Privacy Policy.

Introduction

The following privacy policy is intended to inform you about the types of personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).

The terms used are not gender-specific.

As of January 1, 2026

Table of contents

  • Introduction

  • Responsible party

  • Overview of processing activities

  • Relevant legal bases

  • Security measures

  • Deletion of data

  • Use of cookies

  • Business services

  • Payment methods

  • Provision of online services and web hosting

  • Registration, login, and user account

  • Blogs and publication media

  • Contact and inquiry management

  • Music and podcasts

  • Newsletters and electronic notifications

  • Advertising communication via email, post, fax, or telephone

  • Surveys and questionnaires

  • Web analysis, monitoring, and optimization

  • Online marketing

  • Affiliate programs and affiliate links

  • Customer reviews and rating procedures

  • Presence on social networks (social media)

  • Plugins and embedded functions and content

  • Management, organization, and support tools

  • Changes and updates to the privacy policy

  • Rights of data subjects

  • Definition of terms

  • Verantwortlicher

Julia Bamberg
Altdorfstr. 68
79312 Emmendingen
Deutschland

E-Mail-Address:

mail@juliabamberg.com

Imprint:

https://www.juliabamberg.com/imprint

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of Data Processed

  • Master data.

  • Payment data.

  • Contact data.

  • Content data.

  • Contract data.

  • Usage data.

  • Meta/communication data.

  • Event data (Facebook).

Special Categories of Data

  • Health data.

Categories of Data Subjects

  • Customers.

  • Prospective customers.

  • Communication partners.

  • Users.

  • Business and contractual partners.

Purposes of Processing

  • Provision of contractual services and customer service.

  • Contact requests and communication.

  • Security measures.

  • Direct marketing.

  • Reach measurement.

  • Office and organizational procedures.

  • Conversion measurement.

  • Affiliate tracking.

  • Administration and responding to requests.

  • Server monitoring and error detection.

  • Feedback.

  • Marketing.

  • Profiles with user-related information.

  • Provision of our online services and user-friendliness.

Relevant Legal Bases

Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your and/or our country of residence or establishment. If more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

Consent (Art. 6(1) sentence 1 lit. a GDPR) – The data subject has given consent to the processing of personal data relating to them for one or more specific purposes.

Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR) – Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

Legal obligation (Art. 6(1) sentence 1 lit. c GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.

Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

Security Measures

In accordance with the statutory provisions, taking into account the state of the art, implementation costs, and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to data as well as access to, input of, disclosure of, safeguarding of availability of, and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to threats to data. We also take the protection of personal data into account already in the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Deletion of Data

The data processed by us will be deleted in accordance with statutory provisions as soon as the consents permitting processing are revoked or other permissions cease to apply (e.g., if the purpose for processing this data no longer applies or it is not required for that purpose).

If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise or defense of legal claims or to protect the rights of another natural or legal person.

Our privacy notices may also contain further information regarding retention and deletion of data that applies primarily to the respective processing activities.

Use of Cookies

Cookies are small text files or other storage records that store information on end devices and read information from end devices. For example, to store the login status in a user account, the contents of a shopping cart in an e-shop, the content accessed, or functions used within an online service. Cookies may also be used for different purposes, e.g., for the functionality, security and convenience of online services and for creating analyses of visitor traffic.

Notes on consent: We use cookies in accordance with statutory provisions. Therefore, we obtain prior consent from users unless it is not legally required. Consent is not necessary in particular if storing and reading information, including cookies, is strictly necessary in order to provide users with a telemedia service (i.e., our online service) expressly requested by them. The revocable consent is clearly communicated to users and contains information about the respective cookie usage.

Notes on data protection legal bases: The data protection legal basis on which we process users’ personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is the declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g., in the economic operation of our online service and improving its usability) or, if this takes place in the context of fulfilling our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. We explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing processes.

Storage period: With regard to storage period, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user leaves an online service and closes their device (e.g., browser or mobile application).

  • Persistent cookies: Persistent cookies remain stored even after the device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, the user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage period of cookies (e.g., as part of obtaining consent), users should assume that cookies are persistent and that the storage period can be up to two years.

General notes on withdrawal and objection (opt-out): Users can withdraw their consent at any time and also object to processing in accordance with the statutory provisions of Art. 21 GDPR (further notes on objection are provided within this privacy policy). Users can also declare their objection via their browser settings.

Further Notes on Processing Processes, Procedures and Services

Processing of cookie data based on consent: We use a cookie consent management procedure within which users’ consent to the use of cookies and/or the processing activities and providers named within the cookie consent management procedure can be obtained, managed and revoked. The consent declaration is stored so that it does not have to be requested again and to be able to prove consent in accordance with legal obligations. Storage can take place server-side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies in order to be able to assign the consent to a user and/or their device. Subject to individual information regarding providers of cookie management services, the following notes apply: The storage duration of consent can be up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system and device used.

Business Services

We process data of our contractual and business partners, e.g., customers and prospective customers (collectively referred to as “contractual partners”), within the scope of contractual and comparable legal relationships as well as related measures and within the scope of communication with contractual partners (or pre-contractually), e.g., in order to answer inquiries.

We process this data to fulfill our contractual obligations. This includes in particular obligations to provide the agreed services, any update obligations, and remedies in the event of warranty and other performance disruptions. In addition, we process the data to protect our rights and for purposes of administrative tasks associated with these obligations as well as corporate organization. Furthermore, we process the data on the basis of our legitimate interests in proper and economically sound business operations and in security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information and rights (e.g., involving telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or financial authorities). Within the scope of applicable law, we only disclose data of contractual partners to third parties insofar as this is necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about further forms of processing, e.g., for marketing purposes, within the scope of this privacy policy.

We inform contractual partners about which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, by special marking (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after the expiry of 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for statutory archiving purposes (e.g., for tax purposes usually 10 years). Data disclosed to us by the contractual partner as part of an order will be deleted in accordance with the specifications of the order, generally after the end of the order.

If we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between users and the providers.

Therapeutic Services

We process the data of our clients as well as prospective clients and other principals or contractual partners (uniformly referred to as “clients”) in order to be able to provide our services to them. The data processed, the nature, scope, purpose and necessity of its processing are determined by the underlying contract and client relationship.

In the course of our activities, we may also process special categories of data, in particular information about the health of clients, possibly with reference to their sex life or sexual orientation, as well as data from which racial and ethnic origin, political opinions, religious or philosophical beliefs or trade union membership may be inferred. For this purpose, we obtain explicit consent from clients if necessary and otherwise process the special categories of data insofar as this serves the health of clients, the data is public, or other legal permissions apply.

If it is necessary for the performance of our contract, to protect vital interests, or required by law, and/or if the client’s consent is available, we disclose or transmit the clients’ data in compliance with professional regulations to third parties or agents, such as authorities, medical facilities, laboratories, billing offices, as well as in the IT, office or comparable services sector.

Events and Activities

We process the data of participants of events and similar activities offered or organized by us (hereinafter uniformly referred to as “participants” and “events”) in order to enable them to participate in the events and make use of the services or actions associated with participation.

If we process health-related data, religious, political or other special categories of data in this context, this is done within the scope of obviousness (e.g., for thematically oriented events) or serves health prevention, security, or takes place with the consent of the data subjects.

The required information is marked as such within the scope of the order, purchase or comparable contract conclusion and includes the information required for service provision and billing as well as contact information in order to be able to make any necessary inquiries. If we gain access to information of end customers, employees or other persons, we process it in accordance with statutory and contractual provisions.

Types of data processed: Master data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email, telephone numbers); contract data (e.g., contract subject matter, term, customer category).

Special categories of personal data: Health data (Art. 9(1) GDPR).

Data subjects: Prospective customers; business and contractual partners; customers.

Purposes of processing: Provision of contractual services and customer service; contact requests and communication; office and organizational procedures; administration and responding to requests.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legal obligation (Art. 6(1) sentence 1 lit. c GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Payment Methods

Within the scope of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer affected persons efficient and secure payment options and, for this purpose, use additional service providers in addition to banks and credit institutions (collectively “payment service providers”).

The data processed by the payment service providers includes master data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums as well as contract, amount and recipient-related information. This information is required in order to carry out the transactions. However, the entered data is processed and stored only by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information confirming or denying the payment. Under certain circumstances, payment service providers may transmit the data to credit agencies. This transmission serves identity and creditworthiness checks. We refer to the terms and conditions and the privacy notices of the payment service providers in this regard.

The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions and can be accessed within the respective websites or transaction applications. We also refer to these for further information and for asserting rights of withdrawal, information and other data subject rights.

Types of data processed: Master data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contract data (e.g., contract subject matter, term, customer category); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses); contact data (e.g., email, telephone numbers).

Data subjects: Customers; prospective customers.

Purposes of processing: Provision of contractual services and customer service.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Google Pay: Payment processing services; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://pay.google.com/intl/de_de/about/; Privacy policy: https://policies.google.com/privacy.

Mastercard: Payment processing services; service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgien; Website: https://www.mastercard.de/de-de.html; Privacy policy: https://www.mastercard.de/de-de/datenschutz.html.

PayPal: Payment processing services (e.g., PayPal, PayPal Plus, Braintree); service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Website: https://www.paypal.com/de; Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Visa: Payment processing services; service provider: Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, GB; Website: https://www.visa.de; Privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

Provision of Online Services and Web Hosting

In order to provide our online services securely and efficiently, we use the services of one or more web hosting providers whose servers (or servers managed by them) can be used to access the online services. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.

The data processed in connection with the provision of the hosting services can include all information relating to users of our online services that arises during use and communication. This regularly includes the IP address, which is necessary to deliver the content of online services to browsers, and all inputs made within our online services or on websites.

Types of data processed: Content data (e.g., inputs in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Provision of our online services and user-friendliness; reach measurement (e.g., access statistics, recognition of returning visitors); conversion measurement (measurement of the effectiveness of marketing measures); server monitoring and error detection.

Legal basis: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Email sending and hosting: The web hosting services used by us also include sending, receiving and storing emails. For these purposes, the addresses of recipients and senders as well as further information relating to email sending (e.g., the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent encrypted on the Internet. As a rule, emails are encrypted during transport, but (if no so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We therefore cannot assume responsibility for the transmission path of emails between the sender and reception on our server.

Collection of access data and log files: We (or our web hosting provider) collect data about every access to the server (so-called server log files). The server log files may include the address and name of the retrieved websites and files, date and time of retrieval, transmitted data volumes, message about successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to avoid overloading the servers (in particular in the event of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure server utilization and stability; deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

SquareSpace: Squarespace offers software as a service for creating and hosting websites; service provider: Squarespace, Inc. 8 Clarkson St, New York, NY 10014, USA; Website: https://www.squarespace.com; Privacy policy: https://www.squarespace.com/privacy; Standard Contractual Clauses (ensuring data protection level for processing in third countries): https://www.squarespace.com/dpa.

Registration, Login and User Account

Users can create a user account. As part of registration, users are informed of the required mandatory information and it is processed for the purpose of providing the user account on the basis of contractual performance. The processed data includes in particular login information (username, password and an email address).

When using our registration and login functions as well as using the user account, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests as well as those of users in protection against misuse and other unauthorized use. As a rule, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about processes relevant to their user account, e.g., technical changes.

Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, telephone numbers); content data (e.g., inputs in online forms); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Provision of contractual services and customer service; security measures; administration and responding to requests.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Two-factor authentication: Two-factor authentication provides an additional layer of security for your user account and ensures that only you can access your account even if someone else knows your password. For this purpose, in addition to your password you must carry out another authentication measure (e.g., enter a code sent to a mobile device). We will inform you about the procedure used by us.

Deletion of data after termination: If users terminate their user account, their data relating to the user account will be deleted, subject to a legal permission, obligation or user consent.

No retention obligation for data: It is the users’ responsibility to back up their data before the end of the contract in the event of termination. We are entitled to irretrievably delete all data stored by the user during the term of the contract.

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). Readers’ data is processed for the purposes of the publication medium only insofar as it is necessary for its presentation and for communication between authors and readers or for security reasons. Otherwise, we refer to the information on processing of visitors to our publication medium within the scope of these privacy notices.

Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, telephone numbers); content data (e.g., inputs in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Provision of contractual services and customer service; feedback (e.g., collecting feedback via online form); security measures; administration and responding to requests.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Comments and posts: If users leave comments or other posts, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in case someone posts unlawful content in comments and posts (insults, prohibited political propaganda, etc.). In such cases, we can be held liable for the comment or post ourselves and are therefore interested in the author’s identity. Furthermore, we reserve the right, on the basis of our legitimate interests, to process users’ information for spam detection. On the same legal basis, we reserve the right, in the case of surveys, to store users’ IP addresses for their duration and to use cookies in order to prevent multiple votes. The personal information communicated in the course of comments and posts, any contact and website information as well as the content information are stored permanently by us until users object.

Contact and Inquiry Management

When contacting us (e.g., via contact form, email, telephone or via social media) and within the scope of existing user and business relationships, the information provided by the inquiring persons is processed insofar as this is necessary to answer contact inquiries and any requested measures.

Responding to contact inquiries and managing contact and inquiry data within the scope of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to respond to (pre-)contractual inquiries and otherwise on the basis of legitimate interests in responding to inquiries and maintaining user and business relationships.

Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, telephone numbers); content data (e.g., inputs in online forms).

Data subjects: Communication partners.

Purposes of processing: Contact requests and communication; provision of contractual services and customer service.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); legal obligation (Art. 6(1) sentence 1 lit. c GDPR).

Further Notes on Processing Processes, Procedures and Services:

Contact form: If users contact us via our contact form, email or other communication channels, we process the data communicated to us in this context in order to handle the communicated request. For this purpose, we process personal data within the scope of pre-contractual and contractual business relationships insofar as this is necessary for their fulfillment and otherwise on the basis of our legitimate interests and the interests of communication partners in responding to requests and our statutory retention obligations.

Music and Podcasts

We use hosting and analytics services from service providers in order to offer our audio content for listening and/or downloading and to obtain statistical information about retrieval of the audio content.

Types of data processed: Usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); conversion measurement (measurement of the effectiveness of marketing measures); profiles with user-related information (creation of user profiles).

Further Notes on Processing Processes, Procedures and Services:

Blubrry: Blubrry – music and podcast hosting; service provider: Rawvoice, Inc. 5000 Arlington Centre Blvd., Building 2, Suite 2115, Upper Arlington, Ohio 43220 17525 Egan Drive Coopersville, Michigan 49404, USA; Website: https://soundcloud.com; Privacy policy: https://create.blubrry.com/resources/about-blubrry/privacy-policy/.

Spotify: Spotify – music hosting and widget; service provider: Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Schweden; Website: https://www.spotify.com/de; Privacy policy: https://www.spotify.com/de/legal/privacy-policy/.

Newsletters and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter “newsletter”) only with the consent of the recipients or a legal permission. If the content of the newsletter is specifically described as part of the newsletter registration, it is decisive for users’ consent. Otherwise, our newsletters contain information about our services and us.

To sign up for our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal addressing in the newsletter or further information if this is necessary for the purposes of the newsletter.

Double opt-in procedure: Registration for our newsletter generally takes place in a so-called double opt-in procedure. This means you will receive an email after registration asking you to confirm your registration. This confirmation is necessary so that no one can register with someone else’s email address. Newsletter registrations are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Likewise, changes to your data stored by the sending service provider are logged.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove previously given consent. The processing of this data is restricted to the purpose of possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blacklist (so-called “block list”).

Logging of the registration procedure is carried out on the basis of our legitimate interests for the purpose of proving its proper course. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Notes on legal bases: Newsletters are sent on the basis of recipients’ consent or, if consent is not required, on the basis of our legitimate interests in direct marketing, insofar as and to the extent legally permitted, e.g., in the case of advertising to existing customers. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in efficient and secure sending. The registration procedure is recorded on the basis of our legitimate interests in order to prove that it was carried out in accordance with the law.

Content:

  • Information about us, our services, promotions and offers.

Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, telephone numbers); meta/communication data (e.g., device information, IP addresses); usage data (e.g., websites visited, interest in content, access times).

Data subjects: Communication partners.

Purposes of processing: Direct marketing (e.g., by email or post).

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Right to object (opt-out): You can cancel receipt of our newsletter at any time, i.e., revoke your consents and/or object to further receipt. You will find a link to unsubscribe either at the end of each newsletter or you can otherwise use one of the contact options given above, preferably email.

Further Notes on Processing Processes, Procedures and Services:

Measurement of open and click rates: The newsletters contain a so-called “web beacon”, i.e., a pixel-sized file that is retrieved when the newsletter is opened from our server or, if we use a sending service provider, from their server. As part of this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, are initially collected. This information is used to technically improve our newsletters based on technical data or target groups and their reading behavior, based on their retrieval locations (which can be determined using the IP address) or access times. This analysis also includes determining whether newsletters are opened, when they are opened and blocked.

Mailchimp: Email sending and email marketing platform; service provider: Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; Website: https://mailchimp.com; Privacy policy: https://mailchimp.com/legal/; Standard Contractual Clauses (ensuring data protection level for processing in third countries): part of the data processing agreement; Data processing agreement: https://mailchimp.com/legal/; Further information: Special security measures: https://mailchimp.com/help/Mailchimp-european-data-transfers/.

Advertising Communication via Email, Post, Fax or Telephone

We process personal data for purposes of advertising communication, which may take place via various channels such as email, telephone, post or fax in accordance with statutory provisions.

Recipients have the right to revoke consents granted at any time or to object to advertising communication at any time.

After revocation and/or objection, we may store the data required to prove consent for up to three years on the basis of our legitimate interests before deleting it. Processing of this data is restricted to the purpose of possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time.

Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, telephone numbers).

Data subjects: Communication partners.

Purposes of processing: Direct marketing (e.g., by email or post).

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Surveys and Questionnaires

The surveys and questionnaires conducted by us (hereinafter “surveys”) are evaluated anonymously. Personal data is processed only insofar as this is necessary to provide and technically carry out the surveys (e.g., processing the IP address in order to display the survey in the user’s browser or using a temporary cookie (session cookie) to enable resuming the survey) or users have consented.

Notes on legal bases: If we ask participants for consent to process their data, this is the legal basis for processing; otherwise, participants’ data is processed on the basis of our legitimate interests in conducting an objective survey.

Types of data processed: Contact data (e.g., email, telephone numbers); content data (e.g., inputs in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Communication partners.

Purposes of processing: Contact requests and communication; direct marketing (e.g., by email or post).

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Google Form: Google Cloud forms; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://firebase.google.com; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying ads: https://adssettings.google.com/authenticated.

Web Analytics, Monitoring and Optimization

Web analytics (also referred to as “reach measurement”) serves to evaluate visitor flows of our online service and can include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online service or its functions or content are used most frequently or invite reuse. Likewise, we can identify which areas require optimization.

In addition to web analytics, we may also use testing procedures, e.g., to test and optimize different versions of our online service or its components.

Unless otherwise stated below, profiles, i.e., data summarized into a usage process, may be created for these purposes and information may be stored in a browser or end device and read from it. The collected information includes in particular visited websites and elements used there, as well as technical information such as the browser used, the computer system used and information about usage times. If users have consented to the collection of their location data with us or with the providers of the services used by us, location data may also be processed.

Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimization, but rather pseudonyms. This means that we and the providers of the software used do not know the actual identity of users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to use third-party providers, the legal basis for processing data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic and user-friendly services). In this context, we also refer to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles).

Security measures: IP masking (pseudonymization of the IP address).

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Google Analytics: Web analytics, reach measurement and measurement of user flows; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Further information: types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and Standard Contractual Clauses for transfers of data to third countries: https://business.safety.google/adsprocessorterms.

Online Marketing

We process personal data for purposes of online marketing, which in particular may include marketing of advertising space or displaying advertising and other content (collectively referred to as “content”) based on users’ potential interests as well as measuring its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called “cookie”) or similar procedures are used by which the information relevant for displaying the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information such as the browser used, the computer system used, as well as information about usage times and used functions. If users have consented to the collection of their location data, this may also be processed.

Users’ IP addresses are also stored. However, we use available IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. Generally, no clear data of users (such as email addresses or names) is stored within the scope of online marketing procedures, but rather pseudonyms. This means that we and the providers of the online marketing procedures do not know the actual identity of users, but only the information stored in their profiles.

As a rule, the information in the profiles is stored in cookies or by means of similar procedures. These cookies can generally also be read on other websites that use the same online marketing procedure, analyzed for purposes of displaying content, supplemented with further data and stored on the server of the online marketing procedure provider.

In exceptional cases, clear data can be assigned to the profiles. This is the case if users are, for example, members of a social network whose online marketing procedure we use and the network links users’ profiles with the aforementioned information. Please note that users may make additional agreements with the providers, e.g., by consenting during registration.

As a rule, we only receive aggregated information about the success of our advertisements. However, within the scope of so-called conversion measurement, we can check which of our online marketing procedures led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, please assume that cookies used are stored for a period of two years.

Notes on legal bases: If we ask users for their consent to use third-party providers, the legal basis for processing data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic and user-friendly services). In this context, we also refer to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Marketing; profiles with user-related information (creation of user profiles); conversion measurement (measurement of the effectiveness of marketing measures).

Security measures: IP masking (pseudonymization of the IP address).

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Right to object (opt-out): We refer to the privacy notices of the respective providers and the objection options (so-called “opt-out”) specified for the providers. If no explicit opt-out option is specified, you can disable cookies in your browser settings. However, this may restrict functions of our online service. We therefore additionally recommend the following opt-out options, offered collectively for the respective regions: a) Europe: https://www.youronlinechoices.eu. b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Cross-territory: https://optout.aboutads.info.

Further Notes on Processing Processes, Procedures and Services:

Google Ads and conversion measurement: We use the online marketing procedure “Google Ads” to place ads in the Google advertising network (e.g., in search results, in videos, on websites, etc.) so that they are shown to users who presumably have an interest in the ads. We also measure the conversion of the ads. However, we only learn the anonymous total number of users who clicked on our ad and were redirected to a page tagged with a so-called “conversion tracking tag”. However, we do not receive any information that can be used to identify users; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Further information: types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products: information on the services; Data processing terms between controllers and Standard Contractual Clauses for transfers of data to third countries: https://business.safety.google/adscontrollerterms.

Affiliate Programs and Affiliate Links

We integrate so-called affiliate links or other references (which may include, for example, search masks, widgets or discount codes) to offers and services of third-party providers into our online service (collectively referred to as “affiliate links”). If users follow the affiliate links and subsequently use the offers, we may receive a commission or other benefits from these third-party providers (collectively referred to as “commission”).

In order to track whether users have used the offers of an affiliate link used by us, it is necessary that the respective third-party providers learn that users have followed an affiliate link used within our online service. Assignment of the affiliate links to the respective business transactions or other actions (e.g., purchases) serves solely the purpose of commission billing and is removed as soon as it is no longer required for that purpose.

For the purposes of the aforementioned assignment, affiliate links may be supplemented with certain values that are part of the link or can be stored elsewhere, e.g., in a cookie. The values may include in particular the originating website (referrer), the time, an online identifier of the operators of the website on which the affiliate link was located, an online identifier of the respective offer, the type of link used, the type of offer and an online identifier of the user.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Furthermore, the use of third-party providers may be part of our (pre-)contractual services if the use of the third-party providers has been agreed in this context. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic and user-friendly services). In this context, we also refer to the information on the use of cookies in this privacy policy.

Types of data processed: Contract data (e.g., contract subject matter, term, customer category); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Affiliate tracking.

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Amazon Partner Program: Affiliate partner program (Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or one of its affiliated companies); service provider: Amazon Europe Core S.à.r.l., Amazon EU S.à.r.l, Amazon Services Europe S.à.r.l. and Amazon Media EU S.à.r.l., all four located at 38, avenue John F. Kennedy, L-1855 Luxemburg, as well as Amazon Instant Video Germany GmbH, Domagkstr. 28, 80807 München (together “Amazon Europe”), parent company: Amazon.com, Inc., 2021 Seventh Ave, Seattle, Washington 98121, USA; Website: https://www.amazon.de; Privacy policy: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010.

Customer Reviews and Rating Procedures

We participate in review and rating procedures in order to evaluate, optimize and advertise our services. If users rate us via the participating rating platforms or procedures or otherwise provide feedback, the general terms and conditions and privacy notices of the providers also apply. As a rule, rating also requires registration with the respective providers.

In order to ensure that the rating persons have actually used our services, we transmit the necessary data regarding the customer and the service used to the respective rating platform with the customers’ consent (including name, email address and order number or item number). This data is used solely to verify the authenticity of the user.

Types of data processed: Contract data (e.g., contract subject matter, term, customer category); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Customers; users (e.g., website visitors, users of online services).

Purposes of processing: Feedback (e.g., collecting feedback via online form); marketing.

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Review widget: We integrate so-called “review widgets” into our online service. A widget is a functional and content element integrated into our online service that displays changing information. It can, for example, be displayed in the form of a seal or comparable element, sometimes also called a “badge”. The relevant content of the widget is displayed within our online service, but at that moment it is retrieved from the servers of the respective widget provider. This is the only way to always show the current content, especially the current rating. For this purpose, a data connection must be established from the website accessed within our online service to the server of the widget provider and the widget provider receives certain technical data (access data, including IP address) needed so that the widget content can be delivered to the user’s browser. Furthermore, the widget provider receives information that users have visited our online service. This information can be stored in a cookie and used by the widget provider to recognize which online services participating in the review procedure have been visited by the user. The information can be stored in a user profile and used for advertising or market research purposes.

Presences in Social Networks (Social Media)

We maintain online presences within social networks and, in this context, process users’ data in order to communicate with users active there or to provide information about us.

We point out that users’ data may be processed outside the European Union. This may result in risks for users because, for example, enforcing users’ rights could be more difficult.

Furthermore, users’ data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on users’ usage behavior and the resulting interests. The usage profiles can in turn be used, for example, to place advertisements inside and outside the networks that presumably correspond to users’ interests. For these purposes, cookies are generally stored on users’ computers in which users’ usage behavior and interests are stored. Furthermore, data may also be stored in the usage profiles independently of the devices used by users (in particular if users are members of the respective platforms and are logged in there).

For a detailed presentation of the respective forms of processing and the objection options (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

Also in the case of information requests and assertion of data subject rights, we point out that these can be most effectively asserted with the providers. Only the providers have access to users’ data and can directly take appropriate measures and provide information. If you still need help, you can contact us.

Types of data processed: Contact data (e.g., email, telephone numbers); content data (e.g., inputs in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Contact requests and communication; feedback (e.g., collecting feedback via online form); marketing.

Legal basis: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Instagram: Social network; service provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.

Facebook pages: Profiles within the social network Facebook – We are jointly responsible with Facebook Ireland Ltd. for the collection (but not further processing) of data of visitors to our Facebook page (so-called “fan page”). This data includes information about the types of content users view or interact with, or actions taken by them (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see “Device Information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook collects and uses information also to provide analytics services, so-called “Page Insights”, for page operators so that they gain insights into how people interact with their pages and the content associated with them. We have concluded a specific agreement with Facebook (“Information about Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum) which regulates in particular which security measures Facebook must observe and in which Facebook agrees to fulfill data subject rights (i.e., users can address information or deletion requests directly to Facebook). Users’ rights (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information about Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland; Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard Contractual Clauses (ensuring data protection level for processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: joint controllership agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data.

LinkedIn: Social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Standard Contractual Clauses (ensuring data protection level for processing in third countries): https://legal.linkedin.com/dpa; Right to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out; Data processing agreement: https://legal.linkedin.com/dpa.

YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): https://adssettings.google.com/authenticated.

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online service that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or maps (hereinafter uniformly referred to as “content”).

Integration always requires that the third-party providers of this content process users’ IP addresses, since they could not send the content to users’ browsers without the IP address. The IP address is therefore required for displaying these contents or functions. We endeavor to use only such content whose respective providers use the IP address solely for delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on users’ devices and may include, among other things, technical information about the browser and operating system, referring websites, visit time as well as other information about the use of our online service and may also be combined with such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic and user-friendly services). In this context, we also refer to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses); master data (e.g., names, addresses); contact data (e.g., email, telephone numbers); content data (e.g., inputs in online forms); event data (Facebook) (“event data” is data that can be transmitted by us to Facebook, e.g., via Facebook Pixel (via apps or in other ways), and relates to persons or their actions; this includes, for example, information about visits to websites, interactions with content, functions, installations of apps, purchases of products, etc.; the event data is processed for the purpose of creating audiences for content and advertising information (custom audiences); event data does not include the actual content (e.g., comments written), no login information and no contact information (i.e., no names, email addresses and telephone numbers). Event data is deleted by Facebook after a maximum of two years; audiences created from it are deleted when our Facebook account is deleted).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Provision of our online services and user-friendliness; provision of contractual services and customer service; marketing; profiles with user-related information (creation of user profiles).

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Facebook plugins and content: Facebook social plugins and content – This may include, for example, content such as images, videos or texts and buttons with which users can share content of this online service within Facebook. The list and appearance of the Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/ – We are jointly responsible with Facebook Ireland Ltd. for the collection or receipt in the context of a transmission (but not further processing) of “event data” that Facebook collects via the Facebook social plugins (and embedding functions for content) executed on our online service or receives in the context of a transmission for the following purposes, jointly responsible: a) displaying content and advertising information that presumably corresponds to users’ interests; b) delivery of commercial and transactional messages (e.g., contacting users via Facebook Messenger); c) improving ad delivery and personalization of functions and content (e.g., improving recognition of which content or advertising information presumably corresponds to users’ interests). We have concluded a specific agreement with Facebook (“Controller Addendum”, https://www.facebook.com/legal/controller_addendum) which regulates in particular which security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook agrees to fulfill data subject rights (i.e., users can address information or deletion requests directly to Facebook). Note: If Facebook provides us with metrics, analyses and reports (which are aggregated, i.e., do not contain information about individual users and are anonymous to us), then this processing does not take place within the scope of joint controllership, but on the basis of a data processing agreement (“Data Processing Terms”, https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) as well as, with regard to processing in the USA, on the basis of Standard Contractual Clauses (“Facebook EU Data Transfer Addendum”, https://www.facebook.com/legal/EU_data_transfer_addendum). Users’ rights (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook; service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland; Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy.

Google Maps: We integrate maps from the service “Google Maps” of the provider Google. The processed data may include in particular users’ IP addresses and location data, which, however, is not collected without their consent (as a rule as part of the settings of their mobile devices); service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://cloud.google.com/maps-platform; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying ads: https://adssettings.google.com/authenticated.

Instagram plugins and content: Instagram plugins and content – This may include, for example, content such as images, videos or texts and buttons with which users can share content of this online service within Instagram. – We are jointly responsible with Facebook Ireland Ltd. for the collection or receipt in the context of a transmission (but not further processing) of “event data” that Facebook collects via Instagram functions (e.g., embedding functions for content) executed on our online service or receives in the context of a transmission for the following purposes, jointly responsible: a) displaying content and advertising information that presumably corresponds to users’ interests; b) delivery of commercial and transactional messages (e.g., contacting users via Facebook Messenger); c) improving ad delivery and personalization of functions and content (e.g., improving recognition of which content or advertising information presumably corresponds to users’ interests). We have concluded a specific agreement with Facebook (“Controller Addendum”, https://www.facebook.com/legal/controller_addendum) which regulates in particular which security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook agrees to fulfill data subject rights (i.e., users can address information or deletion requests directly to Facebook). Note: If Facebook provides us with metrics, analyses and reports (which are aggregated, i.e., do not contain information about individual users and are anonymous to us), then this processing does not take place within the scope of joint controllership, but on the basis of a data processing agreement (“Data Processing Terms”, https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) as well as, with regard to processing in the USA, on the basis of Standard Contractual Clauses (“Facebook EU Data Transfer Addendum”, https://www.facebook.com/legal/EU_data_transfer_addendum). Users’ rights (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook; service provider: https://www.instagram.com, Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.

LinkedIn plugins and content: LinkedIn plugins and content – This may include, for example, content such as images, videos or texts and buttons with which users can share content of this online service within LinkedIn; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Standard Contractual Clauses (ensuring data protection level for processing in third countries): https://legal.linkedin.com/dpa; Right to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out; Data processing agreement: https://legal.linkedin.com/dpa.

YouTube videos: Video content; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying ads: https://adssettings.google.com/authenticated.

Management, Organization and Support Tools

We use services, platforms and software from other providers (hereinafter referred to as “third-party providers”) for purposes of organization, administration, planning and providing our services. When selecting third-party providers and their services, we comply with statutory requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. Various data may be affected that we process in accordance with this privacy policy. This data may include in particular master data and contact data of users, data on transactions, contracts, other processes and their content.

If users are referred to the third-party providers and/or their software or platforms within the scope of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization or marketing purposes. We therefore ask you to observe the privacy notices of the respective third-party providers.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Furthermore, the use of third-party providers may be part of our (pre-)contractual services if the use of the third-party providers has been agreed in this context. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic and user-friendly services). In this context, we also refer to the information on the use of cookies in this privacy policy.

Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, telephone numbers); content data (e.g., inputs in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).

Data subjects: Communication partners; users (e.g., website visitors, users of online services).

Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further Notes on Processing Processes, Procedures and Services:

Other service providers: .

Changes and Updates to the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing activities carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time and we ask you to verify the information before making contact.

Rights of Data Subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data relating to you which is based on Art. 6(1) lit. e or f GDPR; this also applies to profiling based on these provisions. If personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data relating to you for the purpose of such advertising; this also applies to profiling insofar as it is related to such direct marketing.

  • Right to withdraw consent: You have the right to withdraw consents granted at any time.

  • Right of access: You have the right to request confirmation as to whether data relating to you is being processed, and to obtain access to such data as well as further information and a copy of the data in accordance with statutory provisions.

  • Right to rectification: You have the right, in accordance with statutory provisions, to request completion of data relating to you or correction of inaccurate data relating to you.

  • Right to erasure and restriction of processing: You have the right, in accordance with statutory provisions, to request that data relating to you be deleted without undue delay, or alternatively, in accordance with statutory provisions, to request restriction of processing of the data.

  • Right to data portability: You have the right to receive data relating to you which you have provided to us, in a structured, commonly used and machine-readable format, or to request its transmission to another controller.

  • Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Definitions of Terms

In this section you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined primarily in Art. 4 GDPR. The legal definitions are binding. The following explanations are intended primarily for understanding. The terms are sorted alphabetically.

Affiliate tracking: In affiliate tracking, links by which linking websites refer users to websites with product or other offers are logged. The operators of the respective linking websites can receive a commission if users follow these so-called affiliate links and then use the offers (e.g., purchase goods or use services). For this purpose, it is necessary that providers can track whether users who are interested in certain offers subsequently use them due to the affiliate links. Therefore, for the functionality of affiliate links it is necessary that they are supplemented by certain values that become part of the link or can be stored elsewhere, e.g., in a cookie. The values include in particular the originating website (referrer), the time, an online identifier of the operators of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user as well as tracking-specific values such as, for example, advertising material ID, partner ID and categorizations.

Conversion measurement: Conversion measurement (also referred to as “visit action evaluation”) is a procedure with which the effectiveness of marketing measures can be determined. For this purpose, a cookie is usually stored on users’ devices within websites on which the marketing measures take place and then retrieved again on the target website. For example, this allows us to track whether the ads placed by us on other websites were successful.

Personal data: “Personal data” is all information relating to an identified or identifiable natural person (hereinafter “data subject”); a natural person is considered identifiable who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Profiles with user-related information: Processing of “profiles with user-related information”, or “profiles” for short, includes any form of automated processing of personal data consisting of using such personal data to evaluate certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information relating to demographics, behavior and interests, such as interaction with websites and their content, etc.), to analyze, evaluate or predict them (e.g., interests in certain content or products, click behavior on a website or location). Cookies and web beacons are often used for profiling purposes.

Reach measurement: Reach measurement (also referred to as web analytics) serves to evaluate visitor flows of an online service and can include behavior or interests of visitors in certain information, such as website content. With the help of reach analysis, website operators can, for example, recognize at what time visitors visit their website and which content they are interested in. This enables them, for example, to better adapt the content of the website to the needs of their visitors. Pseudonymous cookies and web beacons are often used for reach analysis purposes in order to recognize returning visitors and thus obtain more precise analyses of the use of an online service.

Server monitoring and error detection: With the help of server monitoring and error detection, we ensure the availability and integrity of our online service and use the processed data to technically optimize our online service. Performance, utilization and comparable technical values are processed, which provide information about the stability and any anomalies of our online service. In the event of errors and anomalies, individual requests from users of our online service are recorded in order to identify and remedy problem sources.

Controller: The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, whether it is collection, evaluation, storage, transmission or deletion.