Contact and Inquiry Management

When contacting us (e.g., by post, contact form, email, telephone, or via social media) and within the context of existing user and business relationships, the information of the inquiring individuals is processed to the extent necessary to respond to contact inquiries and any requested measures.

Processed Data Types:

• Contact data (e.g., email, telephone numbers)
• Content data (e.g., entries in online forms)
• Usage data (e.g., visited websites, interest in content, access times)
• Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status)

Affected Persons:

• Communication partners

Purposes of Processing:

• Contact inquiries and communication
• Administration and response to inquiries
• Feedback (e.g., collecting feedback via online form)
• Provision of our online offering and user-friendliness

Legal Bases:

• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR)
• Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR)

Further Information on Processing Procedures, Methods, and Services:

• Contact Form: When users contact us via our contact form, email, or other communication channels, we process the data provided to us for handling the communicated request; Legal bases: Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

---

Push Notifications

With the consent of the users, we can send push notifications to users. Push notifications are messages displayed on the screens, devices, or browsers of the users, even when our online service is not being actively used.

To subscribe to the push notifications, users must confirm the query from their browser or device to receive push notifications. This consent process is documented and stored. The storage is necessary to recognize whether users have agreed to receive the push notifications and to be able to prove the consent. For these purposes, a pseudonymous identifier of the browser (so-called „push token“) or the device ID of a device is stored.

Push notifications may be necessary to fulfill contractual obligations (e.g., to inform users about important technical or organizational matters related to the use of our online offering). Otherwise, push notifications will only be sent based on user consent.

Processed Data Types:

• Usage data (e.g., visited websites, interest in content)
• Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers)

Affected Persons:

• Communication partners

Purposes of Processing:

• Provision of our online offering and user-friendliness

Legal Bases:

• Consent (Art. 6 para. 1 sentence 1 lit. a GDPR)
• Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR)

---

Newsletter and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter „newsletters“) only with the consent of the recipients or legal permission. If the content of the newsletter is specifically described during registration, it is decisive for the user’s consent. In addition, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal addressing in the newsletter or other information, provided this is necessary for the purposes of the newsletter.

Double-Opt-In Process: The registration for our newsletter is done in a so-called double-opt-in procedure. This means that after registration, you will receive an email in which you will be asked to confirm your registration. This confirmation is necessary to ensure that no one can register with another’s email address. The registrations for the newsletter are logged to prove the registration process in accordance with the legal requirements. This includes the storage of the registration and confirmation times as well as the IP address. Likewise, the changes to your data stored with the email service provider are logged.

Deletion and Limitation of Processing: We may store the email addresses of unsubscribed users for up to three years based on our legitimate interests before deleting them to prove a formerly given consent. The processing of this data is limited to the purpose of possible defense against claims. An individual deletion request is possible at any time if the former existence of consent is confirmed. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blocklist (so-called „blocklist“).

The logging of the registration process is based on our legitimate interests for the purpose of proving its proper execution. If we commission a service provider to send emails, this is done based on our legitimate interests in a secure and efficient delivery system.

Content:

• Information about us, our services, promotions, and offers

Processed Data Types:

• Inventory data (e.g., names, addresses)
• Contact data (e.g., email, telephone numbers)
• Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status)
• Usage data (e.g., visited websites, interest in content, access times)

Affected Persons:

• Communication partners

Purposes of Processing:

• Direct marketing (e.g., via email or post)

Legal Bases:

• Consent (Art. 6 para. 1 sentence 1 lit. a GDPR)

Opt-Out Option: You can unsubscribe from our newsletter at any time, i.e., revoke your consents or object to further receipt. You will find a link to unsubscribe at the end of each newsletter or you can otherwise use one of the contact options provided above, preferably email.

Further Information on Processing Procedures, Methods, and Services:

• Measurement of Opening and Click Rates: The newsletters contain a so-called „web beacon,“ i.e., a pixel-sized file that is retrieved from our server, or, if we use an email service provider, from their server when the newsletter is opened. As part of this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, is collected. This information is used to improve the technical performance of our services based on the technical data or the target groups and their reading behavior based on their access locations (which can be determined using the IP address) or the access times. This analysis also includes determining whether newsletters are opened, when they are opened, and which links are clicked. This information is assigned to individual newsletter recipients and stored in their profiles until they are deleted. The evaluations are used to recognize the reading habits of our users and adapt our content to them or send different content according to the interests of our users. The measurement of the opening rates and click rates, as well as the storage of the measurement results in user profilesMeasurement of the opening rates and click rates, as well as the storage of the measurement results in user profiles, are based on user consent. A separate objection to the measurement of performance is unfortunately not possible; in this case, the entire newsletter subscription must be canceled. In this case, the stored profile information will be deleted.Processed Data Types:
  • Inventory data (e.g., names, addresses)
  • Contact data (e.g., email, telephone numbers)
  • Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status)
  • Usage data (e.g., accessed content, interactions with content)

  Legal Bases:

  • Consent (Art. 6 para. 1 sentence 1 lit. a GDPR)

  ---

  Marketing Communication via Email, Post, Fax, or Telephone

  We process personal data for marketing communication purposes, which may be carried out via various channels, such as email, telephone, post, or fax, in accordance with legal requirements.

  Recipients have the right to revoke any consent they have given at any time or to object to marketing communication at any time.

  After revocation or objection, we store the data necessary to prove the prior authorization to contact or send communications for up to three years based on our legitimate interests. The processing of this data is limited to the purpose of defending against potential claims. In the case of obligations to permanently respect objections, we reserve the right to store the necessary data (e.g., depending on the communication channel, the email address, telephone number, or name) in a blocklist for this purpose.

  Processed Data Types:

  • Inventory data (e.g., names, addresses)
  • Contact data (e.g., email, telephone numbers)

  Affected Persons:

  • Communication partners

  Purposes of Processing:

  • Direct marketing (e.g., via email or post)

  Legal Bases:

  • Consent (Art. 6 para. 1 sentence 1 lit. a GDPR)
  • Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR)

  ---

  Web Analysis, Monitoring, and Optimization

  Web analysis (also referred to as „reach measurement“) serves to evaluate visitor traffic on our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize when our online offering or its functions or content are most frequently used, or invite repeat use. Similarly, we can identify which areas need optimization.

  In addition to web analysis, we may also use test procedures, for example, to test and optimize different versions of our online offering or its components.

  Unless otherwise indicated below, for these purposes, profiles may be created that summarize the data about a user’s session, and information may be stored in a browser or a device and retrieved from it. The collected information may include, in particular, the visited websites and their elements, as well as technical information such as the browser used, the computer system, and the time spent on the website. If users have consented to the collection of their location data, this may also be processed.

  The IP addresses of users are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. Generally, the data stored in the context of web analysis, A/B testing, and optimization is not clear data of users (such as email addresses or names) but pseudonymous data. This means that we, as well as the providers of the used software, do not know the actual identity of the users, only the information stored in their profiles for the respective procedures.

  Processed Data Types:

  • Usage data (e.g., visited websites, interest in content, access times)
  • Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status)

  Affected Persons:

  • Users (e.g., website visitors, users of online services)

  Purposes of Processing:

  • Reach measurement (e.g., access statistics, recognition of returning visitors)
  • Profiles with user-related information (creating user profiles)

  Security Measures:

  • IP masking (pseudonymization of the IP address)

  Legal Bases:

  • Consent (Art. 6 para. 1 sentence 1 lit. a GDPR)

  Further Information on Processing Procedures, Methods, and Services:

  • Google Tag Manager: Google Tag Manager is a solution that allows us to manage website tags through a user interface and integrate other services into our online offering (referred to in more detail elsewhere in this privacy policy). The Tag Manager itself (which implements the tags) does not create user profiles or store cookies. Only the IP address of the user is transmitted to Google, which is necessary to run the Google Tag Manager; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (guaranteeing data protection levels for processing in third countries): https://business.safety.google/adsprocessorterms.
  • Matomo: Matomo is software used for web analysis and reach measurement. In the course of using Matomo, cookies are generated and stored on the users‘ end device. The data collected during the use of Matomo is only processed by us and not shared with third parties. Cookies are stored for a maximum duration of 13 months; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Deletion of Data: Cookies have a storage duration of a maximum of 13 months.

  ---

  Presence in Social Networks (Social Media)

  We maintain online presences within social networks and process data of users in this context to communicate with users active there or to offer information about us.

  We point out that user data may be processed outside the European Union. This may result in risks for the users, for example, because the enforcement of user rights could be more difficult.

  Furthermore, user data is generally processed within social networks for market research and advertising purposes. For example, user profiles can be created based on user behavior and interests. The usage profiles can in turn be used, for example, to display advertisements inside and outside the networks that presumably correspond to the users‘ interests. For these purposes, cookies are usually stored on users‘ devices in which the user behavior and interests are stored. Additionally, data can be stored in the usage profiles, regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in).

  For a detailed description of the respective forms of processing and the options to object (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

  Also, in the case of information requests and the assertion of user rights, we point out that these are most effectively asserted with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, you can contact us.

  Processed Data Types:

  • Contact data (e.g., email, telephone numbers)
  • Content data (e.g., entries in online forms)
  • Usage data (e.g., visited websites, interest in content, access times)
  • Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status)

  Affected Persons:

  • Users (e.g., website visitors, users of online services)

  Purposes of Processing:

  • Contact inquiries and communication
  • Feedback (e.g., collecting feedback via online forms)
  • Marketing

  Legal Bases:

  • Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR)

Further Information on Social Media Processing Procedures, Methods, and Services:

• Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
• Facebook Pages: Profiles within the social network Facebook – We are jointly responsible with Meta Platforms Ireland Limited for collecting (but not for further processing) data of visitors to our Facebook page (so-called „Fanpage“). This data includes information about the types of content users view or interact with, or the actions they take (as detailed under „Things you and others do and provide“ in Facebook’s data policy: https://www.facebook.com/policy), as well as information about the devices used by visitors (e.g., IP addresses, operating system, browser type, language settings, cookie data). As explained in Facebook’s data policy under „How do we use this information?“, Facebook also collects and uses information to provide analytics services, known as „Page Insights,“ to page operators, enabling them to gain insights into how people interact with their pages and the content associated with them. We have entered into a special agreement with Facebook („Page Insights Information,“ https://www.facebook.com/legal/terms/page_controller_addendum), which specifies in particular what security measures Facebook must observe and in which Facebook has agreed to fulfill data subject rights (i.e., users can, for example, request information or deletion directly from Facebook). The rights of users (in particular, to access, deletion, objection, and complaints to the relevant supervisory authority) are not restricted by these agreements with Facebook. Further details can be found in the „Page Insights Information“ (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (guaranteeing data protection level for processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: Joint responsibility agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. Joint responsibility is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which also covers the transfer of the data to the parent company Meta Platforms, Inc. in the USA (based on the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
• LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Data processing agreement: https://legal.linkedin.com/dpa; Standard contractual clauses (guaranteeing data protection level for processing in third countries): https://legal.linkedin.com/dpa; Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Pinterest: Social network; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.pinterest.com; Privacy policy: https://policy.pinterest.com/en/privacy-policy; Further information: Pinterest Data Sharing Annex (ANNEX A): https://business.pinterest.com/en/pinterest-advertising-services-agreement.

---

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as „third-party providers“). These may be, for example, graphics, videos, or city maps (hereinafter uniformly referred to as „content“).

The integration always requires that the third-party providers of this content process the IP address of the users, as they would not be able to send the content to their browser without the IP address. The IP address is therefore necessary for the display of this content or function. We strive to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as „web beacons“) for statistical or marketing purposes. Pixel tags can be used to evaluate visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, visit times, and other information regarding the use of our online offering, as well as being combined with such information from other sources.

Processed Data Types:

• Usage data (e.g., visited websites, interest in content, access times)
• Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status)

Affected Persons:

• Users (e.g., website visitors, users of online services)

Purposes of Processing:

• Provision of our online offering and user-friendliness

Legal Bases:

• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR)

Further Information on Processing Procedures, Methods, and Services:

• Integration of Third-Party Software, Scripts, or Frameworks (e.g., jQuery): We integrate software into our online offering that we retrieve from the servers of other providers (e.g., functional libraries that we use for the display or user-friendliness of our online offering). In doing so, the respective providers collect the IP address of the users and can process it for security purposes, as well as for the analysis and optimization of their services; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Google Fonts (Retrieved from Google Server): We integrate fonts (and symbols) for a technically secure, maintenance-free, and efficient use of fonts and symbols with regard to timeliness and loading times, their uniform display, and the consideration of possible license restrictions. The provider of the fonts receives the user’s IP address to enable the fonts to be delivered to the user’s browser. In addition, technical data (e.g., language settings, screen resolution, operating system, and hardware used) is transmitted to provide the fonts depending on the devices used and the technical environment. This data may be processed on a Google server in the USA – When visiting our online offering, the user’s browser sends HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving the fonts). The Google Fonts Web API provides users with Google Fonts‘ Cascading Style Sheets (CSS) and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the user to access the internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the User-Agent, which describes the browser and operating system versions of the website visitors, as well as the referrer URL (i.e., the website where the Google font should be displayed). IP addresses are not logged or stored on Google servers and are not analyzed. The Google Fonts Web API logs details of HTTP requests (requested URL, User-Agent, and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families that the user wants to load. This data is logged to determine how often a particular font family is requested. In the Google Fonts Web API, the User-Agent must customize the font that is generated for the specific browser type. The User-Agent is logged primarily for debugging purposes and is used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the „Analytics“ page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for maintenance in production and an aggregated report on top integrations based on the number of font requests can be generated. According to Google, none of the information collected by Google Fonts is used to create profiles of end users or to display targeted ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Further information: https://developers.google.com/fonts/faq/privacy?hl=en.

Changes and Updates to the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We will adapt the privacy policy as soon as changes in our data processing make this necessary. We will inform you as soon as changes require your cooperation (e.g., consent) or other individual notifications.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and ask you to check the details before contacting them.

---

Rights of the Data Subjects

As a data subject, you have the right to various rights under the General Data Protection Regulation (GDPR), which arise in particular from Articles 15 to 21 GDPR:

• Right to Object: You have the right to object, at any time, to the processing of your personal data, which is based on Art. 6 para. 1 lit. e or f GDPR, for reasons arising from your particular situation. This also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling, insofar as it is related to such direct marketing.
• Right of Withdrawal for Consents: You have the right to withdraw your consent at any time.
• Right of Access: You have the right to request confirmation as to whether data concerning you is being processed and to information about this data, as well as further information and a copy of the data in accordance with legal requirements.
• Right to Rectification: You have the right to request the completion of data concerning you or the correction of inaccurate data concerning you, in accordance with legal requirements.
• Right to Erasure and Restriction of Processing: In accordance with legal requirements, you have the right to request that data concerning you be deleted immediately, or alternatively, to request a restriction of the processing of the data in accordance with legal requirements.
• Right to Data Portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, in accordance with legal requirements, or to request its transfer to another controller.
• Right to Complain to Supervisory Authority: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement if you consider that the processing of personal data relating to you infringes the provisions of the GDPR.

---

Definitions of Terms

In this section, you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined mainly in Art. 4 GDPR. The legal definitions are binding. However, the following explanations are intended primarily to aid understanding. The terms are arranged alphabetically.

• Personal Data: „Personal data“ means any information relating to an identified or identifiable natural person (hereinafter „data subject“); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Profiles with User-Related Information: The processing of „profiles with user-related information,“ or simply „profiles,“ includes any form of automated processing of personal data that consists of using this personal data to analyze, evaluate, or predict certain personal aspects related to a natural person (depending on the type of profile formation, this may include different information concerning demographics, behavior, and interests, such as interactions with websites and their content). Cookies and web beacons are often used for profiling purposes.
• Reach Measurement: Reach measurement (also referred to as web analytics) serves to evaluate the visitor flows of an online offer and can include the behavior or interests of visitors in certain information, such as website content. Website owners can use the reach analysis to understand when visitors access their website and for which content they are interested. For reach measurement purposes, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus obtain more precise analyses of the use of an online offering.
• Controller: „Controller“ means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: „Processing“ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.