Privacy Policy

Introduction 

The following privacy policy is intended to inform you about the types of personal data (hereinafter also referred to as ‘data’) that we process, the purposes for which we do so, and the extent of such processing. This privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and, in particular, on our websites, in mobile applications and within external online platforms, such as our social media profiles (hereinafter collectively referred to as the “online offering”). 

The terms used are not gender-specific. 

Date: 16 December 2024 

Inhaltsübersicht

• Data Controller
• Contact details for the Data Protection Officer
• Overview of data processing
• Relevant legal bases
• Security measures
• Transfer of personal data
• Datenverarbeitung Geschäftliche Leistungen in Drittländern
• Deletion of data
• Use of cookies
• Business services
• Providers and services used in the course of business
• Provision of the online service and web hosting
• Blogs and publication media
• Chatbots and chat functions
• Contact and enquiry management
• Communication via messaging apps
• Video conferencing, web meetings, webinars and screen sharing
• Application processes
• Cloud services
• Newsletters and electronic notifications
• Surveys and questionnaires
• Web analytics, monitoring & optimisation
• Online marketing
• Präsenzen in sozialen Netzwerken (Social Media)
• Plugins, embedded functions and content
• Management, organisation and support tools
• Änderung und Aktualisierung der Datenschutzerklärung
• Rights of data subjects
• Definitions

Data controller 

PARK 7 GmbH  
Bonner Str. 207 
50968 Cologne  
Germany 

Authorised representatives: Björn Lewe, Maik Rico y Gomez.  
Email address: kontakt@park-sieben.com. 

Legal notice: https://www.park-sieben.com/impressum. 

Contact the Data Protection Officer 

datenschutz@park-sieben.com

Overview of data processing 

The following overview summarises the types of data processed and the purposes of such processing, and identifies the data subjects.  

Types of data processed 

• Basic personal details.
• Payment data.
• Location data.
• Contact data.
• Contract data.
• Usage data.
• Meta/communication data.
• Applicant data. 

Categories of data subjects 

• Customers.
• Employees.
• Prospective customers.
• Communication partners.
• Users.
• Job applicants.
• Business and contractual partners.
• Participants.
• People depicted. 

Purposes of processing 

• Provision of contractual services and customer service.
• Enquiries and communication.
• Security measures.
• Direct marketing.
• Audience measurement.
• Tracking.
• Office and organisational procedures.
• Remarketing.
• Conversion measurement.
• Management and response to enquiries.
• Recruitment procedures.
• Content Delivery Network (CDN).
• Feedback.
• Marketing.
• Profiles containing user-related information.
• Target group segmentation.
• Provision of our online services and user-friendliness.
• IT infrastructure.

Relevant legal bases 

Relevant legal bases under the GDPR: Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or where we are based. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

• Consent (Article 6(1), first sentence, point (a) of the GDPR) – The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes. 
• Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR) – The processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request. 
• Legal obligation (Article 6(1), first sentence, point (c) of the GDPR) – The processing is necessary for compliance with a legal obligation to which the controller is subject. 
• Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. 
• Recruitment process as a pre-contractual or contractual relationship (Article 9(2)(b) of the GDPR) – Insofar as, in the context of the recruitment process, special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g. health data, such as severe disability status or ethnic origin), this is done to enable the controller or the data subject to exercise their rights and fulfil their obligations arising from labour law and the law on social security and social protection; such processing is carried out in accordance with Article 9(2)(b) GDPR; in the case of the protection of the vital interests of applicants or other individuals in accordance with Article 9(2)(c) GDPR; or for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector in accordance with Article 9(2)(h) of the GDPR. Where the provision of special categories of data is based on voluntary consent, such data is processed on the basis of Article 9(2)(a) of the GDPR. 

National data protection regulations in Germany: In addition to the data protection provisions of the General Data Protection Regulation, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against the Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer of data, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for the purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, performance or termination of employment relationships, as well as the consent of employees. In addition, state data protection laws of the individual federal states may apply.

Security measures 

In accordance with statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihoods and severity of threats to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. 

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input of, disclosure of, and availability of the data, and ensuring their separation. Furthermore, we have established procedures to ensure that data subjects’ rights are upheld, that data is deleted, and that appropriate action is taken in the event of a data breach. Furthermore, we take the protection of personal data into account right from the development and selection of hardware, software and procedures, in accordance with the principle of data protection by design and through privacy-friendly default settings. 

TLS encryption (https): To protect the data you transmit via our online service, we use TLS encryption. You can recognise such encrypted connections by the prefix https:// in your browser’s address bar. 

Transfer of personal data 

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organisational units or individuals. Recipients of this data may include, for example, service providers commissioned to carry out IT tasks or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data. 

Data transfer within the organisation: We may transfer personal data to other departments within our organisation or grant them access to this data. Where such disclosure is made for administrative purposes, it is based on our legitimate business and operational interests, or takes place where it is necessary to fulfil our contractual obligations, or where the data subjects have given their consent or where there is a legal authorisation.

International data transfers 

Data processing in third countries: Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other individuals, bodies or organisations, this is done solely in accordance with the relevant legal requirements. Where the level of data protection in the third country has been recognised by means of an adequacy decision (Article 45 of the GDPR), this serves as the basis for the data transfer. Furthermore, data transfers only take place if the level of data protection is otherwise ensured, in particular through standard contractual clauses (Article 46(2)(c) of the GDPR), explicit consent, or in the case of transfers required by contract or by law (Article 49(1) of the GDPR). Furthermore, we will inform you of the legal basis for transfers to third countries in relation to the individual providers from the third country in question, whereby adequacy decisions take precedence as the legal basis. Information on transfers to third countries and existing adequacy decisions can be found on the European Commission’s website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de. 

EU-US Transatlantic Data Privacy Framework: Under the so-called ‘Data Privacy Framework’ (DPF), the European Commission has also recognised the level of data protection provided by certain US companies as adequate under the adequacy decision of 10 July 2023. You can find the list of certified organisations, as well as further information on the DPF, on the US Department of Commerce’s website at https://www.dataprivacyframework.gov/ (in English). We will inform you in our privacy policy which of the service providers we use are certified under the Data Privacy Framework. 

Deletion of data 

The data we process is deleted in accordance with statutory requirements as soon as the consent permitting its processing is withdrawn or other authorisations cease to apply (e.g. if the purpose for which the data is processed no longer applies or if the data is no longer required for that purpose). Where the data is not deleted because it is required for other, legally permissible purposes, its processing is restricted to those purposes. This means that the data will be blocked and not processed for any other purposes. This applies, for example, to data which must be retained for commercial or tax law reasons, or where storage is necessary to establish, exercise or defend legal claims, or to protect the rights of another natural or legal person. 

As part of our privacy policy, we may provide users with further information on the erasure and retention of data that applies specifically to the respective processing operations. 

Use of cookies 

This website uses cookies. We use cookies to personalise content and adverts, to provide social media features and to analyse our website traffic. We also share information about your use of our website with our social media, advertising and analytics partners, who may combine this information with other data you have provided to them or which they have collected through your use of their services. Cookies are small text files that websites may use to make the user experience more efficient. The law states that we may store cookies on your device if they are strictly necessary for the operation of this website. For all other types of cookies, we require your consent. This website uses various types of cookies. Some cookies are set by third-party services that appear on our pages. You can change or withdraw your consent at any time via the cookie policy on our website. Find out more about who we are, how to contact us and how we process personal data in our privacy policy. When contacting us regarding your consent, please state your consent ID and the date. Your consent applies to the following domains: www.park-sieben.com & www.welcome.park-sieben.com Cookie policy last updated on 12 March 2025 by Park7 GmbH.

Cookies are small text files or other storage mechanisms that store information on end devices and read information from them. For example, to store the login status in a user account, the contents of a shopping basket in an online shop, the content accessed or the functions used on a website. Cookies may also be used for various other purposes, such as to ensure the functionality, security and convenience of websites, as well as to analyse visitor traffic. 

Information on consent: We use cookies in accordance with the relevant legal provisions. We therefore obtain prior consent from users, unless this is not required by law. In particular, consent is not required if the storage and retrieval of information – including cookies – are strictly necessary to provide users with a telemedia service (i.e. our online service) that they have expressly requested. The revocable consent is clearly communicated to users and includes information on the specific use of cookies. 

Notes on the legal basis for data protection: The legal basis under data protection law on which we process users’ personal data using cookies depends on whether we ask users for their consent. If users give their consent, the legal basis for the processing of their data is the consent they have given. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online service and improving its usability) or, where this takes place in the context of fulfilling our contractual obligations, where the use of cookies is necessary to fulfil our contractual obligations. We explain the purposes for which we process cookies in this privacy policy or as part of our consent and processing procedures. 

Retention period: With regard to the retention period, a distinction is made between the following types of cookies: 

• Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest once a user has left an online service and closed their device (e.g. browser or mobile application). 
• Permanent cookies: Permanent cookies remain stored even after the device has been closed. This allows, for example, the login status to be saved or preferred content to be displayed immediately when the user visits a website again. Similarly, user data collected via cookies may be used for audience measurement. Unless we provide users with explicit information regarding the type and storage duration of cookies (e.g. when seeking consent), users should assume that cookies are permanent and may be stored for up to two years. 

General information on withdrawal of consent and objection (opt-out): Users may withdraw the consent they have given at any time and may also object to the processing in accordance with the legal provisions set out in Article 21 of the GDPR. Users may also exercise their right to object via their browser settings, for example by disabling the use of cookies (although this may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes may also be lodged via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). Consent (Article 6(1), first sentence, point (a) of the GDPR). 

Further information on processing operations, procedures and services:  

• Processing of cookie data on the basis of consent: We use a cookie consent management system, within which users’ consent to the use of cookies, or to the processing activities and providers specified within the cookie consent management system, is obtained and can be managed and withdrawn by users. In this context, the declaration of consent is stored so that the user does not have to be asked for consent again and so that consent can be demonstrated in accordance with the legal obligation. Storage may take place on the server and/or in a cookie (a so-called ‘opt-in’ cookie, or using comparable technologies) in order to be able to associate the consent with a user or their device. Subject to specific information provided by the providers of cookie management services, the following applies: Consent may be stored for up to two years. In this process, a pseudonymous user identifier is generated and stored together with the time of consent, details of the scope of consent (e.g. which categories of cookies and/or service providers) and the browser, operating system and end device used; legal basis: consent (Article 6(1), first sentence, point (a) of the GDPR). 
• Cookiebot: Cookie consent management; Service provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark; Website: https://www.cookiebot.com/de; Privacy policy: https://www.cookiebot.com/de/privacy-policy/; Data Processing Agreement: Provided by the service provider; Further information: Stored data (on the service provider’s server): The user’s IP address in anonymised form (the last three digits are set to 0), date and time of consent, browser details, the URL from which consent was sent, an anonymous, random and encrypted key value, and the user’s consent status. 

Business services 

We process data relating to our contractual and business partners, e.g. customers and prospective customers (collectively referred to as ‘contractual partners’), within the framework of contractual and comparable legal relationships, as well as associated measures and in the context of communication with contractual partners (or on a pre-contractual basis), e.g. to respond to enquiries.

We process this data to fulfil our contractual obligations. These include, in particular, the obligations to provide the agreed services, any obligations to update data, and to remedy warranty claims and other service disruptions. Furthermore, we process the data to safeguard our rights and for the purposes of administrative tasks associated with these obligations, as well as for the organisation of our business. In addition, we process the data on the basis of our legitimate interests in the proper and sound management of our business, as well as in security measures to protect our contractual partners and our business operations from misuse, risks to their data, confidential information, details and rights (e.g. involving telecommunications, transport and other ancillary services, as well as subcontractors, banks, tax and legal advisers, payment service providers or tax authorities). Within the framework of applicable law, we only disclose contractual partners’ data to third parties to the extent necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners are informed about other forms of processing, e.g. for marketing purposes, within the scope of this privacy policy.

We inform contractual partners of which data is required for the aforementioned purposes either before or during the data collection process, e.g. in online forms, by means of specific markings (e.g. colours) or symbols (e.g. asterisks or other markers), or in person. 

We delete the data once statutory warranty obligations and comparable obligations have expired, i.e. generally after 4 years, unless the data is stored in a customer account, for example, for as long as it must be retained for statutory archiving purposes. The statutory retention period is ten years for documents relevant under tax law, as well as for commercial ledgers, inventories, opening balance statements, annual accounts, the working instructions necessary for understanding these documents, and other organisational documents and accounting records; and six years for commercial and business correspondence received and copies of commercial and business correspondence sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance statement, the annual accounts or the management report was drawn up, the commercial or business letter was received or sent, or the accounting record was created; furthermore, the record was made or the other documents were created. 

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy policies of the respective third-party providers or platforms ( ) shall apply to the relationship between users and the providers. 

• Types of data processed: Basic personal details (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact details (e.g. email, telephone numbers); contractual data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status). 
• Data subjects: Prospective customers; business and contractual partners; customers. 
• Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; contact enquiries and communication; office and organisational procedures; management and response to enquiries; conversion tracking (measuring the effectiveness of marketing measures). Profiles containing user-related information (creation of user profiles). 
• Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR); legal obligation (Article 6(1), first sentence, point (c) of the GDPR); legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services:  

• Agency services: We process our clients’ data as part of our contractual services, which may include, for example, conceptual and strategic consultancy, campaign planning, software and design development, consultancy or maintenance, implementation of campaigns and processes, handling, server administration, data analysis, consultancy services and training services; Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR).
• Consulting: We process the data of our clients, customers, prospective clients and other principals or contractual partners (collectively referred to as ‘clients’) in order to be able to provide them with our consultancy services. The data processed, as well as the nature, scope, purpose and necessity of its processing, are determined by the underlying contractual and client relationship.Where necessary for the performance of our contract, to protect vital interests or as required by law, or where the clients’ consent has been obtained, we disclose or transfer clients’ data to third parties or agents, such as public authorities, subcontractors or providers of IT, office or similar services, in accordance with professional regulations; Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR).
• Project and development services: We process the data of our customers and clients (hereinafter collectively referred to as ‘customers’) in order to enable them to select, purchase or commission the chosen services or works, as well as related activities, and to facilitate their payment, provision, execution or delivery.The necessary details are identified as such in the context of the conclusion of a contract, order or similar agreement and include the information required for the provision of services and invoicing, as well as contact details to enable any necessary consultations. Where we obtain access to information relating to end customers, employees or other individuals, we process this information in accordance with statutory and contractual requirements; legal bases: performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR). 

Providers and services used in the course of our business activities 

As part of our business operations, we use additional third-party services, platforms, interfaces or plug-ins (hereinafter ‘services’) in compliance with legal requirements. Their use is based on our interests in the proper, lawful and cost-effective management of our business operations and our internal organisation. 

• Types of data processed: Basic personal details (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); contract data (e.g. subject matter of the contract, term, customer category).
• Data subjects: Customers; prospective customers; users (e.g. website visitors, users of online services); business and contractual partners; employees (e.g. staff, job applicants, former employees).
• Purposes of processing: Provision of contractual services and customer service; administrative and organisational procedures.
• Legal bases: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• DATEV: Software for bookkeeping, communication with tax advisers and public authorities, and document storage; Service provider: DATEV eG, Paumgartnerstr. 6–14, 90429 Nuremberg, Germany; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.datev.de/web/de/mydatev/; Privacy policy: https://www.datev.de/web/de/berufsgruppenuebergreifend/ueber-datev/datenschutz-und-compliance/; Data processing agreement: Provided by the service provider. 

Provision of the online service and web hosting 

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device. 

• Types of data processed: Usage data (e.g. webpages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online services and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures; Content Delivery Network (CDN).
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• HubSpot: Website and landing pages; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy. 
• Provision of our online service on rented server space: To provide our online service, we use server space, computing capacity and software which we rent or otherwise obtain from a relevant server provider (also known as a ‘web host’); legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• Collection of access data and log files: Access to our online service is logged in the form of so-called ‘server log files’. Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, confirmation of successful access, browser type and version, the user’s operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.The server log files may be used, on the one hand, for security purposes, e.g. to prevent the servers at from becoming overloaded (particularly in the event of malicious attacks, known as DDoS attacks) and, on the other hand, to ensure the servers’ capacity utilisation and stability; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Deletion of data: Log file information is stored for a maximum of 30 days and is subsequently deleted or anonymised. Data that must be retained for evidential purposes is exempt from deletion until the relevant incident has been fully resolved.
• Email transmission and hosting: The web hosting services we use also include the sending, receiving and storage of emails. For these purposes, the addresses of the recipients and senders, as well as further information relating to email transmission (e.g. the providers involved) and the contents of the respective emails, are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent in encrypted form over the internet. Whilst emails are usually encrypted whilst in transit, they are not encrypted on the servers from which they are sent and received (unless a so-called end-to-end encryption method is used). We are therefore unable to accept any responsibility for the transmission of emails between the sender and our server; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 
• Content Delivery Network: We use a ‘Content Delivery Network’ (CDN). A CDN is a service that enables the content of an online offering – in particular large media files such as graphics or scripts – to be delivered more quickly and securely via regionally distributed servers connected via the internet; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• HostEurope: Services relating to the provision of IT infrastructure and associated services (e.g. storage space and/or computing capacity); Service provider: Host Europe GmbH, Hansestrasse 111, 51149 Cologne, Germany; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.hosteurope.de; Privacy policy: https://www.hosteurope.de/AGB/Datenschutzerklaerunghttps://www.hosteurope.de/Dokumente/.
• Cloudflare: Content Delivery Network (CDN) – a service that enables the content of a website, in particular large media files such as graphics or scripts, to be delivered more quickly and securely via servers distributed regionally and connected via the internet; Service provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.cloudflare.com; Privacy policy: https://www.cloudflare.com/privacypolicy/; Data processing agreement: https://www.cloudflare.com/cloudflare-customer-dpa; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://www.cloudflare.com/cloudflare-customer-scc. 

Blogs and publication media 

We use blogs or similar means of online communication and publication (hereinafter ‘publication medium’). Readers’ data is processed for the purposes of the publication medium only to the extent necessary for its presentation and for communication between authors and readers, or for security reasons. For all other matters, please refer to the information on the processing of visitors to our publication medium set out in this privacy notice. 

• Types of data processed: Personal details (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. webpages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of contractual services and customer service; feedback (e.g. collecting feedback via online forms); provision of our online services and user-friendliness.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Chatbots and chat functions 

We offer online chats and chatbot functions as a means of communication (collectively referred to as ‘chat services’). A chat is an online conversation conducted in real time. A chatbot is a piece of software that answers users’ questions or provides them with information via messages. If you use our chat functions, we may process your personal data.

If you use our chat services within an online platform, your identification number within that platform will also be stored. We may also collect information about which users interact with our chat services and when. Furthermore, we store the content of your conversations via the chat services and log registration and consent processes so that we can provide evidence of these in accordance with legal requirements.

We would like to draw users’ attention to the fact that the relevant platform provider may be able to ascertain whether and when users communicate via our chat services, and may collect technical information about the device used by the user and, depending on the user’s device settings, location information (so-called metadata) for the purposes of optimising the relevant services and for security purposes. Furthermore, the metadata relating to communication via chat services (i.e. for example, information on who has communicated with whom) may be used by the respective platform providers, in accordance with their terms and conditions – to which we refer for further information – for marketing purposes or to display advertising tailored to users.

If users agree to receive regular messages from a chatbot, they may unsubscribe from these messages at any time. The chatbot will inform users how and using which keywords they can unsubscribe. Upon unsubscribing from chatbot messages, users’ data will be deleted from the list of message recipients.

We use the aforementioned information to operate our chat services, e.g. to address users personally, to answer their enquiries, to send any requested content, and also to improve our chat services (e.g. to ‘teach’ chatbots answers to frequently asked questions or to identify unanswered enquiries). 

Notes on legal bases: We use the chat services on the basis of consent where we have previously obtained users’ permission to process their data in connection with our chat services (this applies to cases where users are asked for consent, e.g. so that a chatbot can send them regular messages). Where we use chat services to respond to users’ enquiries about our services or our company, this is done for the purposes of contractual and pre-contractual communication. Furthermore, we use chat services on the basis of our legitimate interests in optimising the chat services, ensuring their operational efficiency and enhancing the positive user experience. 

Withdrawal, objection and erasure: You may withdraw any consent you have given at any time or object to the processing of your data in connection with our chat services. 

• Types of data processed: Contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, consent status).
• Data subjects: Communication partners.
• Purposes of processing: Contact enquiries and communication; direct marketing (e.g. by email or post).
• Legal bases: Consent (Article 6(1), first sentence, point (a) of the GDPR); performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR). Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• HubSpot: Chatbot and assistant software, as well as related services; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Data processing agreement: https://legal.hubspot.com/dpa. Basis for transfers to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.hubspot.com/dpa). 

Contact and enquiry management 

When you contact us (e.g. via the contact form, email, telephone or social media), as well as in the context of existing user and business relationships, the details provided by the enquirers are processed to the extent necessary to respond to contact enquiries and any requested actions. 

• Types of data processed: Contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Communication partners.
• Purposes of processing: Contact enquiries and communication; managing and responding to enquiries; feedback (e.g. collecting feedback via online forms); provision of our online services and user-friendliness.
• Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR). 

Further information on processing operations, procedures and services: 

• HubSpot: Customer management, process and sales support, including personalised customer service via multi-channel communication – i.e. the management of customer enquiries from various channels – as well as analytics and feedback functions; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Data processing agreement: https://legal.hubspot.com/dpa; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://legal.hubspot.com/dpa. 

Communication via messaging services 

We use messaging services for communication purposes and therefore ask you to take note of the following information regarding the functionality of these services, encryption, the use of communication metadata and your options to object.

You may also contact us via alternative channels, e.g. by telephone or email. Please use the contact details provided to you or those specified on our website.

In the case of end-to-end encryption of content (i.e. the content of your message and any attachments), we would like to point out that the communication content (i.e. the content of the message and any attached images) is encrypted from end to end. This means that the content of the messages cannot be viewed, not even by the messaging service providers themselves. You should always use an up-to-date version of the messaging app with encryption enabled to ensure that the message content is encrypted.

However, we would also like to draw our communication partners’ attention to the fact that, whilst the messaging service providers cannot view the content, they can determine whether and when communication partners are communicating with us, and that technical information about the communication partners’ devices – as well as location information (so-called metadata), depending on their device settings – is processed. 

Notes on legal bases: Where we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. Furthermore, if we do not ask for consent and you, for example, contact us of your own accord, we use messaging services in our dealings with our contractual partners and in the context of contract initiation as a contractual measure; and in the case of other prospective customers and communication partners, on the basis of our legitimate interests in swift and efficient communication and in meeting our communication partners’ needs regarding communication via messaging services. Furthermore, we would like to point out that we do not initially transmit the contact details provided to us to the messaging services without your consent. 

Withdrawal, objection and deletion: You may withdraw any consent you have given at any time and object to communication with us via Messenger at any time. In the case of communication via Messenger, we will delete the messages in accordance with our general deletion policy (i.e. e.g., as described above, upon the termination of contractual relationships, in the context of archiving requirements, etc.) and, in other cases, as soon as we can assume that we have responded to any enquiries from communication partners, provided that no reference back to a previous conversation is to be expected and there are no statutory retention obligations preventing deletion. 

Reservation regarding referral to other communication channels: Finally, we would like to point out that, for reasons of your security, we reserve the right not to respond to enquiries via Messenger. This is the case, for example, if contractual details require special confidentiality or if a response via Messenger does not meet formal requirements. In such cases, we will refer you to more appropriate communication channels.  

• Types of data processed: Contact details (e.g. email, telephone numbers); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms).
• Data subjects: Communication partners.
• Purposes of processing: Contact enquiries and communication; direct marketing (e.g. by email or post).
• Legal bases: Consent (Article 6(1), first sentence, point (a) of the GDPR); legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing procedures, processes and services: 

•  Microsoft Teams: Microsoft Teams – Messenger; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; Parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.microsoft.com/de-de/microsoft-365; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Security information: https://www.microsoft.com/de-de/trustcenter; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.  

Video conferences, online meetings, webinars and screen sharing 

We use platforms and applications provided by third parties (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as “conferences”). When selecting conference platforms and their services, we comply with the relevant legal requirements. 

Data processed by conference platforms: When participants take part in a conference, the conference platforms process the personal data of the participants listed below. The scope of the processing depends, on the one hand, on what data is required for a specific conference (e.g. login details or real names) and, on the other hand, on what optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants’ data may also be processed by the conference platforms for security purposes or to optimise the service. The data processed includes personal details (first name, surname), contact information (email address, telephone number), login details (access codes or passwords), profile pictures, details of professional position/role, the IP address of the internet connection, details of participants’ devices, their operating system, browser and its technical and language settings, information on the content of communications – i.e. chat entries as well as audio and video data – and the use of other available functions (e.g. polls). The content of communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users on the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider. 

Logging and recordings: Should text entries, participation results (e.g. from surveys) and video or audio recordings be logged, participants will be informed of this transparently in advance and, where necessary, asked for their consent. 

Participants’ data protection measures: Please refer to the conference platforms’ privacy notices for details on how your data is processed, and select the security and privacy settings that best suit your needs within the conference platforms’ settings. Please also ensure that your data and privacy are protected in the background of your recording for the duration of a video conference (e.g. by informing housemates, locking doors and, where technically possible, using the function to blur the background). Links to the conference rooms and access details must not be passed on to unauthorised third parties. 

Notes on legal bases: Where, in addition to the conference platforms, we also process users’ data and ask users for their consent to the use of the conference platforms or certain functions (e.g. consent to the recording of conferences), the legal basis for the processing is this consent. Furthermore, our processing may be necessary to fulfil our contractual obligations (e.g. in participant lists, when summarising the results of discussions, etc.). In addition, users’ data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners. 

• Types of data processed: Basic personal details (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Communication partners; users (e.g. website visitors, users of online services); persons depicted. 
• Purposes of processing: Provision of contractual services and customer service; contact enquiries and communication; office and organisational procedures.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• GoToMeeting: conference software; service provider: LogMeIn Ireland Limited, Bloodstone Building Block C 70, Sir John Rogerson’s Quay, Dublin 2, Ireland; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.goto.com/meeting; Privacy policy: https://www.goto.com/company/legal/privacy; Data processing agreement: https://www.goto.com/company/legal#OtherAgreements (Data Processing Addendum); Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://www.goto.com/company/legal#OtherAgreements (Data Processing Addendum).
• GoToWebinar: webinar software; service provider: LogMeIn Ireland Limited, Bloodstone Building Block C 70, Sir John Rogerson’s Quay, Dublin 2, Ireland; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.goto.com/meeting; Privacy policy: https://www.goto.com/company/legal/privacy; Data processing agreement: https://www.goto.com/company/legal#OtherAgreements (Data Processing Addendum); Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://www.goto.com/company/legal#OtherAgreements (Data Processing Addendum).
• Microsoft Teams: messaging and conferencing software; service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal basis: Legitimate interests (Article 6(1)(f) of the GDPR); Website: https://www.microsoft.com/de-de/microsoft-365; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Security information: https://www.microsoft.com/de-de/trustcenter; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

Application procedure 

The application process requires applicants to provide us with the data necessary for their assessment and selection. The information required is set out in the job description or, in the case of online forms, in the details provided therein.

Generally, the required details include personal information such as name, address and contact details, as well as evidence of the qualifications necessary for the post. Upon request, we are happy to provide further details on what information is required.

Where available, applicants may submit their applications to us via an online form. The data is transmitted to us in encrypted form using state-of-the-art technology. Applicants may also submit their applications to us by email. However, please note that emails are generally not sent in encrypted form over the internet. As a rule, emails are encrypted whilst in transit, but not on the servers from which they are sent and received. We cannot therefore accept any responsibility for the transmission of the application between the sender and its receipt on our server.

For the purposes of candidate sourcing, the submission of applications and the selection of candidates, we may, in accordance with legal requirements, use applicant tracking or recruitment software, as well as platforms and services provided by third parties.

Applicants are welcome to contact us regarding the method of submitting their application or to send their application to us by post. 

Processing of special categories of data: Insofar as, in the context of the application process, special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g. health data, such as severe disability status or ethnic origin), this is done so that the controller or the data subject may exercise their rights and fulfil their obligations arising from labour law and the law on social security and social protection. Such processing is carried out in accordance with Article 9(2)(b) GDPR; in the case of the protection of the vital interests of applicants or other individuals in accordance with Article 9(2)(c) GDPR; or for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, for healthcare or social care provision or treatment, or for the administration of systems and services in the healthcare or social care sector in accordance with Article 9(2)(h) of the GDPR. Where the provision of special categories of data is based on voluntary consent, such data is processed on the basis of Article 9(2)(a) of the GDPR. 

Deletion of data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a vacancy is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a valid withdrawal by the applicant, the data will be deleted no later than six months after the application is made, to enable us to answer any follow-up questions regarding the application and to fulfil our obligations to provide evidence under the regulations on equal treatment of applicants. Invoices for any travel expense reimbursements will be archived in accordance with tax law requirements. 

Inclusion in a candidate pool: Inclusion in a candidate pool, where offered, is based on consent. Candidates are informed that their consent to be included in the talent pool is voluntary, has no influence on the current application process, and that they may withdraw their consent at any time with future effect. 

• Types of data processed: Basic personal details (e.g. names, addresses); contact details (e.g. email, telephone numbers); Content data (e.g. entries in online forms); applicant data (e.g. personal details, postal and contact addresses, the documents relating to the application at and the information contained therein, such as cover letters, CVs, certificates, as well as further information regarding a specific post or information provided voluntarily by applicants about themselves or their qualifications).
• Data subjects: Applicants.
• Purposes of processing: recruitment process (establishment and any subsequent implementation, as well as possible subsequent termination of the employment relationship).
• Legal basis: The recruitment process as a pre-contractual or contractual relationship (Article 6(1)(b) of the GDPR). 

Further information on processing operations, procedures and services: 

• Services and service providers used: Catch Talents: applicant management software; service provider: Catch GmbH, Vitalisstraße 67, 50827 Cologne; website: https://catch.hr/; privacy policy: https://catch.hr/de/privacy-policy.

Cloud services 

We use software services accessible via the internet and run on their providers’ servers (so-called ‘cloud services’, also referred to as ‘Software as a Service’) for the storage and management of content (e.g. document storage and management, the exchange of documents, content and information with specific recipients, or the publication of content and information). 

In this context, personal data may be processed and stored on the providers’ servers, insofar as such data forms part of communications with us or is otherwise processed by us, as set out in this privacy policy. This data may include, in particular, users’ Basic personal details and contact details, as well as data relating to transactions, contracts, other processes and their contents. The cloud service providers also process usage data and metadata, which they use for security purposes and to optimise their services. 

Where we use cloud services to provide forms or similar documents and content for other users or on publicly accessible websites, the providers may store cookies on users’ devices for the purposes of web analytics or to remember users’ settings (e.g. in the case of media control). 

• Types of data processed: Personal details (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Customers; staff (e.g. employees, job applicants, former employees); prospective clients; communication partners; users (e.g. website visitors, users of online services).
• Purposes of processing: Office and organisational procedures; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• Google Cloud services: cloud infrastructure services and cloud-based application software; service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://cloud.google.com/; Privacy policy: https://policies.google.com/privacy; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://cloud.google.com/terms/eu-model-contract-clause; Further information: https://cloud.google.com/privacy.
• Google Workspace: Cloud-based application software (e.g. word processing and spreadsheets, calendar and contact management), cloud storage and cloud infrastructure services; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://workspace.google.com/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://cloud.google.com/terms/data-processing-addendum; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://cloud.google.com/terms/eu-model-contract-clause; Further information: https://cloud.google.com/privacy.
• Microsoft cloud services: cloud storage, cloud infrastructure services and cloud-based application software; service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; legal basis: Legitimate interests (Article 6(1)(f) of the GDPR); Website: https://microsoft.com/de-de; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Security information: https://www.microsoft.com/de-de/trustcenter; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

Newsletters and electronic notifications 

We send out newsletters, emails and other electronic notifications (hereinafter “newsletters”) only with the consent of the recipients or where permitted by law. Where the content of a newsletter is specifically described as part of the subscription process, this content is decisive for the user’s consent. In addition, our newsletters contain information about our services and our organisation. 

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name, so that we can address you personally in the newsletter, or further details, provided these are necessary for the purposes of the newsletter. 

Double opt-in procedure: Subscription to our newsletter generally takes place via a so-called double opt-in procedure. This means that, after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can subscribe using someone else’s email address. Subscriptions to the newsletter are logged so that we can provide evidence of the subscription process in accordance with legal requirements. This includes storing the time of subscription and confirmation, as well as the IP address. Any changes to your data stored with the email service provider are also logged. 

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to provide evidence of consent previously given. The processing of this data is restricted to the purpose of potentially defending against claims. An individual request for erasure may be made at any time, provided that the prior existence of consent is confirmed at the same time. In the event of obligations to permanently comply with objections, we reserve the right to store the email address solely for this purpose in a block list. 

The logging of the registration process is carried out on the basis of our legitimate interests for the purpose of verifying that it has been carried out correctly. Where we use a third-party service to send emails, this is done on the basis of our legitimate interests in an efficient and secure delivery system. 

Content:
Information about us, our services, promotions and offers. 

• Types of data processed: Basic personal details (e.g. names, addresses); contact details (e.g. email, telephone numbers); meta/communication data (e.g. device information, IP addresses); usage data (e.g. websites visited, interest in content, access times).
• Data subjects: Communication partners; users (e.g. website visitors, users of online services).
• Purposes of processing: Direct marketing (e.g. by email or post); provision of contractual services and customer service.
• Legal bases: Consent (Article 6(1), first sentence, point (a) of the GDPR); legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• Right to object (opt-out): You may unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to receiving further issues. You will find a link to unsubscribe from the newsletter either at the end of each newsletter or you may use one of the contact options listed above, preferably by email. 

Further information on processing operations, procedures and services: 

• Measuring open and click-through rates: The newsletters contain a so-called ‘web beacon’, i.e. a pixel-sized file that is retrieved from our server – or, if we use a mailing service provider, from their server – when the newsletter is opened. As part of this retrieval, technical information – such as details about your browser and system – as well as your IP address and the time of retrieval are initially collected. This information is used to improve our newsletter technically, based on the technical data or the target groups and their reading behaviour, determined by their location (which can be identified using the IP address) or the times of access. This analysis also involves determining whether the newsletters are opened, when they are opened and which links are clicked. This information is assigned to individual newsletter recipients and stored in their profiles until it is deleted. We use these analyses to identify our users’ reading habits and to tailor our content to them, or to send different content according to our users’ interests. The measurement of open rates and click-through rates, as well as the storage of the measurement results in users’ profiles and their further processing, are carried out on the basis of the users’ consent. Unfortunately, it is not possible to withdraw consent for performance measurement separately; in this case, the entire newsletter subscription to must be cancelled or objected to. In this case, the stored profile information will be deleted; legal basis: consent (Article 6(1), first sentence, point (a) of the GDPR).
• Condition for using free services: Consent to receive mailings may be made a condition for using free services (e.g. access to certain content or participation in certain promotions). If users wish to use the free service without subscribing to the newsletter, please contact us. 
• HubSpot: email marketing platform; service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; legal basis: legitimate interests (Article 6(1)(f) of the GDPR); website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Data processing agreement: https://legal.hubspot.com/dpa; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://legal.hubspot.com/dpa.
• Zapier: Import of email addresses to the mailing service providers used from other platforms or other sources; Service provider: Zapier, Inc., 548 Market St #62411, San Francisco, California 94104, USA; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://zapier.com; Privacy policy: https://zapier.com/privacy; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://zapier.com/tos (part of the Terms and Conditions).

Surveys and questionnaires 

Using ‘easyfeedback’, we offer online surveys in which participants receive a self-assessment by answering questions, with the aim of identifying areas for improvement. In addition, participants are provided with further, tailored information based on the results. In doing so, the personal data and other information provided are processed. Participation in the self-assessment is voluntary; if data subjects do not provide personal data, this has no further consequences apart from the fact that the ‘self-assessment’ cannot be carried out. 

• Categories of data processed: contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Participants.
• Purposes of processing: Analysis and provision of results relating to self-assessment and, based on this, further information
• Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR). 

Further information on processing procedures, methods and services: 

• Easyfeedback: Survey tool for collecting and analysing survey data.  
• Service provider: easyfeedback GmbH, Ernst-Abbe-Straße 4, 56070 Koblenz, Germany; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• Website: https://easy-feedback.de;
• Privacy policy: https://easy-feedback.de/privacy/datenschutz/

Web analytics, monitoring and optimisation 

Web analytics (also referred to as ‘reach measurement’) is used to analyse visitor traffic to our online service and may include pseudonymised data on visitors’ behaviour, interests or demographic information, such as age or gender. With the help of reach analysis, we can, for example, identify at what times our online service, its functions or content are used most frequently, or encourage repeat visits. We can also identify which areas require optimisation. 

In addition to web analytics, we may also use testing procedures to, for example, test and optimise different versions of our online service or its components. 

Unless otherwise stated below, profiles – i.e. data aggregated to represent a usage session – may be created for these purposes, and information may be stored in a browser or on a device and retrieved from it. The data collected includes, in particular, the web pages visited and the elements used on them, as well as technical details such as the browser and computer system used, and information on usage times. Where users have given their consent to the collection of their location data, either to us or to the providers of the services we use, location data may also be processed. 

Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. Generally, no personally identifiable data (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective processes. 

• Types of data processed: usage data (e.g. web pages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: remarketing; target group identification (identifying target groups relevant for marketing purposes or other content delivery); Audience measurement (e.g. traffic statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles); tracking (e.g. interest-based or behavioural profiling, use of cookies); provision of our online services and user-friendliness.
• Security measures: IP masking (pseudonymisation of the IP address).
• Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR). 

Further information on processing operations, procedures and services: 

• Google Analytics: web analytics, audience measurement and measurement of user flows; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal basis: consent (Article 6(1)(a) of the GDPR); website: https://marketingplatform.google.com/intl/de/about/analytics/; privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://business.safety.google/adsprocessorterms; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de; Settings for the display of adverts: https://adssettings.google.com/authenticated; Further information: https://business.safety.google/adsservices/ (types of processing and the data processed).
• Google Universal Analytics: Audience measurement and web analytics – We use Universal Analytics, a version of Google Analytics, to carry out user analysis based on a pseudonymous user identification number. This identification number does not contain any plaintext data, such as names or email addresses. It serves to associate analytics information with a user, e.g. to identify which content users have accessed during a session or whether they revisit our online service. In doing so, pseudonymous user profiles are created using information from the use of various devices; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com; Terms and Conditions: https://business.safety.google/adsprocessorterms/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms; Standard Contractual Clauses (ensuring an adequate level of data protection when processing in third countries): https://business.safety.google/adsprocessorterms; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of adverts: https://adssettings.google.com/authenticated; Further information: https://business.safety.google/adsservices/ (types of processing and the data processed).
• Google Analytics 4: We use Google Analytics to carry out user analysis based on a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to associate analytical information with a device in order to identify which content users have accessed during one or more sessions, which search terms they have used, whether they have revisited the site, or how they have interacted with our online service. The time of use and its duration are also stored, as well as the sources from which users access our online service and technical details of their devices and browsers. In doing so, pseudonymous user profiles are created using information from the use of various devices, for which cookies may be employed. In Analytics, data on geographical location is provided at a higher level by collecting the following metadata via IP lookup: ‘City’ (and the derived latitude and longitude of the city), ‘Continent’, ‘Country’, ‘Region’, ‘Subcontinent’ (and the ID-based equivalents). To ensure the protection of user data within the EU, Google receives and processes all user data via domains and servers located within the EU. Users’ IP addresses are not logged and are truncated by the last two digits by default. The truncation of IP addresses takes place on EU servers for EU users. Furthermore, all sensitive data collected from users in the EU is deleted before it is recorded via EU domains and servers; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://business.safety.google/adsprocessorterms; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of adverts: https://adssettings.google.com/authenticated; Further information: https://business.safety.google/adsservices/ (types of processing and the data processed).
• Target audience segmentation with Google Analytics: We use Google Analytics to ensure that adverts placed within Google’s advertising services and those of its partners are shown only to users who have demonstrated an interest in our online offering or who exhibit certain characteristics (e.g. interests in specific topics or products, determined on the basis of the websites visited), which we transmit to Google (so-called “Remarketing” or “Google Analytics Audiences”). We also use Remarketing Audiences to ensure that our adverts match users’ potential interests; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal basis: consent (Article 6(1)(a) of the GDPR); Website: https://marketingplatform.google.com; Legal basis: https://business.safety.google/adsprocessorterms/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Further information: Types of processing and data processed: https://business.safety.google/adsservices/; Data processing terms for Google advertising products and standard contractual clauses for data transfers to third countries: https://business.safety.google/adsprocessorterms.
• Google Tag Manager: Google Tag Manager is a solution that enables us to manage so-called website tags via a user interface and thus integrate other services into our online offering (please refer to further details in this privacy policy). The Tag Manager itself (which implements the tags) therefore does not, for example, create user profiles or store cookies. Google merely receives the user’s IP address, which is necessary to run Google Tag Manager; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal basis: consent (Article 6(1)(a) of the GDPR); website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://business.safety.google/adsprocessorterms; Further information: https://business.safety.google/adsservices/ (types of processing and the data processed).
• SalesViewer: On this website, data is collected and stored using SalesViewer® technology from SalesViewer® GmbH on the basis of the website operator’s legitimate interests (Article 6(1)(f) of the GDPR) for marketing, market research and optimisation purposes. A JavaScript-based code is used for this purpose, which serves to collect company-related data and utilise it accordingly. The data collected using this technology is encrypted using a one-way function that cannot be reversed (known as hashing). The data is pseudonymised immediately and is not used to personally identify visitors to this website. The data stored via SalesViewer® is deleted as soon as it is no longer required for its intended purpose and provided that no statutory retention obligations prevent its deletion. You may object to the collection and storage of data at any time with future effect by clicking on this link https://www.salesviewer.com/opt-out to prevent SalesViewer® from collecting data on this website in future. An opt-out cookie for this website will then be stored on your device. If you delete your cookies in this browser, you will need to click this link again.
• Leadinfo: We use the lead generation service provided by Leadinfo B.V., Rotterdam, Netherlands. This service identifies visits to our website by businesses based on IP addresses and displays publicly available information to us, such as company names or addresses. In addition, Leadinfo sets two first-party cookies to analyse user behaviour on our website and processes domains from form submissions (e.g. leadinfo.com) in order to correlate IP addresses with companies and improve its services. Further information can be found at https://www.leadinfo.com. On this page: https://www.leadinfo.com/en/opt-out, you have the option to opt out. If you opt out, your data will no longer be collected by Leadinfo.

Online marketing 

We process personal data for the purposes of online marketing, which may include, in particular, the marketing of advertising space or the display of advertising and other content (collectively referred to as ‘content’) based on users’ potential interests, as well as the measurement of its effectiveness. 

For these purposes, so-called user profiles are created and stored in a file (known as a ‘cookie’) or similar methods are used, by means of which information about the user relevant to the display of the aforementioned content on is stored. This information may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical details such as the browser and computer system used, and information on usage times and functions utilised. Where users have consented to the collection of their location data, this may also be processed. 

Users’ IP addresses are also stored. However, we use available IP masking methods (i.e. pseudonymisation by truncating the IP address) to protect users. Generally, no users’ personally identifiable data (such as email addresses or names) is stored as part of online marketing procedures; instead, pseudonyms are used. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, but only the information stored in their profiles. 

The information in the profiles is usually stored in cookies or by means of similar methods. These cookies can generally be read later on other websites that use the same online marketing process; they can be analysed for the purpose of displaying content, supplemented with further data, and stored on the server of the online marketing service provider. 

In exceptional cases, personal data may be linked to the profiles. This is the case, for example, when users are members of a social network whose online marketing methods we use and the network links users’ profiles to the aforementioned information. Please note that users may enter into additional agreements with the providers, for example by giving their consent during registration. 

In principle, we only have access to aggregated information regarding the success of our advertisements. However, as part of so-called conversion tracking, we may analyse which of our online marketing methods have led to a so-called conversion, i.e. for example, the conclusion of a contract with us. Conversion tracking is used solely to analyse the success of our marketing measures. 

Unless otherwise stated, please assume that any cookies used will be stored for a period of two years. 

• Types of data processed: usage data (e.g. webpages visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, consent status).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Audience measurement (e.g. traffic statistics, identification of returning visitors); tracking (e.g. interest-based/behavioural profiling, use of cookies); marketing; profiles containing user-related information (creation of user profiles); conversion measurement (measuring the effectiveness of marketing measures); target group identification. Provision of our online service and user-friendliness.
• Security measures: IP masking (pseudonymisation of the IP address).
• Legal bases: Consent (Article 6(1), first sentence, point (a) of the GDPR). Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• Right to object (opt-out): We refer you to the privacy policies of the respective providers and the opt-out options specified by them. If no explicit opt-out option has been provided, you have the option of disabling cookies in your browser settings. However, this may restrict certain functions of our online services. We therefore also recommend the following opt-out options, which are summarised and tailored to the respective regions: a) Europe: https://www.youronlinechoices.eu.
  b) Canada: https://www.youradchoices.ca/choices.
  c) USA: https://optout.aboutads.info/.
  d) Across all regions: https://optout.aboutads.info.

Further information on processing procedures, methods and services: 

• Google Ads and conversion tracking: We use the online marketing service ‘Google Ads’ to place adverts on the Google advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who are likely to be interested in the adverts (known as ‘conversion’). We also measure the conversion rate of the adverts. However, we only receive the anonymous total number of users who have clicked on our advert and been redirected to a page tagged with a so-called ‘conversion tracking tag’. We ourselves, however, do not receive any information that can be used to identify users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Further information: Types of processing and data processed: https://business.safety.google/adsservices/; Data processing terms between data controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms.
• LinkedIn: Insights Tag / Conversion Tracking; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy, Cookie Policy: https://www.linkedin.com/legal/cookie_policy; Standard Contractual Clauses (ensuring an adequate level of data protection for processing in third countries): https://legal.linkedin.com/dpa; Right to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Google Tag Manager: Google Tag Manager is a solution that enables us to manage so-called website tags via a user interface and thus integrate other services into our online offering (please refer to further details in this privacy policy). The Tag Manager itself (which implements the tags) therefore does not, for example, create user profiles or store cookies. Google merely receives the user’s IP address, which is necessary to run Google Tag Manager; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal basis: consent (Article 6(1)(a) of the GDPR); website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://business.safety.google/adsprocessorterms; Further information: https://business.safety.google/adsservices/ (types of processing and the data processed).
• Google Analytics: Audience measurement and web analytics; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Article 6(1)(a) of the GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://business.safety.google/adsprocessorterms; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of adverts: https://adssettings.google.com/authenticated; Further information: https://business.safety.google/adsservices/ (types of processing and the data processed).
• HubSpot: Marketing software for lead generation, marketing automation and analytics; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Data processing agreement: https://legal.hubspot.com/dpa; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://legal.hubspot.com/dpa.
• Twitter advertisements: Placement of advertisements within the Twitter platform and analysis of advertising results; service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; parent company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Legal basis: Consent (Article 6(1)(a) of the GDPR); Website: https://business.x.com/de/advertising; Privacy policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
• Microsoft Advertising: Online marketing methods for the purpose of placing content and adverts within the service provider’s advertising network (e.g. in search results, in videos, on websites, etc.), so that they are displayed to users who are presumed to have an interest in the adverts. In addition, we measure the conversion rate of the adverts, i.e. whether users have been prompted to interact with the adverts and make use of the advertised offers (so-called ‘conversion’). However, we only receive anonymous information and no personal information about individual users; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Consent (Article 6(1)(a) of the GDPR), Legitimate interests (Article 6(1)(f) of the GDPR); Website: https://about.ads.microsoft.com/en-us; Privacy Policy: https://www.microsoft.com/de-de/privacy/privacystatement; Basis for transfers to third countries: EU-US Data Privacy Framework (DPF); Right to object (opt-out): https://account.microsoft.com/privacy/ad-settings/signedout. Further information: https://help.ads.microsoft.com/#apex/ads/en/60226/0.

Social media presence 

We maintain an online presence on social media platforms and, in this context, process users’ data in order to communicate with users active on these platforms or to provide information about us.

Please note that this may involve the processing of users’ data outside the European Union. This may entail risks for users, as it could, for example, make it more difficult to enforce their rights.

Furthermore, users’ data within social media platforms is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behaviour and the resulting interests. These usage profiles may in turn be used, for example, to display advertisements within and outside the platforms that are presumed to correspond to users’ interests. For these purposes, cookies are usually stored on users’ computers, in which users’ usage behaviour and interests are recorded. Furthermore, data may also be stored in the user profiles regardless of the devices used by the users (in particular if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the options for objecting (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

We would also like to point out that, in the case of requests for information and the exercise of data subjects’ rights, these can most effectively be exercised with the providers themselves. Only the providers have access to users’ data and can take appropriate measures and provide information directly. Should you nevertheless require assistance, please do not hesitate to contact us

• Types of data processed: Contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Contact enquiries and communication; feedback (e.g. collecting feedback via online forms); marketing.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
• Facebook Pages: Profiles within the Facebook social network – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data relating to visitors to our Facebook page (known as a ‘fan page’). This data includes information on the types of content that users view or interact with, or the actions they take (see ‘Things you and others do and share’ in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see ‘Device Information’ in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under ‘How do we use this information?’, Facebook also collects and uses information to provide analytics services, known as ‘Page Insights’, to page administrators, so that they can gain insights into how people interact with their pages and the content associated with them. We have entered into a specific agreement with Facebook (“Information on Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which sets out in particular the security measures Facebook must observe and in which Facebook has agreed to fulfil data subjects’ rights (i.e. users may, for example, submit requests for information or erasure directly to Facebook). Users’ rights (in particular the rights to access, erasure, objection and to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information on Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: Joint controller agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. Joint controllership is limited to the collection of and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company, Meta Platforms, Inc., in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
• LinkedIn: social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://legal.linkedin.com/dpa; Standard Contractual Clauses (ensuring an adequate level of data protection when processing in third countries): https://legal.linkedin.com/dpa; Right to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• YouTube: social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): https://adssettings.google.com/authenticated.
• Xing: Social network; Service provider: XING AG, Dammtorstraße 29–32, 20354 Hamburg, Germany; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.xing.de; Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plugins, embedded functions and content 

We incorporate functional and content elements into our online offering which are sourced from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or city maps (hereinafter collectively referred to as “content”).

This integration always requires the third-party providers of this content to process the user’s IP address, as they would be unable to send the content to the user’s browser without it. The IP address is therefore necessary for the display of this content or these functions. We endeavour to use only such content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as ‘web beacons’) for statistical or marketing purposes. These ‘pixel tags’ enable information, such as visitor traffic on the pages of this website, to be analysed. This pseudonymous information may also be stored in cookies on the user’s device and may include, amongst other things, technical information about the browser and operating system, referring websites, the time of visit and further details regarding the use of our online service, as well as being linked to such information from other sources.

• Types of data processed: usage data (e.g. webpages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); Basic personal details (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); location data (details of the geographical position of a device or a person).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online services and user-friendliness; provision of contractual services and customer service.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• Integration of third-party software, scripts or frameworks (e.g. jQuery): We integrate software into our online offering that we retrieve from servers operated by other providers (e.g. function libraries that we use to display our online offering or to enhance its user-friendliness). In doing so, the respective providers collect users’ IP addresses and may process them for the purposes of transmitting the software to users’ browsers, for security purposes, and for the evaluation and optimisation of their services. - We integrate software into our online service that we retrieve from servers operated by other providers (e.g. function libraries that we use to enhance the presentation or user-friendliness of our online service). In doing so, the respective providers collect users’ IP addresses and may process them for the purposes of transmitting the software to users’ browsers, for security purposes, and for the evaluation and optimisation of their services; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• Google Fonts (retrieved from the Google server): Retrieval of fonts (and icons) for the purpose of ensuring the technically secure, maintenance-free and efficient use of fonts and icons, taking into account their up-to-date status and loading times, their consistent display and compliance with any licence restrictions. The font provider is provided with the user’s IP address so that the fonts can be made available in the user’s browser . In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for the provision of the fonts depending on the devices used and the technical environment; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy.
• Google Maps: We embed maps from the “Google Maps” service provided by Google. The data processed may include, in particular, users’ IP addresses and location data; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) of the GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy.
• Google Maps APIs and SDKs: Interfaces to Google’s map and location services, which, for example, enable the completion of address entries, location determination, distance calculations or the provision of supplementary information on locations and other places; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) of the GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy.
• reCAPTCHA: We integrate the ‘reCAPTCHA’ function to determine whether entries (e.g. in online forms) are made by humans and not by automated machines (so-called ‘bots’). The data processed may include IP addresses, information on operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, time spent on web pages, previously visited web pages, interactions with reCAPTCHA on other websites, cookies in some cases, and the results of manual verification processes (e.g. answering questions or selecting objects in images). Data processing is carried out on the basis of our legitimate interest in protecting our online service from abusive automated crawling and spam; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) of the GDPR); Website: https://www.google.com/recaptcha/; Privacy policy: https://policies.google.com/privacy; Option to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of adverts: https://adssettings.google.com/authenticated.
• YouTube videos: video content; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Option to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of adverts: https://adssettings.google.com/authenticated.
• YouTube videos: Video content; YouTube videos are embedded via a special domain (identifiable by the component ‘youtube-nocookie’) in what is known as ‘enhanced privacy mode’, which means that no cookies relating to user activity are collected for the purpose of personalising video playback. However, information regarding users’ interaction with the video (e.g. remembering the last playback position) may be stored; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal basis: legitimate interests (Art. 6(1)(f) GDPR); website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy.
• Font Awesome (retrieved from the provider’s server): Retrieval of fonts (and icons) for the purpose of ensuring the technically secure, maintenance-free and efficient use of fonts and icons in terms of up-to-date content and loading times, their consistent display and compliance with any licence restrictions. The provider of the fonts is notified of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for the provision of the fonts depending on the devices used and the technical environment; Service provider: Fonticons, Inc., 6 Porter Road, Apartment 3R, Cambridge, MA 02140, USA; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://fontawesome.com/; Privacy policy: https://fontawesome.com/privacy.

Management, organisation and support tools 

We use services, platforms and software from other providers (hereinafter referred to as “third-party providers”) for the purposes of organising, managing, planning and delivering our services. When selecting third-party providers and their services, we comply with the relevant legal requirements.

In this context, personal data may be processed and stored on the third-party providers’ servers. This may involve various types of data which we process in accordance with this privacy policy. Such data may include, in particular, users’ Basic personal details and contact details, as well as data relating to transactions, contracts, other processes and their contents.

Where users are directed to third-party providers or their software or platforms in the course of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, to optimise their services or for marketing purposes. We therefore ask you to observe the privacy policies of the respective third-party providers. 

• Types of data processed: Content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); Basic personal details (e.g. names, addresses); contact details (e.g. email, telephone numbers).
• Data subjects: Communication partners; users (e.g. website visitors, users of online services); employees (e.g. staff, job applicants, former employees); business and contractual partners.
• Purposes of processing: Contact enquiries and communication; provision of contractual services and customer service; office and organisational procedures; audience measurement (e.g. access statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles); feedback (e.g. collection of feedback via online forms).
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). 

Further information on processing operations, procedures and services: 

• Confluence: software for creating and managing wiki and knowledge platforms; service provider: Atlassian Inc. (San Francisco, Harrison Street office), 1098 Harrison Street, San Francisco, California 94103, USA; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.atlassian.com/software/confluence; Privacy policy: https://www.atlassian.com/legal/privacy-policy; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): Included in the data processing agreement; Further information: Data transfer impact assessment: https://www.atlassian.com/legal/data-transfer-impact-assessment.
• HubSpot: Social media publishing, reporting (e.g. traffic sources, visitor numbers, web analytics), contact management (e.g. contact forms, direct communication and user segmentation), landing pages; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Data processing agreement: https://legal.hubspot.com/dpa; Standard contractual clauses (ensuring an adequate level of data protection for processing in third countries): https://legal.hubspot.com/dpa.
• Jira: web application for bug tracking, issue resolution and operational project management; service provider: Atlassian Inc. (San Francisco, Harrison Street Location), 1098 Harrison Street, San Francisco, California 94103, USA; legal basis: legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.atlassian.com/software/jira; Privacy policy: https://www.atlassian.com/legal/privacy-policy; Data processing agreement: https://www.atlassian.com/legal/data-processing-addendum; Standard contractual clauses (ensuring an adequate level of data protection when processing in third countries): Included in the data processing agreement; Further information: Data transfer impact assessment: https://www.atlassian.com/legal/data-transfer-impact-assessment.
• Mentimeter: Creation of presentations and meetings with real-time feedback; Service provider: Mentimeter AB, Alströmergatan 22 SE-112 47 Stockholm, Sweden; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.mentimeter.com; Privacy policy: https://www.mentimeter.com/policies.
• Miro: Online whiteboard and collaboration platform; Service provider: Realtimeboard Inc. trading as Miro, 201 Spear Street, Suite 1100, San Francisco, California 94105, USA; Legal basis: Legitimate interests (Article 6(1)(f) of the GDPR); Website: https://miro.com/; Privacy policy: https://miro.com/legal/privacy-policy/.
• WeTransfer: Transfer of files via the internet; Service provider: WeTransfer BV, Oostelijke Handelskade 751, Amsterdam, 1019 BW, Netherlands; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://wetransfer.com; Privacy policy: https://wetransfer.com/legal/privacy.

Amendments and updates to the privacy policy 

We ask that you regularly review the content of our privacy policy. We will amend the privacy policy as soon as changes to the data processing activities we carry out make this necessary. We will inform you as soon as the changes require action on your part (e.g. consent) or any other individual notification.

Where we provide addresses and contact details of companies and organisations in this Privacy Policy, please note that these details may change over time; we therefore ask you to check the details before making contact. 

Rights of data subjects 

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR: 

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to obtain access to this data, as well as further information and a copy of the data in accordance with the statutory requirements.
• Right to rectification: In accordance with the statutory provisions, you have the right to request that data relating to you be completed or that any inaccurate data relating to you be rectified.
• Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to request that data relating to you be erased without delay or, alternatively, in accordance with the statutory provisions, to request a restriction on the processing of the data.
• Right to data portability: You have the right, in accordance with the statutory provisions, to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transferred to another data controller. 
• Complaints to a supervisory authority: In accordance with the statutory provisions and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority , in particular a supervisory authority in the Member State in which you habitually reside, the supervisory authority for your place of work or the location of the alleged infringement, should you consider that the processing of your personal data infringes the GDPR. 

Definitions 

This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined, in particular, in Article 4 of the GDPR. The legal definitions are binding. The explanations below, however, are primarily intended to aid understanding. The terms are listed in alphabetical order. 

• Content Delivery Network (CDN): A ‘Content Delivery Network’ (CDN) is a service that enables the content of an online offering – in particular large media files such as graphics or scripts – to be delivered more quickly and securely via servers distributed regionally and connected via the internet.
• Conversion tracking: Conversion tracking (also known as is a method used to determine the effectiveness of marketing measures. To do this, a cookie is usually stored on users’ devices whilst they are on the websites where the marketing measures are taking place, and is then retrieved again on the target website. For example, this enables us to track whether the adverts we have placed on other websites have been successful.
• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Profiles containing user-related information: The processing of ‘profiles containing user-related information’, or ‘profiles’ for short, encompasses any form of automated processing of personal data which consists of using such personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the nature of the profiling, this may include various information concerning demographics, behaviour and interests, such as interaction with the website and its content, etc.) to analyse, evaluate or predict them (e.g. interests in specific content or products, clicking behaviour on a website or location). Cookies and web beacons are frequently used for profiling purposes.
• Audience measurement: Audience measurement (also known as web analytics) is used to analyse visitor traffic to an online service and may include the behaviour or interests of visitors in relation to specific information, such as website content. With the help of reach analysis, website owners can, for example, identify at what times visitors access their website and what content they are interested in. This enables them, for instance, to better tailor the website’s content to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are frequently used to recognise returning visitors and thus obtain more accurate analyses of the use of an online service.
• Remarketing: The terms ‘remarketing’ or ‘retargeting’ are used when, for example, a record is kept – for advertising purposes – of which products a user has shown an interest in on a website, in order to remind the user of these products on other websites, for example in advertisements.
• Location data: Location data is generated when a mobile device (or another device with the technical capabilities for location tracking) connects to a mobile network cell, a Wi-Fi network or similar technical means and location-tracking functions. Location data is used to indicate the geographically identifiable position on Earth at which the respective device is located. Location data can, for example, be used to display map functions or other location-dependent information.
• Tracking: The term ‘tracking’ refers to the ability to monitor users’ behaviour across multiple online services. As a rule, information relating to behaviour and interests in relation to the online services used is stored in cookies or on the servers of the providers of tracking technologies (so-called ‘profiling’). This information can subsequently be used, for example, to display advertisements to users that are likely to match their interests.
• Data controller: The term ‘data controller’ refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: ‘Processing’ means any operation or set of operations which is carried out on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collection, analysis, storage, transmission or erasure.
• Target audience profiling: The term ‘target audience profiling’ (or ‘Custom Audiences’) is used when target audiences are identified for advertising purposes, e.g. the display of advertisements. For example, based on a user’s interest in certain products or topics on the internet, it can be inferred that this user is interested in adverts for similar products or the online shop where they viewed the products. The term ‘Lookalike Audiences’ (or similar target groups) is used, on the other hand, when content deemed suitable is displayed to users whose profiles or interests are presumed to correspond to those of the users on whose profiles the Lookalike Audiences were based. Cookies and web beacons are generally used for the purpose of creating Custom Audiences and Lookalike Audiences.