• Content data (e.g., entries in online forms).
• Contact data (e.g., email, phone numbers).
• Meta/communication data (e.g., device information, IP addresses).
• Usage data (e.g., visited websites, interest in content, access times).
• Contract data (e.g., subject matter of contract, term, customer category).

Categories of Data Subjects

• Business and contractual partners.
• Prospective customers.
• Communication partners.
• Customers.
• Users (e.g., website visitors, users of online services).

Purposes of Processing

• Provision of our online offering and user-friendliness.
• Direct marketing (e.g., by email or postal).
• Feedback (e.g., collecting feedback via online form).
• Contact requests and communication.
• Reach measurement (e.g., access statistics, recognition of returning visitors).
• Security measures.
• Provision of contractual services and customer service.
• Management and response to inquiries.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different likelihood and extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include in particular securing the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, transfer, securing availability and separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data and responses to data threats. We also consider the protection of personal data in the development or selection of hardware, software and procedures in accordance with the principle of data protection by design and by default.

SSL encryption (https): To protect your data transmitted via our online offering, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Subject to express consent or contractually or legally required transmission, we only process or have data processed in third countries with a recognized level of data protection, with contractual obligations through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, EU Commission information page: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en

Deletion of Data

The data processed by us will be deleted in accordance with legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g., if the purpose of processing this data has ceased to apply or it is not required for the purpose).

If the data is not deleted because it is required for other and legally permissible purposes, its processing will be limited to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.

Within the framework of our data protection information, we may provide users with further information on the deletion and retention of data that are specific to the respective processing procedures.

Use of Cookies

Cookies are small text files stored by your browser. If we use cookies in the future, we will inform you and, if necessary, obtain your consent.

Technically necessary cookies: Should we use technically necessary cookies in the future (e.g., for session management), this will be done on the basis of Art. 6 para. 1 lit. f GDPR.

Business Services

We process data of our contractual and business partners, e.g., customers and prospective customers (collectively referred to as "contractual partners") within the framework of contractual and comparable legal relationships and related measures and in the context of communication with contractual partners (or pre-contractually), e.g., to respond to inquiries.

We process this data to fulfill our contractual obligations, to secure our rights and for the purposes of the administrative tasks associated with this information and corporate organization. We only pass on the data of the contractual partners to third parties within the framework of applicable law to the extent that this is necessary for the aforementioned purposes or for the fulfillment of legal obligations or with the consent of the persons concerned (e.g., to participating telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners are informed about further forms of processing, e.g., for marketing purposes, within the framework of this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or in the course of data collection, e.g., in online forms, by special marking (e.g., colors) or symbols (e.g., asterisks or similar), or in person.

We delete the data after the expiry of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for archiving reasons required by law (e.g., for tax purposes, generally 10 years). Data disclosed to us by the contractual partner within the framework of an order is deleted in accordance with the specifications of the order, generally after the end of the order.

If we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between users and providers.

Provision of Online Offering and Web Hosting

In order to provide our online offering securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offering can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.

The data processed in the context of providing the hosting offering may include all information relating to users of our online offering that is generated in the course of use and communication. This regularly includes the IP address, which is necessary to deliver the contents of online offerings to browsers, and all entries made within our online offering or from websites.

Collection of access data and log files: We (or our web hosting provider) collect data on every access to the server (so-called server log files). Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

Server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks) and to ensure server utilization and stability.

Web Hosting Provider

Our web hosting is provided by:

Uberspace

Jonas Pasche

Kaiserstrasse 15

55116 Mainz

Germany

Website: https://uberspace.de

Privacy policy: https://uberspace.de/privacy

The hosting provider processes data generated when visiting our website (IP addresses, access times, etc.) on our behalf. The servers are located exclusively in Germany. Processing is carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR.

Legal basis: Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in the reliable and secure operation of our website.

Contact and Inquiry Management

When contacting us (e.g., via contact form, email, telephone or via social media) as well as within the framework of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

The response to contact requests as well as the management of contact and inquiry data within the framework of contractual or pre-contractual relationships is carried out for the fulfillment of our contractual obligations or for responding to (pre-)contractual requests and otherwise on the basis of legitimate interests in responding to requests and maintaining user or business relationships.

Contact Form with Formtaxi

For our contact form, we use the service Formtaxi, a GDPR-compliant form service.

Provider:

Formtaxi.com

Operated by: Leander Lenzing & Alexander Weiss GbR

Germany

Website: https://form.taxi

Privacy policy: https://form.taxi/privacy

Processed data: When you use our contact form, the data you enter (name, email address, message, etc.) is processed via Formtaxi and forwarded to us. Data processing takes place exclusively on servers in Germany.

Purpose: The use of Formtaxi serves the secure and GDPR-compliant processing of your contact requests. Formtaxi ensures that your data is transmitted encrypted and offers additional security features such as spam protection.

Legal basis: Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in the secure and efficient processing of your contact requests.

Data processing agreement: We have concluded a data processing agreement with Formtaxi in accordance with Art. 28 GDPR. Formtaxi processes your data exclusively according to our instructions.

Changes and Updates to the Privacy Policy

Definitions

In this section, you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are primarily defined in Art. 4 GDPR. The legal definitions are binding. The following explanations are intended primarily to aid understanding. The terms are sorted alphabetically.

Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Controller: "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processing: "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, whether collecting, evaluating, storing, transmitting or deleting.