Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user leaves an online service and closes their device (e.g. browser or mobile application).
• Persistent cookies: Persistent cookies remain stored even after the device is closed. For example, login status can be saved or preferred content can be displayed directly when the user revisits a website. Likewise, data collected via cookies may be used for reach measurement. If we do not provide users with explicit information about the type and storage duration of cookies (e.g. as part of obtaining consent), users should assume that cookies are persistent and that the storage period may be up to two years.

General information on revocation and objection (opt-out): Users may revoke their consent at any time and may also object to processing in accordance with the statutory requirements under Art. 21 GDPR. Users may also declare their objection via their browser settings, e.g. by disabling the use of cookies (which may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes may also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Payment Methods

Within the scope of contractual and other legal relationships, due to legal obligations or based on our legitimate interests, we offer efficient and secure payment options and use additional service providers alongside banks and credit institutions (collectively referred to as “payment service providers”).

The data processed by payment service providers includes master data such as name and address, bank data such as account or credit card numbers, passwords, TANs and checksums, as well as contract, amount, and recipient-related information. This data is required to carry out transactions. However, the entered data is only processed and stored by the payment service providers. This means that we do not receive any account or credit card information, but only confirmation or rejection information regarding payments. In some cases, payment service providers may transmit data to credit agencies for identity and credit checks. Please refer to the terms and privacy policies of the respective providers.

For payment transactions, the terms and privacy policies of the respective providers apply, which are available on their websites and transaction applications. We also refer to these for further information and for asserting revocation, access, and other data subject rights.

• Types of data processed: Master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter, term, customer category); usage data (e.g. visited websites, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Customers; prospects.
• Purposes of processing: Provision of contractual services and customer support.
• Legal basis: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Additional information on processing procedures, methods, and services:

• Klarna / Sofortüberweisung: Payment services (technical integration of online payment methods); Service provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.klarna.com/de; Privacy policy: https://www.klarna.com/de/datenschutz.
• Mastercard: Payment services (technical integration of online payment methods); Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.mastercard.de/de-de.html; Privacy policy: https://www.mastercard.de/de-de/datenschutz.html.
• PayPal: Payment services (technical integration of online payment methods) (e.g. PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.paypal.com/de; Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). Readers’ data is processed for the purposes of the publication medium only insofar as it is necessary for its presentation and for communication between authors and readers, or for security reasons. Otherwise, we refer to the information on the processing of visitors to our publication medium within the scope of this privacy policy.

• Types of data processed: Master data (e.g. names, addresses); contact data (e.g. email, phone numbers); content data (e.g. entries in online forms); usage data (e.g. visited websites, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of contractual services and customer support; feedback (e.g. collecting feedback via online form); provision of our online offering and user-friendliness.
• Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Newsletters and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter “newsletter”) only with the recipients’ consent or a legal permission. If the content of the newsletter is specifically described as part of a subscription, this description is decisive for users’ consent. Otherwise, our newsletters contain information about us and our services.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal addressing in the newsletter, or additional information, if this is necessary for the purposes of the newsletter.

Double opt-in procedure: Subscription to our newsletter is generally carried out using a so-called double opt-in procedure. This means that after registering, you will receive an email in which you are asked to confirm your subscription. This confirmation is necessary to prevent anyone from registering with third-party email addresses. Newsletter registrations are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Likewise, changes to your data stored by the mailing service provider are logged.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove previously given consent. Processing of this data is restricted to the purpose of possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blacklist (so-called “blocklist”).

Logging the subscription procedure is based on our legitimate interests for the purpose of proving that it was properly carried out. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure dispatch system.

Content:

Information about us, our services, promotions, and offers.

• Types of data processed: Master data (e.g. names, addresses); contact data (e.g. email, phone numbers); meta/communication data (e.g. device information, IP addresses); usage data (e.g. visited websites, interest in content, access times).
• Data subjects: Communication partners.
• Purposes of processing: Direct marketing (e.g. by email or post).
• Legal basis: Consent (Art. 6(1)(a) GDPR).
• Right to object (opt-out): You may cancel receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. You will find a link to unsubscribe either at the end of each newsletter, or you may otherwise use one of the contact options provided above, preferably email, for this purpose.

Additional information on processing procedures, methods, and services:

• Measuring open and click rates: The newsletters contain a so-called “web beacon”, i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened, or, if we use a mailing service provider, from their server. As part of this retrieval, technical information is initially collected, such as information about the browser and your system, as well as your IP address and the time of retrieval. This information is used to technically improve our newsletter based on technical data or the target groups and their reading behavior, on the basis of their retrieval locations (which can be determined using the IP address) or the access times.
  Legal basis: Consent (Art. 6(1)(a) GDPR).

Web Analytics, Monitoring, and Optimization

Web analytics (also referred to as “reach measurement”) serves to evaluate visitor traffic to our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, determine at what times our online offering or its functions or content are most frequently used or encourage reuse. Likewise, we can identify which areas require optimization.

In addition to web analytics, we may also use testing procedures to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles may be created for these purposes, i.e., data compiled for a specific usage process, and information may be stored in a browser or on a device and read from it. The collected information includes, in particular, visited websites and elements used there, as well as technical information such as the browser used, the computer system used, and information on usage times. If users have consented to the collection of their location data to us or to the providers of the services we use, location data may also be processed.

Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e., pseudonymization by truncating the IP address) to protect users. In general, no clear data of users (such as email addresses or names) is stored within the scope of web analytics, A/B testing, and optimization, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of users, but only the information stored in their profiles for the purposes of the respective procedures.

• Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing procedures, methods, and services:

• Matomo (without cookies): Matomo is a privacy-friendly web analytics software that is used without cookies and recognizes returning users using a so-called “digital fingerprint”, which is stored anonymously and changed every 24 hours. The “digital fingerprint” records user movements within our online offering using pseudonymized IP addresses in combination with user-side browser settings in such a way that conclusions about individual users’ identities are not possible. The data collected through Matomo is processed only by us and not shared with third parties; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://matomo.org/.

Presences on Social Networks (Social Media)

We maintain online presences within social networks and process users’ data in this context in order to communicate with users active there or to provide information about us.

We point out that users’ data may be processed outside the European Union. This may result in risks for users, as, for example, the enforcement of users’ rights may be more difficult.

Furthermore, users’ data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behavior and resulting interests. These profiles may in turn be used to display advertisements within and outside the networks that presumably correspond to users’ interests. For these purposes, cookies are generally stored on users’ computers, in which users’ behavior and interests are stored. Furthermore, data may also be stored in usage profiles independently of the devices used by users (in particular if users are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and opt-out options, we refer to the privacy policies and information provided by the respective network operators.

In the case of information requests and the assertion of data subject rights, we also point out that these can be most effectively asserted with the providers. Only the providers have access to users’ data and can directly take appropriate measures and provide information. If you nevertheless need assistance, you may contact us.

• Types of data processed: Contact data (e.g. email, phone numbers); content data (e.g. entries in online forms); usage data (e.g. visited websites, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Contact inquiries and communication; feedback (e.g. collecting feedback via online form); marketing.
• Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing procedures, methods, and services:

• Instagram: Social network; Service provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
• Facebook Pages: Profiles within the Facebook social network – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not further processing) of data of visitors to our Facebook page (“fan page”). This includes information on the types of content users view or interact with, or actions they take, as well as information about devices used. Facebook also uses this information to provide “Page Insights”. We have concluded a special agreement with Facebook (“Page Insights Information”) regulating security measures and data subject rights; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy.
• Twitter: Social network; Service provider: Twitter International Company, One Cumberland Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Privacy policy: https://twitter.com/privacy.
• YouTube: Social network and video platform; Service provider: Google Ireland Limited, Dublin, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Privacy policy: https://policies.google.com/privacy.

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include graphics, videos, or maps (hereinafter uniformly referred to as “content”).

Integration always requires that third-party providers process users’ IP addresses, as they could not otherwise send the content to users’ browsers. The IP address is therefore necessary for the display of this content. We endeavor to use only content whose providers use IP addresses solely for delivering the content. Third-party providers may also use so-called pixel tags (“web beacons”) for statistical or marketing purposes.

• Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness.
• Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing procedures, methods, and services:

• Google Fonts (hosted on our own server): Fonts (“Google Fonts”) for user-friendly presentation of our online offering; Service provider: Google Fonts are hosted on our server, no data is transmitted to Google; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Amendment and Updating of the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to our data processing activities make this necessary. We will inform you if changes require your cooperation (e.g. consent) or other individual notification.

If we provide addresses and contact details of companies and organizations in this privacy policy, please note that these may change over time and we ask you to verify the information before contacting them.

Rights of Data Subjects

As data subjects, you have various rights under the GDPR, in particular arising from Articles 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time.
• Right to withdraw consent: You have the right to withdraw consent at any time.
• Right of access: You have the right to request confirmation as to whether personal data is being processed and to receive information and a copy of such data.
• Right to rectification: You have the right to request correction or completion of inaccurate data.
• Right to erasure and restriction of processing: You have the right to request deletion or restriction of processing in accordance with legal requirements.
• Right to data portability: You have the right to receive your data in a structured, commonly used, and machine-readable format or to request transfer to another controller.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority.

Definitions

This section provides an overview of the terminology used in this privacy policy. Many terms are derived from the law and are defined in Art. 4 GDPR.

• Personal data: “Personal data” means any information relating to an identified or identifiable natural person.
• Profiles with user-related information: Processing of profiles involves automated processing of personal data to analyze, evaluate, or predict personal aspects.
• Reach measurement: Reach measurement (web analytics) evaluates visitor flows and interests.
• Controller: The natural or legal person who determines purposes and means of processing.
• Processing: Any operation performed on personal data.