Book a Session
English
DeutschDeutschEnglishEnglishEspañol
0

Privacy Policy

Privacy Policy

Introduction

With the following privacy policy, we want to let you know which types of your personal data (hereinafter also briefly referred to as “data”) we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in connection with providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offer”).

The terms used are gender-neutral.

Last updated: April 10, 2022

Table of Contents

Data Controller

Nadine Gina Krüger
Spanische Allee 6A
14129 Berlin
Germany

Email address:

nadineberlinpt@gmail.com

Overview of data processing

The overview below summarizes the types of data we process and the purposes of processing, and refers to the data subjects.

Types of data processed

  • Master data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta-/communication data.
  • Event data (Facebook).

Categories of people affected

  • Clients.
  • Prospective clients.
  • People we communicate with.
  • Users.
  • Business and contract partners.

Why we process data

  • Providing contracted services and customer support.
  • Contact inquiries and communication.
  • Security measures.
  • Direct marketing.
  • Reach measurement.
  • Office and organizational processes.
  • Managing and responding to inquiries.
  • Feedback.
  • Marketing.
  • Profile with information about you.
  • Providing our online offer and making it user-friendly.

Relevant legal bases

Below, you’ll find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the GDPR, national data protection requirements may apply in your country or our country of residence or registered office. If more specific legal bases apply in individual cases, we will inform you in the privacy policy.

  • Consent (Art. 6(1)(a) GDPR) – You have given consent to the processing of your personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which you are party, or to take steps at your request prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c) GDPR) – We need to process your data to fulfill a legal obligation that applies to us.
  • Legitimate interests (Art. 6(1)(f) GDPR) – We process your data to protect our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms that require the protection of personal data take precedence.

In addition to the data protection rules of the General Data Protection Regulation, national data protection laws in Germany also apply. These include, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special rules, especially on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, transfers, and automated individual decision-making in individual cases, including profiling. It also regulates data processing for purposes of the employment relationship (§ 26 BDSG), particularly with regard to establishing, carrying out, or ending employment relationships, as well as employee consent. In addition, the data protection laws of the individual federal states may apply.

Security measures

We take suitable technical and organizational measures, in accordance with legal requirements, to ensure a level of protection appropriate to the risk. In doing so, we consider the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the different likelihoods and extent of risks to people's rights and freedoms.

These measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input, disclosure, availability, and separation of the data. We have also established procedures that ensure the exercise of data subject rights, the deletion of data, and responses to threats to data. Furthermore, we consider the protection of personal data already when developing or selecting hardware, software, and procedures, in line with the principle of data protection by design and by default.

SSL encryption (https): To protect the data you send through our online offering, we use SSL encryption. You can recognize these encrypted connections by the https:// prefix in your browser's address bar.

Sharing your personal data

In the course of our processing of personal data, it may happen that data is transmitted to or disclosed to other entities, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we comply with legal requirements and conclude appropriate contracts or agreements with the recipients to protect your data.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if processing takes place in the context of using third-party services or disclosing or transferring data to other persons, entities, or companies, this is done only in compliance with legal requirements.

Vorbehaltlich ausdrücklicher Einwilligung oder vertraglich oder gesetzlich erforderlicher Übermittlung verarbeiten oder lassen wir die Daten nur in Drittländern mit einem anerkannten Datenschutzniveau, vertraglichen Verpflichtung durch sogenannte Standardschutzklauseln der EU-Kommission, beim Vorliegen von Zertifizierungen oder verbindlicher internen Datenschutzvorschriften verarbeiten (Art. 44 bis 49 DSGVO, Informationsseite der EU-Kommission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Data deletion

We delete the data we process in accordance with legal requirements as soon as the consent allowing us to process it is withdrawn or other legal bases no longer apply (for example, if the purpose for processing the data no longer exists or the data are no longer necessary for that purpose).

If we do not delete data because it is needed for other legally permitted purposes, we limit its processing to those purposes. This means the data are blocked and not used for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or where storage is necessary to assert, exercise, or defend legal claims or to protect the rights of another natural or legal person.

Our privacy notices may also include further details about data retention and deletion that take priority for the specific processing activities.

Use of cookies

Cookies are small text files or other storage entries that save information on your device and read information from it. For example, they can store your login status in a user account, the contents of your shopping cart in an online shop, the content you have accessed, or the features you have used on our online offer. Cookies can also be used for different purposes, such as ensuring the functionality, security, and comfort of online offers, as well as creating analyses of visitor flows.

Notes on consent: We use cookies in line with legal requirements. That’s why we ask for your prior consent, unless consent is not legally required. In particular, consent is not necessary when storing and reading information—including cookies—is strictly necessary to provide you with a telemedia service you have expressly requested (in other words, our online offer). We clearly communicate the revocable consent to you and include information about the specific use of cookies.

Notes on data protection legal bases: The legal basis we use to process your personal data with cookies depends on whether we ask for your consent. If you consent, the legal basis for processing your data is the consent you give. Otherwise, we process data collected using cookies on the basis of our legitimate interests (for example, in running our online offer as a business and improving its usability) or, where applicable, to fulfill our contractual obligations when cookies are necessary to meet those obligations. We explain the purposes for which we process cookies throughout this privacy policy or within our consent and processing procedures.

Storage duration: With regard to storage duration, we distinguish between the following types of cookies:

  • Temporary Cookies (also known as Session or Persistent Cookies): Temporary cookies are deleted at the latest after a user leaves an online service and closes their device (e.g., browser or mobile app).
  • Permanent Cookies: Permanent cookies remain stored even after the device is closed. This allows, for example, your login status to be saved or preferred content to be displayed directly when you revisit a website. Similarly, data collected via cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g., when obtaining consent), users should assume that cookies are permanent and may have a storage duration of up to two years.

General Information on Revocation and Objection (Opt-Out): Users can revoke their given consents at any time and also lodge an objection to processing in accordance with the legal requirements under Art. 21 GDPR (further information on objections will be provided within this privacy policy). Users can also declare their objection through their browser settings.

Further Information on Processing Processes, Procedures, and Services:

  • Processing of Cookie Data Based on Consent: We use a cookie consent management process to obtain, manage, and allow revocation of users' consents for the use of cookies, or the processing and providers mentioned within the cookie consent management procedure. The declaration of consent is stored so that it does not need to be requested again and so that consent can be proven in accordance with legal obligations. Storage can occur server-side and/or in a cookie (so-called Opt-In cookie, or using comparable technologies) to assign consent to a user or their device. Subject to individual details regarding providers of cookie management services, the following notes apply: The storage duration of consent can be up to two years. A pseudonymous user identifier is created and stored along with the time of consent, details on the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system, and device used.

Business services

We process data from our contractual and business partners, such as customers and prospects (collectively referred to as "Contract Partners"), within the framework of contractual and comparable legal relationships and associated measures, as well as in communication with Contract Partners (or pre-contractually), for example, to answer inquiries.

We process this data to fulfill our contractual obligations. These include, in particular, obligations to provide agreed-upon services, any update duties, and remedies for warranty and other performance defects. Furthermore, we process the data to safeguard our rights and for administrative tasks and company organization related to these duties. Additionally, we process the data based on our legitimate interests in proper and economically sound business management, as well as security measures to protect our Contract Partners and our business operations from misuse, endangerment of their data, secrets, information, and rights (e.g., involving telecommunications, transport, and other auxiliary services, subcontractors, banks, tax and legal advisors, payment service providers, or financial authorities). Within the scope of applicable law, we pass on Contract Partners' data to third parties only to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contract Partners will be informed about further forms of processing, e.g., for marketing purposes, within this privacy policy.

We inform Contract Partners before or during data collection which data is required for the aforementioned purposes, for example, in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete data after statutory warranty and comparable obligations expire, i.e., generally after 4 years, unless the data is stored in a customer account, for example, as long as it must be retained for legal archiving reasons (e.g., for tax purposes, usually 10 years). Data disclosed to us by a contracting party within the scope of an order is deleted in accordance with the order’s requirements, generally after the end of the order.

Where we use third-party providers or platforms to deliver our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply between users and providers.

Customer account

As a contracting party, you can create an account within our online offering (e.g. customer or user account, briefly “customer account”). If registering a customer account is required, we will point this out to you, as well as the information needed for registration. Customer accounts are not public and cannot be indexed by search engines. When you register, log in, and use your customer account, we store your IP address along with the access times so we can prove the registration and help prevent any misuse of your customer account.

If you have cancelled your customer account, the data relating to it will be deleted, unless it must be retained for legal reasons. It is up to you to back up your data after your customer account has been cancelled.

Shop and E-Commerce

We process our customers' data to enable you to select, purchase, or order the chosen products, goods, and related services, as well as to pay for and receive or have them carried out. If needed to fulfil an order, we use service providers, especially postal, freight, and shipping companies, to carry out delivery or execution for you. To process payment transactions, we use the services of banks and payment providers. The required details are marked as such during the ordering or comparable purchase process and include the information needed for delivery, provision, and billing, as well as contact information so we can get in touch if needed.

  • Types of data processed: Customer data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email, phone numbers); contract data (e.g. subject matter of the contract, duration, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Affected persons: Customers; prospects; business and contractual partners.
  • Purposes of processing: Providing contractual services and customer service; security measures; contact requests and communication; office and organizational processes; administration and answering inquiries.
  • Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR); legal obligation (Art. 6(1)(c) GDPR).

Payment processing

In the context of contractual and other legal relationships, due to legal obligations, or otherwise based on our legitimate interests, we offer affected individuals efficient and secure payment options and, for this purpose, use additional service providers alongside banks and credit institutions (collectively 'payment service providers').

The data processed by the payment service providers includes inventory data, such as name and address, banking data, such as account numbers or credit card numbers, passwords, TANs, and checksums, as well as contract-, amount-, and recipient-related information. This information is necessary to carry out transactions. However, the data you enter is processed and stored only by the payment service providers. This means we do not receive account- or credit-card-related information, but only confirmation or negative information about the payment. In some cases, the payment service providers may transmit data to credit reporting agencies. This transmission is intended for identity and creditworthiness checks. For this, we refer you to the terms and conditions and privacy notices of the payment service providers.

The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions and can be accessed on their respective websites or transaction applications. We also refer to them for further information and for exercising rights of revocation, information, and other data subject rights.

  • Types of data processed: inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contract data (e.g., subject matter of contract, duration, customer category); usage data (e.g., websites visited, interest in content, access times); meta-/communication data (e.g., device information, IP addresses).
  • Affected individuals: customers; prospects.
  • Purposes of processing: Providing contractual services and customer service.
  • Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

Providing our online offer and web hosting

To make sure our online content is safe and runs smoothly for you, we work with one or more web hosting providers. Their servers (or servers they manage) make our online offer accessible. For this purpose, we may use infrastructure and platform services, computing capacity, storage space, database services, security services, and technical maintenance.

The data processed as part of our hosting services may include all information about you as a user that arises when you use our online offer or communicate with us. This typically includes your IP address, which is needed to deliver online content to your browser, as well as any entries you make within our online offer or on websites.

  • Types of data processed: Content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • People affected: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Providing our online offering and user-friendliness; delivering contractual services and customer service.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

  • Email sending and hosting: The web hosting services we use also include sending, receiving, and storing emails. For these purposes, the addresses of recipients and senders, as well as other information regarding email delivery (e.g., the providers involved), and the contents of the respective emails are processed. The data mentioned above may also be processed for spam detection. Please note that emails on the internet are generally not sent encrypted. In most cases, emails are encrypted during transmission, but (unless a so-called end-to-end encryption method is used) they are not encrypted on the servers from which they are sent and received. We therefore cannot take responsibility for the transmission route of emails between the sender and receipt on our server.
  • Collection of access data and log files: We ourselves (or our web hosting provider) collect data about each access to the server (so-called server log files). Server log files may include the address and name of the requested web pages and files, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), and usually IP addresses and the requesting provider. Server log files can be used for security purposes, e.g., to avoid server overload (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure server utilization and stability; Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that must be retained longer for evidentiary purposes are exempt from deletion until the respective incident is finally clarified.
  • Content Delivery Network: We use a "Content Delivery Network" (CDN). A CDN is a service that helps deliver content from an online offering, especially large media files such as graphics or program scripts, faster and more securely with the help of regionally distributed servers connected via the internet.
  • WordPress.com: Hostingplattform für Blogs / Webseiten; Dienstanbieter: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA; Website: https://wordpress.com; Datenschutzerklärung: https://automattic.com/de/privacy/; Auftragsverarbeitungsvertrag: mit Anbieter abgeschlossen: https://wordpress.com/support/data-processing-agreements/.
  • STRATO: Leistungen auf dem Gebiet der Bereitstellung von informationstechnischer Infrastruktur und verbundenen Dienstleistungen (z.B. Speicherplatz und/oder Rechenkapazitäten); Dienstanbieter: STRATO AG, Pascalstraße 10,10587 Berlin, Deutschland; Website: https://www.strato.de; Datenschutzerklärung: https://www.strato.de/datenschutz; Auftragsverarbeitungsvertrag: mit Anbieter abgeschlossen.

Blogs and publishing media

We use blogs or similar tools for online communication and publication (which we’ll call a “publication medium”). We process readers’ data for the purposes of the publication medium only to the extent necessary for its display and for communication between authors and readers, or for security reasons. Otherwise, we refer you to the information on processing visitors’ data in this privacy notice.

  • Types of data processed: Inventory data (e.g. names, addresses); contact data (e.g. email, phone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta-/communication data (e.g. device information, IP addresses).
  • People affected: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Providing contractual services and customer service; feedback (e.g. collecting feedback via online form); security measures; managing and answering inquiries.
  • Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

  • Comments and Posts: When you leave comments or other posts, your IP address may be stored based on our legitimate interests. This helps protect us if someone leaves unlawful content in comments and posts (insults, prohibited political propaganda, etc.). In that case, we may be held responsible for the comment or post, so we are interested in knowing who wrote it. We also reserve the right to process your details for spam detection based on our legitimate interests. On the same legal basis, we reserve the right to store your IP address for the duration of surveys and to use cookies to prevent multiple votes. The personal information, any contact and website details, and the content you share with comments and posts are stored by us permanently until you object.

Managing contacts and inquiries

When you contact us (e.g. via contact form, email, phone, or social media), and within existing user and business relationships, we process the details you provide to the extent necessary to answer your inquiry and any actions you request.

We answer your contact inquiries and manage your contact and inquiry data as part of our contractual or pre-contractual relationships. This is done to fulfill our contractual obligations, respond to (pre-)contractual requests, and based on our legitimate interest in answering inquiries and maintaining user and business relationships.

  • Types of Data Processed: Inventory data (e.g., names, addresses); Contact details (e.g., email, phone numbers); Content data (e.g., entries in online forms).
  • Data Subjects: Communication partners.
  • Purposes of Processing: Contact inquiries and communication; Providing contractual services and customer support.
  • Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR); legal obligation (Art. 6(1)(c) GDPR).

Further Information on Processing Processes, Procedures, and Services:

  • Contact Form: When you reach out to us via our contact form, email, or other communication channels, we process the personal information you share with us to address your request. For this purpose, we process personal data within the scope of pre-contractual and contractual business relationships, where necessary for their fulfillment, and otherwise based on our legitimate interests, the interests of our communication partners in having their concerns addressed, and our statutory retention obligations.

Newsletters and electronic notifications

We send newsletters, emails, and other electronic notifications (hereinafter “Newsletters”) only with the recipient's consent or where permitted by law. If the content of a newsletter is specifically described during registration, that description governs the user's consent. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask for your name—for personalized greetings in the newsletter—or additional details if they are necessary for the purpose of the newsletter.

Double-Opt-In Procedure: Registration for our newsletter generally follows a so-called double-opt-in procedure. This means you will receive an email after signing up asking you to confirm your registration. This confirmation is necessary to ensure that no one can sign up using someone else’s email address. Newsletter registrations are logged to demonstrate that the sign-up process complies with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address. Changes to your data stored with the shipping service provider are also logged.

Deletion and Restriction of Processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to prove that consent was previously given. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for deletion is possible at any time, provided that the previous existence of consent is confirmed. In cases where there are obligations to permanently respect objections, we reserve the right to store the email address solely for this purpose in a blocklist (so-called “Blocklist”).

The logging of the registration process is based on our legitimate interests to prove its proper execution. To the extent that we commission a service provider to send emails, this is done based on our legitimate interest in an efficient and secure sending system.

Notes on Legal Bases: Newsletters are sent based on the recipients' consent or, if consent is not required, based on our legitimate interest in direct marketing, provided and to the extent that this is legally permitted, e.g., in the case of advertising to existing customers. To the extent that we commission a service provider to send emails, this is done based on our legitimate interest in efficient and secure delivery. The registration process is recorded based on our legitimate interests to prove that it was carried out in compliance with the law.

Content:

Information about us, our services, promotions, and offers.

  • Types of data processed: Inventory data (e.g., names, addresses); Contact data (e.g., email, phone numbers); Meta-/communication data (e.g., device information, IP addresses); Usage data (e.g., websites visited, interest in content, access times).
  • Data Subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g., via email or postal mail).
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).
  • Opt-out option: You can unsubscribe from our newsletter at any time, meaning you can revoke your consent or object to further receipt. You will find a link to unsubscribe either at the end of each newsletter, or you can use one of the contact methods listed above, preferably email.

Further Information on Processing Processes, Procedures, and Services:

  • Messung von Öffnungs- und Klickraten: Die Newsletter enthalten einen sogenannte „web-beacon“, d.h., eine pixelgroße Datei, die beim Öffnen des Newsletters von unserem Server, bzw., sofern wir einen Versanddienstleister einsetzen, von dessen Server abgerufen wird. Im Rahmen dieses Abrufs werden zunächst technische Informationen, wie Informationen zum Browser und Ihrem System, als auch Ihre IP-Adresse und der Zeitpunkt des Abrufs, erhoben. Diese Informationen werden zur technischen Verbesserung unseres Newsletters anhand der technischen Daten oder der Zielgruppen und ihres Leseverhaltens auf Basis ihrer Abruforte (die mit Hilfe der IP-Adresse bestimmbar sind) oder der Zugriffszeiten genutzt. Diese Analyse beinhaltet ebenfalls die Feststellung, ob die Newsletter geöffnet werden, wann sie geöffnet werden undblocked protected blocked locked blocked locked blocked locked protected protected blocked blocked locked locked blocked protected locked protected locked locked protected blocked protected protected protected protected blocked blocked locked protected blocked locked protected protected protected protected blocked locked blocked blocked locked protected locked locked locked locked locked blocked locked blocked protected blocked protected locked protected protected blocked protected protected locked locked locked protected blocked locked locked locked locked blocked blocked locked locked blocked protected protected locked blocked blocked protected locked protected blocked blocked protected protected blocked protected protected protected protected locked blocked locked protected blocked locked blocked protected blocked locked locked protected locked protected.

Web analytics, monitoring, and optimization

Web analytics (also referred to as "reach measurement") is used to evaluate visitor flows on our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can identify, for example, when our online offering or its functions or content are most frequently used or invite reuse. We can also track which areas require optimization.

In addition to web analytics, we may also use testing procedures to test and optimize, for example, different versions of our online offering or its components.

Unless stated otherwise below, profiles—i.e., data summarized into a usage process—may be created for these purposes, and information may be stored in a browser or on an end device and read from it. The data collected includes, in particular, websites visited and elements used there, as well as technical details such as the browser used, the computer system used, and usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, location data may also be processed.

We also store users' IP addresses. However, we use an IP masking method (i.e., pseudonymization by shortening the IP address) to protect our users. Generally, no clear user data (such as email addresses or names) is stored in the context of web analytics, A/B testing, and optimization; instead, we use pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is this consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to refer you to the information on cookie usage in this privacy policy.

  • Types of data processed: Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
  • People affected: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g., access statistics, detection of returning visitors); Profiles with user-related information (creation of user profiles).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

Our presence on social networks (social media)

We maintain online presences within social networks and process user data in this context to communicate with active users there or to provide information about us.

Please note that user data may be processed outside the European Union. This can pose risks for users, as it may make it more difficult to enforce their rights.

Furthermore, user data within social networks is typically processed for market research and advertising purposes. For example, usage profiles can be created based on user behavior and the resulting interests. These usage profiles can then be used to display ads within and outside of the networks that presumably match the users' interests. For these purposes, cookies are usually stored on users' devices, saving their browsing behavior and interests. Additionally, usage profiles may also store data independent of the devices used by the users (especially if they are members of the respective platforms and logged in).

For a detailed description of the respective processing methods and opt-out options, please refer to the privacy policies and information provided by the operators of the respective networks.

Regarding requests for information and the assertion of data subject rights, we would like to point out that these are most effectively addressed directly with the providers. Only the providers have access to user data and can take appropriate measures and provide information directly. If you still need assistance, feel free to contact us.

  • Types of Data Processed: Contact details (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., websites visited, interest in content, access times); Meta/Communication data (e.g., device information, IP addresses).
  • People affected: Users (e.g., website visitors, users of online services).
  • Purposes of Processing: Contact inquiries and communication; Feedback (e.g., collecting feedback via online form); Marketing.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

  • Instagram: Soziales Netzwerk; Dienstanbieter: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com; Datenschutzerklärung: https://instagram.com/about/legal/privacy.
  • Facebook-Seiten: Profile innerhalb des sozialen Netzwerks Facebook – Wir sind gemeinsam mit Meta Platforms Ireland Limited für die Erhebung (jedoch nicht die weitere Verarbeitung) von Daten der Besucher unserer Facebook-Seite (sog. „Fanpage“) verantwortlich. Zu diesen Daten gehören Informationen zu den Arten von Inhalten, die Nutzer sich ansehen oder mit denen sie interagieren, oder die von ihnen vorgenommenen Handlungen (siehe unter „Von dir und anderen getätigte und bereitgestellte Dinge“ in der Facebook-Datenrichtlinie: https://www.facebook.com/policy), sowie Informationen über die von den Nutzern genutzten Geräte (z. B. IP-Adressen, Betriebssystem, Browsertyp, Spracheinstellungen, Cookie-Daten; siehe unter „Geräteinformationen“ in der Facebook-Datenrichtlinie: https://www.facebook.com/policy). Wie in der Facebook-Datenrichtlinie unter „Wie verwenden wir diese Informationen?“ erläutert, erhebt und verwendet Facebook Informationen auch, um Analysedienste, so genannte „Seiten-Insights“, für Seitenbetreiber bereitzustellen, damit diese Erkenntnisse darüber erhalten, wie Personen mit ihren Seiten und mit den mit ihnen verbundenen Inhalten interagieren. Wir haben mit Facebook eine spezielle Vereinbarung abgeschlossen („Informationen zu Seiten-Insights“, https://www.facebook.com/legal/terms/page_controller_addendum), in der insbesondere geregelt wird, welche Sicherheitsmaßnahmen Facebook beachten muss und in der Facebook sich bereit erklärt hat die Betroffenenrechte zu erfüllen (d. h. Nutzer können z. B. Auskünfte oder Löschungsanfragen direkt an Facebook richten). Die Rechte der Nutzer (insbesondere auf Auskunft, Löschung, Widerspruch und Beschwerde bei zuständiger Aufsichtsbehörde), werden durch die Vereinbarungen mit Facebook nicht eingeschränkt. Weitere Hinweise finden sich in den „Informationen zu Seiten-Insights“ (https://www.facebook.com/legal/terms/information_about_page_insights_data); Dienstanbieter: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland; Website: https://www.facebook.com; Datenschutzerklärung: https://www.facebook.com/about/privacy; Standardvertragsklauseln (Gewährleistung Datenschutzniveau bei Verarbeitung in Drittländern): https://www.facebook.com/legal/EU_data_transfer_addendum; Weitere Informationen: Vereinbarung gemeinsamer Verantwortlichkeit: https://www.facebook.com/legal/terms/information_about_page_insights_data.
  • Twitter: Soziales Netzwerk; Dienstanbieter: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland, Mutterunternehmen: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Datenschutzerklärung: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
  • YouTube: Soziales Netzwerk und Videoplattform; Dienstanbieter: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, Mutterunternehmen: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Datenschutzerklärung: https://policies.google.com/privacy; Widerspruchsmöglichkeit (Opt-Out): https://adssettings.google.com/authenticated.

Plugins, embedded features, and content

We integrate functional and content elements into our online offerings that are sourced from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include, for example, graphics, videos, or city maps (hereinafter collectively referred to as "content").

Incorporating these services always requires that third-party providers process users' IP addresses, as they could not send content to their browsers without it. The IP address is therefore necessary for displaying this content or functionality. We strive to use only those contents whose respective providers use the IP address solely for delivering the content. Third parties may also use so-called pixel tags (invisible graphics, also known as "Web Beacons") for statistical or marketing purposes. Through "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. This pseudonymous information may also be stored in cookies on the user's device and can contain, among other things, technical information about the browser and operating system, referring websites, visit times, and further details regarding the use of our online offer, as well as be linked with such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is this consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to refer you to the information on cookie usage in this privacy policy.

  • Types of data processed: Usage data (e.g., visited websites, interest in content, access times); Meta-/communication data (e.g., device information, IP addresses); Inventory data (e.g., names, addresses); Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms); Event data (Facebook) ("Event data" are data that we can transmit to Facebook, e.g., via Facebook Pixel (via apps or other ways), and which relate to persons or their actions; Data includes, for example, information about visits to websites, interactions with content, functions, app installations, product purchases, etc.; Event data is processed for the purpose of creating target groups for content and advertising information (Custom Audiences); Event data does not include the actual content (such as written comments), login information, or contact information (i.e., no names, email addresses, or phone numbers). Event data is deleted by Facebook after a maximum of two years, along with the target groups created from them upon deletion of our Facebook account).
  • People affected: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offer and user-friendliness; Fulfillment of contractual obligations and customer service; Marketing; Profiles with user-related information (creation of user profiles).
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

  • Facebook-Plugins und -Inhalte: Facebook Social Plugins und Inhalte – Hierzu können z.B. Inhalte wie Bilder, Videos oder Texte und Schaltflächen gehören, mit denen Nutzer Inhalte dieses Onlineangebotes innerhalb von Facebook teilen können. Die Liste und das Aussehen der Facebook Social Plugins können hier eingesehen werden: https://developers.facebook.com/docs/plugins/ – Wir sind gemeinsam mitMeta Platforms Ireland Limited für die Erhebung oder den Erhalt im Rahmen einer Übermittlung (jedoch nicht die weitere Verarbeitung) von „Event-Daten“, die Facebook mittels der Facebook-Social-Plugins (und Einbettungsfunktionen für Inhalte), die auf unserem Onlineangebot ausgeführt werden, erhebt oder im Rahmen einer Übermittlung zu folgenden Zwecken erhält, gemeinsam verantwortlich: a) Anzeige von Inhalten sowie Werbeinformationen, die den mutmaßlichen Interessen der Nutzer entsprechen; b) Zustellung kommerzieller und transaktionsbezogener Nachrichten (z. B. Ansprache von Nutzern via Facebook-Messenger); c) Verbesserung der Anzeigenauslieferung und Personalisierung von Funktionen und Inhalten (z. B. Verbesserung der Erkennung, welche Inhalte oder Werbeinformationen mutmaßlich den Interessen der Nutzer entsprechen). Wir haben mit Facebook eine spezielle Vereinbarung abgeschlossen („Zusatz für Verantwortliche“, https://www.facebook.com/legal/controller_addendum), in der insbesondere geregelt wird, welche Sicherheitsmaßnahmen Facebook beachten muss (https://www.facebook.com/legal/terms/data_security_terms) und in der Facebook sich bereit erklärt hat die Betroffenenrechte zu erfüllen (d. h. Nutzer können z. B. Auskünfte oder Löschungsanfragen direkt an Facebook richten). Hinweis: Wenn Facebook uns Messwerte, Analysen und Berichte bereitstellt (die aggregiert sind, d. h. keine Angaben zu einzelnen Nutzern erhalten und für uns anonym sind), dann erfolgt diese Verarbeitung nicht im Rahmen der gemeinsamen Verantwortlichkeit, sondern auf Grundlage eines Auftragsverarbeitungsvertrages („Datenverarbeitungsbedingungen „, https://www.facebook.com/legal/terms/dataprocessing) , der „Datensicherheitsbedingungen“ (https://www.facebook.com/legal/terms/data_security_terms) sowie im Hinblick auf die Verarbeitung in den USA auf Grundlage von Standardvertragsklauseln („Facebook-EU-Datenübermittlungszusatz, https://www.facebook.com/legal/EU_data_transfer_addendum). Die Rechte der Nutzer (insbesondere auf Auskunft, Löschung, Widerspruch und Beschwerde bei zuständiger Aufsichtsbehörde), werden durch die Vereinbarungen mit Facebook nicht eingeschränkt; Dienstanbieter: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland; Website: https://www.facebook.com; Datenschutzerklärung: https://www.facebook.com/about/privacy.
  • Google Fonts: Bezug von Schriftarten („Google Fonts“) vom Anbieter Google zum Zwecke einer technisch sicheren, wartungsfreien und effizienten Nutzung von Schriftarten im Hinblick auf Aktualität und Ladezeiten, deren einheitliche Darstellung und Berücksichtigung möglicher lizenzrechtlicher Beschränkungen. Google wird die IP-Adresse des Nutzers mitgeteilt, damit Google die Schriften im Browser der Nutzer bereitstellen kann. Darüber hinaus werden technische Daten (Spracheinstellungen, Bildschirmauflösung, Betriebssystem, verwendete Hardware) übermittelt, die für die Bereitstellung der Schriftarten in Abhängigkeit von den verwendeten Geräten und der technischen Umgebung erforderlich sind. ; Dienstanbieter: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, Mutterunternehmen: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://fonts.google.com/; Datenschutzerklärung: https://policies.google.com/privacy.
  • Google Maps: Wir binden die Landkarten des Dienstes “Google Maps” des Anbieters Google ein. Zu den verarbeiteten Daten können insbesondere IP-Adressen und Standortdaten der Nutzer gehören, die jedoch nicht ohne deren Einwilligung (im Regelfall im Rahmen der Einstellungen ihrer Mobilgeräte vollzogen), erhoben werden; Dienstanbieter: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, Mutterunternehmen: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://cloud.google.com/maps-platform; Datenschutzerklärung: https://policies.google.com/privacy; Widerspruchsmöglichkeit (Opt-Out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=en, Einstellungen für die Darstellung von Werbeeinblendungen: https://adssettings.google.com/authenticated.
  • Instagram-Plugins und -Inhalte: Instagram Plugins und -Inhalte – Hierzu können z.B. Inhalte wie Bilder, Videos oder Texte und Schaltflächen gehören, mit denen Nutzer Inhalte dieses Onlineangebotes innerhalb von Instagram teilen können. – Wir sind gemeinsam mitMeta Platforms Ireland Limited für die Erhebung oder den Erhalt im Rahmen einer Übermittlung (jedoch nicht die weitere Verarbeitung) von „Event-Daten“, die Facebook mittels Funktionen von Instagram (z. B. Einbettungsfunktionen für Inhalte), die auf unserem Onlineangebot ausgeführt werden, erhebt oder im Rahmen einer Übermittlung zu folgenden Zwecken erhält, gemeinsam verantwortlich: a) Anzeige von Inhalten sowie Werbeinformationen, die den mutmaßlichen Interessen der Nutzer entsprechen; b) Zustellung kommerzieller und transaktionsbezogener Nachrichten (z. B. Ansprache von Nutzern via Facebook-Messenger); c) Verbesserung der Anzeigenauslieferung und Personalisierung von Funktionen und Inhalten (z. B. Verbesserung der Erkennung, welche Inhalte oder Werbeinformationen mutmaßlich den Interessen der Nutzer entsprechen). Wir haben mit Facebook eine spezielle Vereinbarung abgeschlossen („Zusatz für Verantwortliche“, https://www.facebook.com/legal/controller_addendum), in der insbesondere geregelt wird, welche Sicherheitsmaßnahmen Facebook beachten muss (https://www.facebook.com/legal/terms/data_security_terms) und in der Facebook sich bereit erklärt hat die Betroffenenrechte zu erfüllen (d. h. Nutzer können z. B. Auskünfte oder Löschungsanfragen direkt an Facebook richten). Hinweis: Wenn Facebook uns Messwerte, Analysen und Berichte bereitstellt (die aggregiert sind, d. h. keine Angaben zu einzelnen Nutzern erhalten und für uns anonym sind), dann erfolgt diese Verarbeitung nicht im Rahmen der gemeinsamen Verantwortlichkeit, sondern auf Grundlage eines Auftragsverarbeitungsvertrages („Datenverarbeitungsbedingungen „, https://www.facebook.com/legal/terms/dataprocessing) , der „Datensicherheitsbedingungen“ (https://www.facebook.com/legal/terms/data_security_terms) sowie im Hinblick auf die Verarbeitung in den USA auf Grundlage von Standardvertragsklauseln („Facebook-EU-Datenübermittlungszusatz, https://www.facebook.com/legal/EU_data_transfer_addendum). Die Rechte der Nutzer (insbesondere auf Auskunft, Löschung, Widerspruch und Beschwerde bei zuständiger Aufsichtsbehörde), werden durch die Vereinbarungen mit Facebook nicht eingeschränkt; Dienstanbieter: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com; Datenschutzerklärung: https://instagram.com/about/legal/privacy.
  • YouTube-Videos: Videoinhalte; Dienstanbieter: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, Mutterunternehmen: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.youtube.com; Datenschutzerklärung: https://policies.google.com/privacy; Widerspruchsmöglichkeit (Opt-Out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=en, Einstellungen für die Darstellung von Werbeeinblendungen: https://adssettings.google.com/authenticated.
  • YouTube-Videos: Videoinhalte; YouTube-Videos werden über eine spezielle Domain (erkennbar an dem Bestandteil „youtube-nocookie“) im sogenannten „Erweiterten Datenschutzmodus“ eingebunden, wodurch keine Cookies zu Nutzeraktivitäten erhoben werden, um die Videowiedergabe zu personalisieren. Dennoch können Angaben zur Interaktion der Nutzer mit dem Video (z.B. Merken der letzten Wiedergabestelle), gespeichert werden; Dienstanbieter: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, Mutterunternehmen: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.youtube.com; Datenschutzerklärung: https://policies.google.com/privacy.

Management, organization, and tools

We use services, platforms, and software from other providers (hereinafter referred to as "third-party providers") for the purpose of organizing, managing, planning, and delivering our services. When selecting third-party providers and their services, we comply with legal requirements.

In this context, personal data may be processed and stored on the servers of third-party providers. This can affect various types of data that we process in accordance with this privacy policy. These data may include, in particular, master data and contact details of users, as well as data relating to transactions, contracts, other processes, and their contents.

If users are directed to third-party providers or their software or platforms within the scope of communication, business relationships, or other interactions with us, these providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask you to review the privacy notices of the respective third-party providers.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Furthermore, their use may be part of our pre-contractual or contractual services, provided that the use of third-party providers has been agreed upon in this context. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we also refer you to the information on cookie usage in this privacy policy.

  • Types of data processed: Content data (e.g., entries in online forms); Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses); Inventory data (e.g., names, addresses); Contact data (e.g., email, phone numbers).
  • Data Subjects: Communication partners; users (e.g., website visitors, users of online services).
  • Purposes of Processing: Contact inquiries and communication.
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

Changes and updates to the privacy policy

We kindly ask you to regularly review the content of our Privacy Policy. We update this policy whenever changes in our data processing activities require it. We will inform you as soon as these changes necessitate any action on your part (such as giving consent) or require individual notification.

If we provide addresses and contact information for companies and organizations in this Privacy Policy, please note that these details may change over time. We kindly ask you to verify this information before contacting us.

Rights of data subjects

As a data subject, you have various rights under the GDPR, particularly those arising from Articles 15 to 21 GDPR:

  • Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out pursuant to Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
  • Right of access: You have the right to request confirmation as to whether your personal data is being processed, and to obtain access to that data along with other information and a copy of it, in accordance with legal requirements.
  • Right to rectification: In accordance with legal requirements, you have the right to request the completion of incomplete personal data or the correction of inaccurate personal data concerning you.
  • Right to erasure and restriction of processing: Subject to legal requirements, you have the right to request the immediate deletion of your personal data, or alternatively, to request the restriction of its processing.
  • Right to data portability: You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, or to request that this data be transmitted to another controller, in accordance with legal requirements.
  • Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR.

Definitions

This section provides an overview of the terms used in this privacy policy. Many of these terms are taken from the law and defined primarily in Article 4 of the GDPR. The legal definitions are binding. The explanations below are intended primarily to aid understanding. The terms are sorted alphabetically.

  • Personal data: “Personal data” means all information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Profiles with user-related information: The processing of “profiles with user-related information,” or simply “profiles,” includes any form of automated processing of personal data that uses this data to analyze, evaluate, or predict specific personal aspects relating to a natural person (depending on the type of profiling, this may involve various details regarding demographics, behavior, and interests, such as interactions with websites and their content). This could include predicting interests in certain content or products, click behavior on a website, or location. Cookies and web beacons are frequently used for profiling purposes.
  • Reach measurement: Reach measurement (also known as web analytics) is used to evaluate visitor flows on an online offering and can cover visitors’ behavior or interests in specific information, such as website content. Through reach analysis, website owners can, for example, identify when visitors access their site and which content they are interested in. This allows them to better tailor the website’s content to their visitors’ needs. For reach analysis, pseudonymous cookies and web beacons are often used to recognize returning visitors and obtain more precise analyses of how an online offering is used.
  • Controller: A “controller” refers to the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
  • Processing: “Processing” refers to any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, including collection, evaluation, storage, transmission, or deletion.