Privacy Policy

Introduction and Overview

We have prepared this privacy policy (version 26.07.2024-122845050) to explain to you, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (short: data) we, as the data controller – and the processors we engage (e.g., providers) – process, will process in the future, and what legal options you have. The terms used are to be understood in a gender-neutral manner.
In short: We provide you with comprehensive information about the data we process about you.

Privacy policies usually sound very technical and use legal jargon. However, this privacy policy aims to describe the most important aspects in as simple and transparent a manner as possible. As far as transparency is concerned, technical terms are explained in a reader-friendly way, links to further information are provided, and graphics are used. We inform you in clear and simple language that we only process personal data within the scope of our business activities when there is a corresponding legal basis. This is certainly not possible if one gives as brief, unclear, and legally technical explanations as are often standard on the internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps there is some information that you did not know before.
If you still have questions, we kindly ask you to contact the responsible entity mentioned below or in the imprint, follow the existing links, and check further information on third-party sites. Our contact details can also be found in the imprint.

Scope

This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies engaged by us (processors). By personal data, we mean information as defined in Art. 4 No. 1 GDPR, such as the name, email address, and postal address of a person. The processing of personal data ensures that we can offer and invoice our services and products, whether online or offline. The scope of this privacy policy includes:

• all online presences (websites, online shops) that we operate
• social media presences and email communication
• mobile apps for smartphones and other devices

In short: The privacy policy applies to all areas in which personal data are structured processed in the company via the mentioned channels. Should we enter into legal relationships with you outside of these channels, we will inform you separately if necessary.

Legal Basis

In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e., the legal bases of the General Data Protection Regulation that enable us to process personal data.
Regarding EU law, we refer to the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. You can read this EU General Data Protection Regulation online at EUR-Lex, the access to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.

We process your data only if at least one of the following conditions applies:

1. Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of the data you entered in a contact form.
2. Contract (Article 6(1)(b) GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data. For example, if we conclude a purchase contract with you, we need personal information in advance.
3. Legal Obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally required to keep invoices for accounting purposes. These usually contain personal data.
4. Legitimate Interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we must process certain data to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Additional conditions such as the exercise of recordings in the public interest and the exercise of public power as well as the protection of vital interests do not usually occur with us. If such a legal basis should be relevant, it will be indicated at the appropriate place.

In addition to the EU regulation, national laws also apply:

• In Austria, this is the Federal Act on the Protection of Natural Persons in the Processing of Personal Data (Data Protection Act), short DSG.
• In Germany, the Federal Data Protection Act, short BDSG, applies.

If further regional or national laws apply, we will inform you about this in the following sections.

Contact Details of the Responsible Party

If you have questions about data protection or the processing of personal data, you will find the contact details of the responsible person or entity below:
Auer Pitztal GmbH
Mandarfen 23
6481 St. Leonhard im Pitztal
Austria

Email: info@andreashofer.at
Phone: +43 5413 / 862 14

Retention Period

We store personal data only as long as it is absolutely necessary for providing our services and products, which is considered a general criterion for us. This means that we delete personal data as soon as the reason for processing the data no longer exists. In some cases, we are legally obliged to retain certain data even after the original purpose has ceased, for example, for accounting purposes.

If you wish for the deletion of your data or revoke consent to data processing, the data will be deleted as quickly as possible and as long as there is no obligation to retain it.

We will inform you about the specific duration of each data processing further down, as far as we have further information on this.

Rights under the General Data Protection Regulation

According to Articles 13, 14 GDPR, we inform you about the following rights that you are entitled to, ensuring fair and transparent processing of data:

• You have the right to obtain information under Article 15 GDPR about whether we process data about you. If this is the case, you have the right to receive a copy of the data and to know the following information:
  • the purpose for which we carry out the processing;
  • the categories, i.e., the types of data being processed;
  • who receives this data and if the data is transferred to third countries, how security can be guaranteed;
  • how long the data is stored;
  • the existence of the right to rectification, deletion, or restriction of processing and the right to object to processing;
  • that you can complain to a supervisory authority (links to these authorities can be found further down);
  • the origin of the data if we did not collect it from you;
  • whether profiling is conducted, meaning whether data is evaluated automatically to create a personal profile of you.
• You have the right to rectification of data under Article 16 GDPR, which means that we must correct data if you find errors.
• You have the right to deletion under Article 17 GDPR ("right to be forgotten"), which means that you may request the deletion of your data.
• You have the right to restriction of processing under Article 18 GDPR, which means that we may only store the data but not further use it.
• You have the right to data portability under Article 20 GDPR, which means that we will provide your data in a common format upon request.
• You have the right to object under Article 21 GDPR, which leads to a change in processing after enforcement.
  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of public authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then check as quickly as possible whether we can legally comply with this objection.
  • If data is used for direct marketing, you can object to this type of data processing at any time. We may not use your data for direct marketing afterward.
  • If data is used for profiling, you can object to this type of data processing at any time. We may not use your data for profiling afterward.
• You have the right under Article 22 GDPR not to be subjected to a decision based solely on automated processing (for example, profiling).
• You have the right to complain under Article 77 GDPR. This means you can complain to the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short: You have rights – do not hesitate to contact the responsible party listed above!

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can complain to the supervisory authority. This is the data protection authority for Austria, whose website you can find at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

Austrian Data Protection Authority

Head: Dr. Matthias Schmidl
Address: Barichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Data Transfer to Third Countries

We transfer or process data only in countries outside the scope of the GDPR (third countries) if you consent to this processing or if there is another legal permission. This is particularly true if the processing is legally required or necessary for fulfilling a contractual relationship and in any case only to the extent that this is generally permitted. Your consent is usually the most important reason for us to process data in third countries. The processing of personal data in third countries such as the USA, where many software providers offer services and have server locations, may mean that personal data is processed and stored in unexpected ways.

We explicitly point out that, according to the opinion of the European Court of Justice, an adequate level of protection for data transfer to the USA currently exists only if a US company that processes personal data of EU citizens in the USA is an active participant in the EU-US Data Privacy Framework. More information on this can be found at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

The data processing by US services that are not active participants in the EU-US Data Privacy Framework may mean that data may not be processed and stored anonymously. Furthermore, it may happen that US government authorities may access individual data. Additionally, it may occur that collected data is linked to data from other services of the same provider, provided you have a corresponding user account. Whenever possible, we try to use server locations within the EU, provided this is offered.
We will inform you in more detail about data transfer to third countries at the appropriate points in this privacy policy, if applicable.

Data Processing Security

To protect personal data, we have implemented both technical and organizational measures. Wherever possible, we encrypt or pseudonymize personal data. This makes it as difficult as possible for third parties to deduce personal information from our data.

Art. 25 GDPR refers to "data protection by design and by default" and means that one always thinks of security both in software (e.g., forms) and hardware (e.g., access to the server room) and implements appropriate measures. Below, we will go into specific measures if necessary.

TLS Encryption with HTTPS

TLS, encryption, and HTTPS sound very technical, and they are. We use HTTPS (the Hypertext Transfer Protocol Secure stands for "secure hypertext transfer protocol") to transmit data securely over the internet.
This means that the complete transmission of all data from your browser to our web server is secured – no one can "listen in".

With this, we have introduced an additional layer of security and comply with data protection by design (Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission over the internet, we can ensure the protection of confidential data.
You can recognize the use of this data transmission security by the small padlock symbol at the top left of the browser, to the left of the internet address (e.g., example.com) and the use of the https scheme (instead of http) as part of our internet address.
If you want to know more about encryption, we recommend searching Google for “Hypertext Transfer Protocol Secure wiki” to find good links to further information.

Communication

Communication Summary 👥 Affected: All who communicate with us via phone, email, or online form 📓 Processed Data: e.g., phone number, name, email address, entered form data. More details can be found with the respective contact method 🤝 Purpose: Handling communication with customers, business partners, etc. 📅 Retention Period: Duration of the business case and legal requirements ⚖️ Legal Bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(b) GDPR (Contract), Art. 6(1)(f) GDPR (Legitimate Interests)

If you contact us and communicate via phone, email, or online form, personal data may be processed.

The data will be processed for handling and processing your inquiry and the associated business transaction. The data will be stored as long as necessary or as long as required by law.

Affected Persons

All those affected are those who seek contact with us through the communication channels we provide.

Phone

If you call us, the call data will be pseudonymized and stored on the respective device and with the telecommunications provider used. Additionally, data such as name and phone number may be sent via email afterward and stored for answering inquiries. The data will be deleted as soon as the business case is completed and legal requirements allow.

Email

If you communicate with us via email, data may be stored on the respective device (computer, laptop, smartphone, etc.) and there may be data storage on the email server. The data will be deleted as soon as the business case is completed and legal requirements allow.

Online Forms

If you communicate with us via online form, data will be stored on our web server and may be forwarded to an email address of ours. The data will be deleted as soon as the business case is completed and legal requirements allow.

Legal Bases

The processing of data is based on the following legal bases:

• Art. 6(1)(a) GDPR (Consent): You give us consent to store your data and further use it for business-related purposes;
• Art. 6(1)(b) GDPR (Contract): There is a necessity for fulfilling a contract with you or a processor, such as the telephone provider, or we must process the data for pre-contractual activities, such as preparing an offer;
• Art. 6(1)(f) GDPR (Legitimate Interests): We want to handle customer inquiries and business communication in a professional manner. For this, certain technical facilities such as email programs, exchange servers, and mobile network operators are necessary to operate communication efficiently.

Data Processing Agreement (DPA)

In this section, we would like to explain what a Data Processing Agreement is and why it is needed. Because the term “Data Processing Agreement” is quite a mouthful, we will often use the acronym DPA in the text. Like most companies, we do not work alone but also engage services from other companies or individuals. By involving various companies or service providers, we may share personal data for processing. These partners act as processors with whom we conclude a contract, the so-called Data Processing Agreement (DPA). The most important thing for you to know is that the processing of your personal data occurs solely according to our instructions and must be regulated by the DPA.

Who are Processors?

We, as a company and website owner, are responsible for all data we process from you. In addition to the controllers, there may also be so-called processors. This includes any company or person that processes personal data on our behalf. More specifically, according to the GDPR definition: any natural or legal person, authority, agency, or other body that processes personal data on our behalf is considered a processor. Processors can thus be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies like Google or Microsoft.

For better understanding of the terminology, here is an overview of the three roles in the GDPR:

Data Subject (You as a customer or interested party) → Controller (we as a company and client) → Processor (service providers such as web hosters or cloud providers)

Content of a Data Processing Agreement

As mentioned above, we have concluded a DPA with our partners who act as processors. It primarily states that the processor processes the data to be processed exclusively in accordance with the GDPR. The contract must be concluded in writing; however, electronic contract conclusion is also considered “written” in this context. Only on the basis of the contract does the processing of personal data take place. The contract must include the following:

• Obligation to us as the controller
• Duties and rights of the controller
• Categories of data subjects
• Type of personal data
• Nature and purpose of the data processing
• Subject matter and duration of the data processing
• Location of the data processing

Furthermore, the contract contains all obligations of the processor. The most important obligations are:

• To ensure data security measures
• To take possible technical and organizational measures to protect the rights of the data subject
• To maintain a record of processing activities
• To cooperate with the data protection supervisory authority upon request
• To conduct a risk analysis regarding the personal data received
• Sub-processors may only be engaged with the written consent of the controller

You can see what a DPA looks like, for example, at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html. Here, a sample contract is presented.

Cookies

Cookies Summary 👥 Affected: Visitors to the website 🤝 Purpose: depending on the respective cookie. More details can be found further down or from the software manufacturer that sets the cookie. 📓 Processed Data: Depending on the respective cookie used. More details can be found further down or from the software manufacturer that sets the cookie. 📅 Retention Period: depending on the respective cookie, can vary from hours to years ⚖️ Legal Bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR (Legitimate Interests)

What are Cookies?

Our website uses HTTP cookies to store user-specific data.
Below, we explain what cookies are and why they are used so that you can better understand the following privacy policy.

Whenever you browse the internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer, and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing is undeniable: cookies are really useful helpers. Almost all websites use cookies. More specifically, they are HTTP cookies, as there are also other cookies for different applications. HTTP cookies are small files that are stored on your computer by our website. These cookie files are automatically placed in the cookie folder, essentially the “brain” of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.

Cookies store certain user data from you, such as language or personal page settings. When you revisit our site, your browser sends the “user-related” information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are accustomed to. In some browsers, each cookie has its own file, while in others, like Firefox, all cookies are stored in a single file.

The following graphic shows a possible interaction between a web browser like Chrome and the web server. In this, the web browser requests a website and receives a cookie back from the server, which the browser reuses as soon as another page is requested.

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiration time of a cookie also varies from a few minutes to several years. Cookies are not software programs and do not contain viruses, trojans, or other “malware.” Cookies also cannot access information on your PC.

For example, cookie data might look like this:

Name: _ga
Value: GA1.2.1326744211.152122845050-9
Purpose: Distinguishing website visitors
Expiration Date: after 2 years

These minimum sizes should be supported by a browser:

• At least 4096 bytes per cookie
• At least 50 cookies per domain
• At least 3000 cookies in total

What Types of Cookies Are There?

The question of which cookies we specifically use depends on the services used and will be clarified in the following sections of the privacy policy. At this point, we would like to briefly address the different types of HTTP cookies.

There are 4 types of cookies that can be distinguished:

Essential Cookies
These cookies are necessary to ensure basic functions of the website. For example, these cookies are needed when a user adds a product to the shopping cart, continues browsing on other pages, and later proceeds to checkout. These cookies prevent the shopping cart from being deleted even if the user closes their browser window.

Functional Cookies
These cookies collect information about user behavior and whether the user receives any error messages. Additionally, these cookies measure the loading time and behavior of the website on different browsers.

Targeted Cookies
These cookies enhance user-friendliness. For example, they store entered locations, font sizes, or form data.

Advertising Cookies
These cookies are also called targeting cookies. They are used to deliver individually tailored advertising to the user. This can be very convenient but also quite annoying.

Typically, you will be asked during your first visit to a website which of these types of cookies you would like to allow. Of course, this decision will also be stored in a cookie.

If you want to know more about cookies and are not afraid of technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments from the Internet Engineering Task Force (IETF) titled “HTTP State Management Mechanism.”

Purpose of Processing via Cookies

The purpose ultimately depends on the respective cookie. More details can be found further down or from the software manufacturer that sets the cookie.

What Data is Processed?

Cookies are small helpers for many different tasks. Unfortunately, it is not possible to generalize what data is stored in cookies, but we will inform you about the processed or stored data in the following privacy policy.

Retention Period of Cookies

The retention period depends on the respective cookie and will be specified further down. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.

You also have an influence on the retention period. You can manually delete all cookies at any time through your browser (see also “Right to Object” below). Furthermore, cookies based on consent will be deleted at the latest after the withdrawal of your consent, with the legality of the storage remaining unaffected until then.

Right to Object – How Can I Delete Cookies?

How and whether you want to use cookies is entirely up to you. Regardless of which service or website the cookies come from, you always have the option to delete, disable, or only partially allow cookies. For example, you can block third-party cookies but allow all other cookies.

If you want to find out which cookies are stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings:

Chrome: Delete, enable, and manage cookies in Chrome

Safari: Manage cookies and website data with Safari

Firefox: Delete cookies to remove data that websites have stored on your computer

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete and manage cookies

If you generally do not want any cookies, you can set your browser to always inform you when a cookie is to be set. This way, you can decide for each individual cookie whether to allow it or not. The procedure varies depending on the browser. It is best to search Google for instructions with the search term “delete cookies Chrome” or “disable cookies Chrome” if you are using the Chrome browser.

Legal Basis

Since 2009, there have been so-called “cookie regulations.” These state that storing cookies requires consent (Article 6(1)(a) GDPR) from you. However, there are still very different reactions to these regulations in EU countries. In Austria, the implementation of this regulation occurred in § 165(3) of the Telecommunications Act (2021). In Germany, the cookie regulations were not implemented as national law. Instead, the implementation of this regulation largely occurred in § 15(3) of the Telemedia Act (TMG), which has been replaced by the Digital Services Act (DDG) since May 2024.

For absolutely necessary cookies, even in the absence of consent, there are legitimate interests (Article 6(1)(f) GDPR), which are mostly of an economic nature. We want to provide website visitors with a pleasant user experience, and for this, certain cookies are often absolutely necessary.

Where non-essential cookies are used, this only occurs with your consent. The legal basis in this respect is Article 6(1)(a) GDPR.

In the following sections, you will be informed in more detail about the use of cookies, provided that the deployed software uses cookies.

Web Hosting Introduction

Web Hosting Summary 👥 Affected: Visitors to the website 🤝 Purpose: Professional hosting of the website and securing operations 📓 Processed Data: IP address, time of website visit, browser used, and other data. More details can be found further down or with the respective web hosting provider. 📅 Retention Period: Depending on the provider, but usually 2 weeks ⚖️ Legal Bases: Art. 6(1)(f) GDPR (Legitimate Interests)

What is Web Hosting?

When you visit websites today, certain information – including personal data – is automatically created and stored, including on this website. This data should be processed as sparingly as possible and only for justified reasons. By "website," we mean the entirety of all web pages on a domain, i.e., everything from the homepage to the very last subpage (like this one). By "domain," we mean, for example, example.com or samplewebsite.com.

When you want to view a website on a computer, tablet, or smartphone, you use a program called a web browser. You probably know some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. We refer to them briefly as browsers or web browsers.

To display the website, the browser must connect to another computer where the website's code is stored: the web server. Operating a web server is a complicated and demanding task, which is why it is usually handled by professional providers. These offer web hosting and ensure reliable and error-free storage of website data. A lot of technical terms, but please hang in there; it gets better!

During the connection of the browser on your computer (desktop, laptop, tablet, or smartphone) and while transferring data to and from the web server, personal data may be processed. On one hand, your computer stores data, and on the other hand, the web server must also store data for some time to ensure proper operation.

A picture is worth a thousand words, so the following graphic illustrates the interplay between the browser, the internet, and the hosting provider.

Why Do We Process Personal Data?

The purposes of data processing are:

1. Professional hosting of the website and securing operations
2. To maintain operational and IT security
3. Anonymous evaluation of access behavior to improve our offerings and possibly for prosecution or enforcement of claims

What Data is Processed?

Even while you are currently visiting our website, our web server – the computer on which this website is stored – typically automatically saves data such as

• the complete internet address (URL) of the visited webpage
• browser and browser version (e.g., Chrome 87)
• the operating system used (e.g., Windows 10)
• the address (URL) of the previously visited page (Referrer URL) (e.g., https://www.beispielquellsite.de/vondabinichgekommen/)
• the hostname and the IP address of the device from which access is made (e.g., COMPUTERNAME and 194.23.43.121)
• date and time
• in files, the so-called web server log files

How Long is Data Stored?

In general, the above-mentioned data is stored for two weeks and then automatically deleted. We do not share this data; however, we cannot rule out that this data may be accessed by authorities in the event of unlawful behavior.

In short: Your visit is logged by our provider (the company that runs our website on special computers (servers)), but we do not share your data without consent!

Legal Basis

The legality of processing personal data in the context of web hosting arises from Art. 6(1)(f) GDPR (preservation of legitimate interests), as the use of professional hosting with a provider is necessary to present the company on the internet securely and user-friendly and to possibly pursue attacks and claims.

Between us and the hosting provider, there is usually a contract for data processing according to Art. 28 GDPR, which ensures compliance with data protection and guarantees data security.

External Hosting Provider Privacy Policy

Below you will find the contact details of our external hosting provider, where you can learn more about data processing in addition to the information above:

LANTECH
Bruggfeldstrasse 5, 6500 Landeck, Austria

Learn more about data processing with this provider in the Privacy Policy.

Website Builder Systems Introduction

Website Builder Systems Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Optimization of our service 📓 Processed Data: Data such as technical usage information like browser activity, clickstream activities, session heatmaps, as well as contact data, IP address, or your geographical location. More details can be found further down in this privacy policy and in the privacy policies of the providers. 📅 Retention Period: Depends on the provider ⚖️ Legal Bases: Art. 6(1)(f) GDPR (Legitimate Interests), Art. 6(1)(a) GDPR (Consent)

What are Website Builder Systems?

We use a website builder system for our website. Builder systems are special forms of a content management system (CMS). With a builder system, website operators can easily create a website without programming knowledge. In many cases, web hosts also offer builder systems. By using a builder system, personal data from you can also be collected, stored, and processed. In this privacy text, we provide you with general information about data processing through builder systems. More detailed information can be found in the privacy policies of the provider.

Why Do We Use Website Builder Systems for Our Website?

The biggest advantage of a builder system is its ease of use. We want to provide you with a clear, simple, and user-friendly website that we can manage and maintain ourselves – without external support. A builder system now offers many helpful functions that we can also apply without programming knowledge. This allows us to design our web presence according to our wishes and provide you with an informative and pleasant experience on our website.

What Data is Stored by a Builder System?

What data is stored depends on the specific website builder system used. Each provider processes and collects different data from website visitors. However, in general, technical usage information such as operating system, browser, screen resolution, language and keyboard settings, hosting provider, and the date of your website visit are collected. Additionally, tracking data (e.g., browser activity, clickstream activities, session heatmaps, etc.) may also be processed. Furthermore, personal data may also be collected and stored, usually including contact data such as email address, phone number (if provided), IP address, and geographical location data. Specific data that is stored can be found in the privacy policy of the provider.

How Long and Where is Data Stored?

We will inform you about the duration of data processing further down in connection with the website builder system used, if we have further information on this. Detailed information can be found in the privacy policy of the provider. In general, we only process personal data as long as it is absolutely necessary for providing our services and products. The provider may store data from you according to their own criteria, which we have no influence over.

Right to Object

You always have the right to access, correct, and delete your personal data. If you have any questions, you can also contact the responsible parties of the website builder system used at any time. Contact details can be found either in our privacy policy or on the website of the respective provider.

Cookies used by providers for their functions can be deleted, disabled, or managed in your browser. Depending on which browser you use, this works in different ways. Please note that some functions may not work as usual if you do this.

Legal Basis

We have a legitimate interest in using a website builder system to optimize our online service and present it efficiently and appealingly to you. The corresponding legal basis is Art. 6(1)(f) GDPR (Legitimate Interests). We only use the builder to the extent that you have given consent.

Where the processing of data is not absolutely necessary for the operation of the website, the data will only be processed based on your consent. This particularly concerns tracking activities. The legal basis in this respect is Art. 6(1)(a) GDPR.

With this privacy policy, we have provided you with the most important general information regarding data processing. If you want to learn more about this, you can find further information – if available – in the following section or in the privacy policy of the provider.

WordPress.com Privacy Policy

WordPress.com Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Optimization of our service 📓 Processed Data: Data such as technical usage information like browser activity, clickstream activities, session heatmaps, as well as contact data, IP address, or your geographical location. More details can be found further down in this privacy policy. 📅 Retention Period: It mainly depends on the type of stored data and the specific settings. ⚖️ Legal Bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR (Legitimate Interests)

What is WordPress?

We use the well-known content management system WordPress.com for our website. The service provider is the American company Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.

The company was founded in 2003 and quickly developed into one of the most well-known content management systems (CMS) worldwide. A CMS is software that helps us design our website and present content beautifully and orderly. The content can include text, audio, and video.
By using WordPress, personal data from you can also be collected, stored, and processed. Typically, mainly technical data such as operating system, browser, screen resolution, or hosting provider are stored. However, personal data such as IP address, geographical data, or contact data can also be processed.

Why Do We Use WordPress on Our Website?

We have many strengths, but real programming is not one of our core competencies.

Nevertheless, we want to have a powerful and attractive website that we can manage and maintain ourselves. With a website builder system or a content management system like WordPress, this is exactly possible. With WordPress, we do not have to be programming experts to provide you with a beautiful website. Thanks to WordPress, we can operate our website quickly and easily without technical knowledge. If technical problems arise or we have specific requests for our website, we still have our specialists who are at home in HTML, PHP, CSS, and more.

Through the ease of use and comprehensive functions of WordPress, we can design our web presence according to our wishes and provide you with good user-friendliness.

What Data is Processed by WordPress?

Non-personal data includes technical usage information such as browser activity, clickstream activities, session heatmaps, and data about your computer, operating system, browser, screen resolution, language and keyboard settings, internet provider, as well as the date of your visit.

Additionally, personal data is also collected. This primarily includes contact data (email address or phone number, if provided), IP address, or your geographical location.

WordPress may also use cookies to collect data. These often include data about your behavior on our website. For example, it can track which subpages you particularly like to view, how long you stay on individual pages, when you leave a page (bounce rate), or what preferences (e.g., language selection) you have made. Based on this data, WordPress can also better tailor its marketing measures to your interests and user behavior. The next time you visit our website, it will be displayed to you as you previously set it up.

WordPress may also use technologies such as pixel tags (web beacons) to identify you as a user clearly and possibly offer interest-based advertising.

How Long and Where is Data Stored?

How long the data is stored depends on various factors. It mainly depends on the type of stored data and the specific settings of the website. In principle, data at WordPress is deleted when it is no longer needed for its purposes. There are, of course, exceptions, especially when legal obligations prescribe longer retention of data. Web server logs containing your IP address and technical data are deleted by WordPress or Automattic after 30 days. Automattic uses the data for analyzing traffic on its websites (for example, all WordPress sites) and to resolve possible issues. Deleted content on WordPress websites is also kept in the trash for 30 days to allow for recovery; after that, it may remain in backups and caches until they are deleted. The data is stored on American servers by Automattic.

How Can I Delete My Data or Prevent Data Storage?

You have the right and opportunity at any time to access your personal data and object to its use and processing. You can also file a complaint with a state supervisory authority at any time.

In your browser, you also have the option to manage, delete, or disable cookies individually. However, please note that disabled or deleted cookies may have negative effects on the functions of our WordPress site. Depending on which browser you use, managing cookies works slightly differently. In the “Cookies” section, you will find the relevant links to the respective instructions for the most well-known browsers.

Legal Basis

If you have consented to the use of WordPress, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (Consent), this consent serves as the legal basis for processing personal data, as may occur during collection by WordPress.

From our side, there is also a legitimate interest in using WordPress to optimize our online service and present it beautifully for you. The corresponding legal basis is Art. 6(1)(f) GDPR (Legitimate Interests). We only use WordPress to the extent that you have given consent.

WordPress or Automattic processes data from you, among other things, in the USA. Automattic is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. More information on this can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Additionally, Automattic uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are templates provided by the EU Commission to ensure that your data still complies with European data protection standards when it is transferred and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Automattic commits to adhering to the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an EU Commission implementation decision. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

More details about the privacy policy and what data is processed by WordPress can be found at https://automattic.com/privacy/.

Web Analytics Introduction

Web Analytics Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Evaluation of visitor information to optimize the web offering. 📓 Processed Data: Access statistics, including data such as access locations, device data, access duration and time, navigation behavior, click behavior, and IP addresses. More details can be found in the respective web analytics tool used. 📅 Storage Duration: Depends on the web analytics tool used ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Web Analytics?

We use software on our website to analyze the behavior of website visitors, known as web analytics. Data is collected, stored, managed, and processed by the respective analytics tool provider (also called tracking tool). The data helps create analyses of user behavior on our website, which are made available to us as website operators. Most tools also offer various testing options. For example, we can test which offers or content our visitors prefer. We show you two different offers for a limited period. After the test (so-called A/B test), we know which product or content our website visitors find more interesting. User profiles can also be created, and data can be stored in cookies for such test procedures and other analytics processes.

Why do we perform Web Analytics?

Our website has a clear goal: we want to provide the best web offering in our industry. To achieve this goal, we want to offer the best and most interesting content while ensuring that you feel completely comfortable on our website. Web analytics tools help us closely examine our website visitors' behavior, allowing us to improve our web offering for you and ourselves. For example, we can identify the average age of our visitors, where they come from, when our website is most visited, or which content or products are particularly popular. All this information helps us optimize the website to best suit your needs, interests, and wishes.

What data is processed?

The specific data stored depends on the analytics tools used. Generally, data such as which content you view on our website, which buttons or links you click, when you access a page, which browser you use, which device (PC, tablet, smartphone, etc.) you use to visit the website, or which operating system you use is stored. If you have agreed that location data may be collected, this can also be processed by the web analytics tool provider.

Your IP address is also stored. According to the General Data Protection Regulation (GDPR), IP addresses are considered personal data. However, your IP address is usually stored in a pseudonymized form (i.e., in an unrecognizable and shortened form). For tests, web analysis, and web optimization purposes, direct data such as your name, age, address, or email address is not stored. All these data, if collected, are stored in a pseudonymized manner, so you cannot be identified as a person.

The following example shows schematically how Google Analytics works as an example of client-based web tracking with JavaScript code.

The duration of data storage always depends on the provider. Some cookies store data for just a few minutes or until you leave the website, while other cookies can store data for several years.

Duration of Data Processing

We will inform you about the duration of data processing below if we have further information. Generally, we only process personal data as long as it is necessary for providing our services and products. This storage duration can also be exceeded if required by law, as in the case of accounting.

Right to Object

You always have the right and the opportunity to withdraw your consent to the use of cookies or third-party providers. This can be done via our cookie management tool or other opt-out functions. For example, you can also prevent data collection through cookies by managing, deactivating, or deleting cookies in your browser.

Legal Basis

The use of web analytics requires your consent, which we obtained through our cookie popup. This consent constitutes the legal basis for the processing of personal data, as can occur when using web analytics tools, according to Art. 6 para. 1 lit. a GDPR (Consent).

Additionally, we have a legitimate interest in analyzing the behavior of website visitors and thus improving our offering technically and economically. Web analytics help us identify website errors, detect attacks, and improve profitability. The legal basis for this is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). However, we only use the tools if you have given your consent.

Since web analytics tools use cookies, we also recommend reading our general privacy policy on cookies. To find out which data is specifically stored and processed, you should read the privacy policies of the respective tools.

Information on specific web analytics tools can be found in the following sections, if available.

Google Analytics Privacy Policy

Google Analytics Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Evaluation of visitor information to optimize the web offering. 📓 Processed Data: Access statistics, including data such as access locations, device data, access duration and time, navigation behavior, and click behavior. More details can be found further down in this privacy policy. 📅 Storage Duration: Customizable, by default Google Analytics 4 stores data for 14 months ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Google Analytics?

We use the analytics tracking tool Google Analytics in the version Google Analytics 4 (GA4) from the American company Google Inc. For the European region, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your actions on our website. By combining various technologies such as cookies, device IDs, and login information, you can be identified as a user across different devices. This allows your actions to be analyzed across platforms.

For example, if you click on a link, this event is stored in a cookie and sent to Google Analytics. The reports we receive from Google Analytics help us better tailor our website and service to your needs. Below, we will provide more details on the tracking tool and inform you about the data processed and how you can prevent this.

Google Analytics is a tracking tool used to analyze our website's data traffic. The basis of these measurements and analyses is a pseudonymous user identification number. This number does not contain personal data such as name or address but is used to assign events to a device. GA4 uses an event-based model that captures detailed information about user interactions, such as page views, clicks, scrolling, and conversion events. Additionally, GA4 includes various machine learning functions to better understand user behavior and certain trends. GA4 uses modeling to extrapolate missing data based on collected data to optimize the analysis and provide forecasts.

To make Google Analytics work, a tracking code is embedded in the code of our website. When you visit our website, this code records various events you perform on our website. With GA4's event-based data model, we as website operators can define and track specific events to obtain analyses of user interactions. Thus, in addition to general information such as clicks or page views, special events that are important for our business can also be tracked. Such special events can include submitting a contact form or purchasing a product.

When you leave our website, this data is sent to the Google Analytics servers and stored there.

Google processes the data and provides us with reports on your user behavior. These can include, among others, the following reports:

• Audience Reports: We learn more about our users and know more precisely who is interested in our service.
• Ad Reports: We can more easily analyze and improve our online advertising.
• Acquisition Reports: We receive valuable information on how to attract more people to our service.
• Behavior Reports: We learn how you interact with our website, tracing your path through our site and which links you click.
• Conversion Reports: Conversion refers to an action you take based on a marketing message, such as becoming a buyer or newsletter subscriber. These reports help us understand how our marketing measures affect you and aim to increase our conversion rate.
• Real-time Reports: We can see what is happening on our website in real-time, such as how many users are currently reading this text.

In addition to the analysis reports mentioned above, Google Analytics 4 also offers the following features:

• Event-based Data Model: This model captures specific events that can occur on our website, such as playing a video, purchasing a product, or signing up for our newsletter.
• Advanced Analysis Features: These features help us better understand your behavior on our website or certain general trends. For example, we can segment user groups, perform comparative analyses of target groups, or trace your path on our website.
• Predictive Modeling: Using collected data, machine learning can extrapolate missing data to predict future events and trends, helping us develop better marketing strategies.
• Cross-platform Analysis: Data can be collected and analyzed from both websites and apps, allowing us to analyze user behavior across platforms, provided you have consented to data processing.

Why do we use Google Analytics on our website?

Our goal with this website is clear: We want to provide you with the best possible service. The statistics and data from Google Analytics help us achieve this goal.

The statistically evaluated data provides a clear picture of our website's strengths and weaknesses. On the one hand, we can optimize our site to be easily found by interested people on Google. On the other hand, the data helps us understand you as a visitor better. We know precisely what we need to improve on our website to offer you the best possible service. The data also helps us make our advertising and marketing measures more individual and cost-effective. After all, it only makes sense to show our products and services to people who are interested in them.

What data is stored by Google Analytics?

Google Analytics generates a random, unique ID connected to your browser cookie using a tracking code. This way, Google Analytics recognizes you as a new user and assigns you a user ID. The next time you visit our site, you will be recognized as a "returning" user. All collected data is stored together with this user ID, allowing for the evaluation of pseudonymous user profiles.

To analyze our website with Google Analytics, a property ID must be included in the tracking code. The data is then stored in the corresponding property. For each new property created, the Google Analytics 4 property is the default. Data is stored for different lengths of time, depending on the property used.

Through identifiers such as cookies, app instance IDs, user IDs, or custom event parameters, your interactions are measured across platforms, provided you have consented. Interactions are all types of actions you take on our website. If you also use other Google systems (such as a Google account), data generated by Google Analytics can be linked to third-party cookies. Google does not share Google Analytics data unless we, as website operators, approve it. Exceptions can occur if required by law.

According to Google, no IP addresses are logged or stored in Google Analytics 4. However, Google uses IP address data for deriving location data and then deletes it immediately. All IP addresses collected from users in the EU are deleted before being stored in a data center or server.

As Google Analytics 4 focuses on event-based data, the tool uses significantly fewer cookies than previous versions (such as Google Universal Analytics). Nevertheless, GA4 uses some specific cookies, including:

Name: _ga
Value: 2.1326744211.152122845050-5
Purpose: By default, analytics.js uses the _ga cookie to store the User ID. It is generally used to distinguish website visitors.
Expiration Date: after 2 years

Name: _gid
Value: 2.1687193234.152122845050-1
Purpose: This cookie is also used to distinguish website visitors.
Expiration Date: after 24 hours

Name: _gat_gtag_UA_<property-id>
Value: 1
Purpose: It is used to throttle the request rate. When Google Analytics is provided via Google Tag Manager, this cookie is named _dc_gtm_<property-id>.
Expiration Date: after 1 minute

Note: This list cannot claim to be complete as Google changes its choice of cookies from time to time. The aim of GA4 is also to improve data protection. Therefore, the tool offers several options for controlling data collection. For example, we can set the storage duration ourselves and also control data collection.

Here we provide an overview of the most important types of data collected by Google Analytics:

Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly which areas you click on. This way, we get information about where you are "moving" on our page.

Session Duration: Google defines session duration as the time you spend on our site without leaving it. If you have been inactive for 20 minutes, the session ends automatically.

Bounce Rate: A bounce occurs when you view only one page on our website and then leave our website.

Account Creation: If you create an account or place an order on our website, Google Analytics collects this data.

Location: IP addresses are not logged or stored in Google Analytics. However, location data derivations are used before the IP address is deleted.

Technical Information: Technical information includes, among other things, your browser type, your internet provider, or your screen resolution.

Source of Origin: Google Analytics or we are also interested in which website or which advertisement you came from to our site.

Other data include contact information, any ratings, media playback (e.g., if you play a video on our site), sharing content via social media, or adding to your favorites. This list does not claim to be complete and serves only as a general orientation on data storage by Google Analytics.

How long and where is the data stored?

Google has servers distributed all over the world. You can read exactly where Google's data centers are located here: https://www.google.com/about/datacenters/locations/?hl=de

Your data is distributed across various physical media. This has the advantage that the data is retrievable more quickly and better protected against manipulation. Each Google data center has appropriate emergency programs for your data. For example, if Google's hardware fails or natural disasters paralyze servers, the risk of a service interruption at Google remains low.

The retention period of the data depends on the properties used. The storage duration is always set individually for each property. Google Analytics offers us four options to control the storage duration:

• 2 months: This is the shortest storage duration.
• 14 months: By default, the data is stored in GA4 for 14 months.
• 26 months: Data can also be stored for 26 months.
• Data is only deleted when we delete it manually.

There is also an option for data to be deleted only if you no longer visit our website within the chosen period. In this case, the retention period is reset each time you visit our website within the specified period.

When the specified period expires, the data is deleted once a month. This retention period applies to your data linked with cookies, user recognition, and advertising IDs (e.g., cookies from the DoubleClick domain). Report results are based on aggregated data and are stored independently of user data. Aggregated data is a merging of individual data into a larger unit.

How can I delete my data or prevent data storage?

Under European Union data protection law, you have the right to access, update, delete, or restrict your data. With the browser add-on for deactivating Google Analytics JavaScript (analytics.js, gtag.js), you prevent Google Analytics 4 from using your data. You can download and install the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de. Please note that this add-on only disables data collection by Google Analytics.

If you want to disable, delete, or manage cookies in general, you will find the corresponding links to the instructions for the most well-known browsers in the "Cookies" section.

Legal Basis

The use of Google Analytics requires your consent, which we obtained through our cookie popup. This consent constitutes the legal basis for the processing of personal data, as can occur when using web analytics tools, according to Art. 6 para. 1 lit. a GDPR (Consent).

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors and thus improving our offering technically and economically. With the help of Google Analytics, we can identify website errors, detect attacks, and improve profitability. The legal basis for this is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). We only use Google Analytics to the extent that you have given your consent.

Google processes data from you in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the proper and secure data transfer of personal data of EU citizens to the USA. You can find more information about this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Google also uses so-called standard contractual clauses (= Art. 46 para. 2 and 3 GDPR). Standard contractual clauses (SCC) are sample templates provided by the EU Commission and are intended to ensure that your data also meets European data protection standards when it is transferred to third countries (such as the USA) and stored there. Through the EU-US Data Privacy Framework and the standard contractual clauses, Google is committed to complying with the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

We hope we have provided you with the most important information about data processing by Google Analytics. If you want to learn more about the tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.

If you want to learn more about data processing, please refer to Google's privacy policy at https://policies.google.com/privacy?hl=de.

Google Analytics Data Processing Agreement (DPA)

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have entered into a data processing agreement (DPA) with Google. You can read what a DPA is and what must be included in a DPA in our general section "Data Processing Agreement (DPA)".

This contract is legally required because Google processes personal data on our behalf. It stipulates that Google may only process data it receives from us according to our instructions and must comply with the GDPR. You can find the link to the data processing terms at https://business.safety.google/intl/de/adsprocessorterms/

Google Analytics Demographics and Interests Reports

We have enabled the advertising reporting features in Google Analytics. The demographic and interest reports include information on age, gender, and interests. This allows us to get a better picture of our users without being able to assign this data to individual persons. You can learn more about the advertising features at https://support.google.com/analytics/answer/3450482?hl=de_AT&utm_id=ad.

You can end the use of activities and information from your Google account under "Ad Settings" at https://adssettings.google.com/authenticated by unchecking the checkbox.

Google Analytics in Consent Mode

Depending on your consent, personal data about you is processed by Google Analytics in the so-called Consent Mode. You can choose whether to agree to Google Analytics cookies or not. This also determines which data Google Analytics is allowed to process from you. The data collected is mainly used to perform measurements on user behavior on the website, serve targeted advertising, and provide us with web analysis reports. Generally, you consent to data processing by Google through a cookie consent tool. If you do not consent to data processing, only aggregated data is collected and processed. This means that data cannot be assigned to individual users, and no user profile is created from you. You can also consent only to statistical measurement. In this case, no personal data is processed and, consequently, not used for advertising or ad measurement success.

Google Analytics IP Anonymization

We have implemented Google Analytics IP address anonymization on this website. This feature was developed by Google to ensure this website complies with the applicable data protection regulations and recommendations of local data protection authorities when they prohibit the storage of the full IP address. The anonymization or masking of IP addresses occurs as soon as the IP addresses arrive in the Google Analytics data collection network and before any storage or processing of the data takes place.

For more information about IP anonymization, please visit https://support.google.com/analytics/answer/2763052?hl=de.

Matomo Cloud Privacy Policy

Matomo Cloud Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Evaluation of visitor information to optimize the web offering. 📓 Processed Data: Access statistics, including data such as access locations, device data, access duration and time, navigation behavior, click behavior, and IP addresses. 📅 Storage Duration: until the data is no longer required for the service. ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Matomo Cloud?

We use the web analytics software Matomo Cloud on our website. The service provider is the New Zealand company InnoCraft Ltd, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand.

Matomo is a web analytics platform that takes data protection very seriously while still providing us as website operators with accurate statistics about your behavior on our website. We have access to a Matomo dashboard and can use various web analytics features. Matomo also offers various options for anonymizing IP addresses of our website visitors and disabling cookies.

Why do we use Matomo Cloud?

Many of the common analytics tools collect vast amounts of personal data and can also share it with third parties. This means that maintaining control over your data is very difficult. Data protection is very important to us, which is why we chose Matomo, a significantly more privacy-friendly alternative. However, we do not want to completely forego web analysis. After all, we can optimize our service with the help of statistics on website behavior and tailor it to your individual needs.

What data is stored by Matomo Cloud?

In addition to personal data such as your IP address or information about yourself (e.g., name, address, date of birth) that you actively provide to us, primarily information about your visitor behavior is stored. This is usually not personal data but information such as the number of visitors to the website, page views, duration of stay, or search terms used. Technical data such as browser type, operating system used, and screen resolution can also be stored. Matomo can also collect information about which website you came from to us. The collected data is never shared with or sold to third parties.

How long and where is the data stored?

Matomo offers a hosted version called "Matomo Cloud," where data is stored on Matomo's servers. All data is stored in Europe, even though the main office is in New Zealand.

In general, the data in Matomo Cloud is stored as long as business purposes require. Unfortunately, we cannot provide exact retention periods at this point as they depend heavily on individual configurations.

How can I delete my data or prevent data storage?

You always have the right and the opportunity to access your personal data and object to the use and processing of this data. You can also file a complaint with a state supervisory authority at any time.

You can also manage, delete, or deactivate cookies individually in your browser. Please note that deactivated or deleted cookies may have negative effects on the functions of our website. Depending on which browser you use, managing cookies works a little differently. You can find the corresponding links to the instructions of the most well-known browsers in the "Cookies" section. If you want to request data deletion, you can also contact us.

Legal Basis

The use of Matomo Cloud requires your consent, which we obtained through our consent management tool (popup). This consent constitutes the legal basis for the processing of personal data, as can occur when using web analytics tools, according to Art. 6 para. 1 lit. a GDPR (Consent).

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors and thus improving our offering technically and economically. With the help of Matomo Cloud, we can identify optimization potential for our website and improve profitability. The legal basis for this is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). We only use Matomo Cloud to the extent that you have given your consent.

For more information about the data processed by Matomo Cloud, please refer to the privacy policy at https://matomo.org/matomo-cloud-privacy-policy/. Questions about data protection can be addressed by email to privacy@matomo.org.

Email Marketing Introduction

Email Marketing Summary 👥 Affected: Newsletter subscribers 🤝 Purpose: Direct advertising via email, notification of system-relevant events 📓 Processed Data: Data entered during registration, but at least the email address. More details can be found in the respective email marketing tool. 📅 Storage Duration: Duration of the subscription ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Email Marketing?

To keep you informed, we also use the possibility of email marketing. If you have agreed to receive our emails or newsletters, your data will be processed and stored. Email marketing is a sub-area of online marketing. It involves sending news or general information about a company, products, or services via email to a specific group of people who are interested.

If you want to participate in our email marketing (usually via newsletter), you generally need to register with your email address. To do this, you fill out an online form and submit it. It may also happen that we ask for your salutation and name so that we can address you personally.

Generally, the registration for newsletters works with the so-called "double opt-in procedure." After registering for our newsletter on our website, you will receive an email to confirm your registration. This ensures that the email address belongs to you and that no one has registered with someone else's email address. We or a notification tool used by us logs each registration. This is necessary to prove the legally correct registration process. Usually, the registration time, confirmation time, and your IP address are stored. Additionally, any changes to your stored data are also logged.

Why do we use Email Marketing?

We want to stay in touch with you and keep you updated on the latest news about our company. Email marketing, often referred to as "newsletter," is an essential part of our online marketing. If you agree or if it is legally permitted, we send you newsletters, system emails, or other notifications via email. When we use the term "newsletter" in the following text, we primarily mean regularly sent emails. We aim not to bother you with our newsletters but to provide relevant and interesting content. You will learn more about our company, services, or products. As we continuously improve our offerings, you will always be informed about news or special, lucrative promotions via our newsletter. If we use a service provider offering a professional mailing tool for our email marketing, we do so to provide you with fast and secure newsletters. The purpose of our email marketing is to inform you about new offers and to achieve our business goals.

What data is processed?

If you become a subscriber to our newsletter via our website, you confirm your membership in an email list via email. In addition to the IP address and email address, your salutation, name, address, and phone number can also be stored if you agree to this data storage. The marked data is necessary for you to participate in the offered service. Providing it is voluntary, but failure to do so means you cannot use the service. Additionally, information about your device or your preferred content on our website can also be stored. More about data storage when you visit a website can be found in the section "Automatic Data Storage." We record your consent statement to prove it complies with our laws.

Duration of Data Processing

If you unsubscribe from our email/newsletter distribution list, we may store your address for up to three years based on our legitimate interests to prove your former consent. We may only process this data if we need to defend against any claims.

If you confirm that you have given consent for the newsletter registration, you can request deletion at any time. If you permanently object to the consent, we reserve the right to store your email address in a blacklist. As long as you voluntarily subscribe to our newsletter, we will, of course, retain your email address.

Right to Object

You have the option to cancel your newsletter registration at any time. To do this, you only need to withdraw your consent to the newsletter registration. This usually takes only a few seconds or one or two clicks. Most of the time, you will find a link at the end of each email to cancel the newsletter subscription. If the link in the newsletter is really not visible, please contact us by email, and we will immediately terminate your newsletter subscription.

Legal Basis

The sending of our newsletter is based on your consent (Article 6 para. 1 lit. a GDPR). This means we can only send you a newsletter if you have actively registered for it. We may also send you promotional messages if you have become our customer and have not objected to the use of your email address for direct advertising.

Information about specific email marketing services and how they process personal data can be found in the following sections, if available.

Newsletter - Service Provider

The newsletter is sent using the service provider NEWSTROLL - email marketing software, Maustäle 18, D 72793 Pfullingen. You can view the service provider's privacy policy here: https://www.newstroll.de/datenschutz/. The service provider is used based on our legitimate interests according to Art. 6 para. 1 lit. f GDPR and an order processing contract according to Art. 28 para. 3 sentence 1 GDPR.

The service provider can use the recipients' data in pseudonymous form, i.e., without assigning it to a user, to optimize or improve its own services, e.g., for technical optimization of sending and displaying the newsletters or for statistical purposes. However, the service provider does not use the data of our newsletter recipients to contact them themselves or to pass the data on to third parties.

Newsletter - Success Measurement

The newsletters contain a so-called "web beacon," i.e., a pixel-sized file that is retrieved from our server or, if we use a service provider, from their server when the newsletter is opened. During this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, is collected.

This information is used to improve the services technically based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our aim nor, if used, the service provider's aim to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

Push Notifications Introduction

Push Notifications Summary 👥 Affected: Push notification subscribers 🤝 Purpose: Notification of system-relevant and interesting events 📓 Processed Data: Data entered during registration, usually also location data. More details can be found in the respective push notification tool. 📅 Storage Duration: Data is usually stored as long as necessary to provide the services. ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. b GDPR (Contract)

What are Push Notifications?

We also use so-called push notification services on our website to keep our users always up to date. This means that if you have agreed to the use of such push notifications, we can send you short news via a software tool. Push notifications are a form of text messages that appear directly on your smartphone or other devices such as tablets or PCs if you have signed up for them. You receive these messages even if you are not on our website or actively using our offer. Data about your location and usage behavior can also be collected and stored.

Why do we use Push Notifications?

On the one hand, we use push notifications to fully deliver the services we have contractually agreed with you. On the other hand, the notifications also serve our online marketing. We can bring our services or products closer to you with the help of these messages. Especially when there is news in our company, we can inform you immediately. We want to know the preferences and habits of all our users as well as possible to continuously improve our offer.

What data is processed?

To receive push notifications, you must confirm that you want to receive these messages. The data collected during the consent process is stored, managed, and processed. This is necessary to prove and recognize that a user has agreed to receive push notifications. For this purpose, a so-called device token or push token is stored in your browser. Usually, your location data or the location of your used device is also stored.

To always send interesting and important push notifications, the handling of the messages is also statistically evaluated. For example, we can see whether and when you open the message. With the help of these insights, we can adapt our communication strategy to your wishes and interests. Although these stored data can be assigned to you, we do not want to check you as an individual. Rather, we are interested in the collected data of all our users so that we can make optimizations. You can find out what data is stored exactly in the privacy policies of the respective service providers.

Duration of Data Processing

How long the data is processed and stored depends primarily on the tool we use. You can find more about the data processing of the individual tools below. In the privacy policies of the providers, you will usually find exact information about how long the data is stored and processed. Generally, personal data is only processed as long as it is necessary to provide our services. When data is stored in cookies, the storage duration varies widely. The data can be deleted immediately after leaving a website or can be stored for several years. Therefore, you should look at each cookie in detail if you want to know more about data storage. Most of the time, you will also find informative details about individual cookies in the privacy policies of the individual providers.

Legal Basis

Push notifications may also be necessary to fulfill certain obligations stated in a contract. For example, to inform you about technical or organizational news. In this case, the legal basis is Art. 6 para. 1 lit. b GDPR.

If this is not the case, push notifications are only sent based on your consent. Our push notifications may particularly have promotional content. The push notifications can also be sent depending on your location displayed by your device. The analytical evaluations mentioned above are also based on your consent to receive such messages. The legal basis is Art. 6 para. 1 lit. a GDPR. Of course, you can revoke your consent at any time or change various settings in the settings.

Push Notifications - Service Provider

The push notification service is provided by PUSHPANDA - Project K GmbH, Richard-Wagner-Straße 9, A-6020 Innsbruck. You can view the service provider's privacy policy here: https://www.pushpanda.io/agb.

Cookie Consent Management Platform Introduction

Cookie Consent Management Platform Summary 👥 Affected: Website visitors 🤝 Purpose: Obtaining and managing consent for certain cookies and thus the use of certain tools 📓 Processed Data: Data to manage the set cookie settings such as IP address, time of consent, type of consent, individual consents. More details can be found in the respective tool. 📅 Storage Duration: Depends on the tool used, expect periods of several years ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is a Cookie Consent Management Platform?

We use a consent management platform (CMP) software on our website that makes it easier for us and you to handle the scripts and cookies used correctly and securely. The software automatically creates a cookie popup, scans and controls all scripts and cookies, provides a legally required cookie consent for you, and helps us and you keep track of all cookies. Most cookie consent management tools identify and categorize all existing cookies. You, as a website visitor, then decide for yourself whether and which scripts and cookies you want to allow or not. The following graphic shows the relationship between browser, web server, and CMP.

Why do we use a Cookie Management Tool?

Our goal is to provide you with the best possible transparency in the area of data protection. We are also legally obliged to do so. We want to inform you as best as possible about all tools and all cookies that can store and process data from you. It is also your right to decide for yourself which cookies you accept and which you do not. To grant you this right, we first need to know exactly which cookies have landed on our website. Thanks to a cookie management tool that regularly scans the website for all existing cookies, we are aware of all cookies and can inform you about them in compliance with the GDPR. Through the consent system, you can then accept or reject cookies.

What data is processed?

Within the framework of our cookie management tool, you can manage each cookie yourself and have full control over the storage and processing of your data. Your consent statement is stored so that we do not have to query you again on each new visit to our website and can prove your consent if legally required. This is stored either in an opt-in cookie or on a server. Depending on the provider of the cookie management tool, the storage duration of your cookie consent varies. Usually, this data (e.g., pseudonymous user ID, consent timestamp, detailed information on cookie categories or tools, browser, device information) is stored for up to two years.

Duration of Data Processing

We will inform you about the duration of data processing below if we have further information. Generally, we only process personal data as long as it is absolutely necessary for providing our services and products. Data stored in cookies is stored for different lengths of time. Some cookies are deleted after leaving the website, while others can be stored in your browser for several years. The exact duration of data processing depends on the tool used. In the respective privacy policies of the individual providers, you will usually find exact information about the duration of data processing.

Right to Object

You also have the right and the opportunity to revoke your consent to the use of cookies at any time. This can be done either via our cookie management tool or other opt-out functions. For example, you can also prevent data collection through cookies by managing, deactivating, or deleting cookies in your browser.

Information about specific cookie management tools can be found in the following sections, if available.

Legal Basis

If you agree to cookies, personal data will be processed and stored via these cookies. If we are allowed to use cookies based on your consent (Article 6 para. 1 lit. a GDPR), this consent is also the legal basis for the use of cookies and the processing of your data. A cookie consent management platform software is used to manage cookie consent and enable you to give consent. The use of this software enables us to operate the website efficiently and in compliance with the law, which is a legitimate interest (Article 6 para. 1 lit. f GDPR).

BorlabsCookie Privacy Policy

We use BorlabsCookie on our website, which, among other things, is a tool for storing your cookie consent. The service provider is the German company Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg, Germany.

More about the data processed by BorlabsCookie can be found in the privacy policy at https://de.borlabs.io/datenschutz/.

Audio & Video Introduction

Audio & Video Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Optimization of our service 📓 Processed Data: Data such as contact information, user behavior data, information about your device, and your IP address may be stored. More details can be found below in the respective privacy texts. 📅 Storage Duration: Data is generally stored as long as it is necessary for the service purpose ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What are Audio and Video Elements?

We have integrated audio and video elements into our website so that you can watch videos or listen to music/podcasts directly on our website. The content is provided by service providers. All content is therefore also obtained from the respective providers' servers.

These are integrated functional elements from platforms such as YouTube, Vimeo, or Spotify. The use of these portals is generally free, but paid content can also be published. With the help of these embedded elements, you can listen to or watch the respective content directly on our website.

If you use audio or video elements on our website, personal data may also be transmitted to, processed, and stored by the service providers.

Why do we use Audio & Video Elements on our Website?

Of course, we want to provide you with the best possible offering on our website. We are aware that content is no longer conveyed solely through text and static images. Instead of simply providing a link to a video, we offer you audio and video formats directly on our website that are entertaining, informative, or ideally both. This enhances our service and makes it easier for you to access interesting content. Therefore, in addition to our texts and images, we also offer video and/or audio content.

What Data is Stored through Audio & Video Elements?

If you visit a page on our website that has an embedded video, your server connects to the provider's server. Data from you is also transmitted to the third-party provider and stored there. Some data is collected and stored regardless of whether you have an account with the third-party provider or not. This usually includes your IP address, browser type, operating system, and other general information about your device. Most providers also collect information about your web activity. This includes session duration, bounce rate, which button you clicked, or from which website you use the service. All this information is usually stored via cookies or pixel tags (also called web beacons). Pseudonymized data is usually stored in cookies in your browser. You can find out exactly what data is stored and processed in the respective provider's privacy policy.

Duration of Data Processing

The exact duration for which data is stored on the third-party providers' servers can be found either below in the privacy text of the respective tool or in the provider's privacy policy. Generally, personal data is only processed as long as it is absolutely necessary for providing our services or products. This usually also applies to third-party providers. You can generally assume that certain data is stored on the third-party providers' servers for several years. Data can be stored for different periods in cookies. Some cookies are deleted after you leave the website, while others can be stored in your browser for several years.

Right to Object

You also have the right and the opportunity to revoke your consent to the use of cookies or third-party providers at any time. This can be done either through our cookie management tool or through other opt-out functions. For example, you can also prevent data collection through cookies by managing, deactivating, or deleting cookies in your browser. The lawfulness of the processing up to the point of revocation remains unaffected.

Since the embedded audio and video functions on our site usually also use cookies, you should also read our general privacy policy on cookies. The privacy policies of the respective third-party providers provide more detailed information on how your data is handled and stored.

Legal Basis

If you have consented to the processing and storage of your data by embedded audio and video elements, this consent constitutes the legal basis for the data processing (Art. 6 para. 1 lit. a GDPR). Generally, your data is also stored and processed based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in maintaining fast and good communication with you or other customers and business partners. We only use the embedded audio and video elements to the extent that you have given your consent.

YouTube Privacy Policy

YouTube Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Optimization of our service 📓 Processed Data: Data such as contact information, user behavior data, information about your device, and your IP address may be stored. More details can be found below in this privacy policy. 📅 Storage Duration: Data is generally stored as long as it is necessary for the service purpose ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is YouTube?

We have embedded YouTube videos on our website to present interesting videos directly on our site. YouTube is a video portal that has been a subsidiary of Google since 2006. The video portal is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit a page on our website that has an embedded YouTube video, your browser automatically connects to YouTube or Google's servers. Various data is transmitted depending on the settings. Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for the entire data processing in the European region.

In the following, we will explain in more detail which data is processed, why we have embedded YouTube videos, and how you can manage or delete your data.

On YouTube, users can watch, rate, comment on, and upload videos for free. Over the years, YouTube has become one of the most important social media channels worldwide. To display videos on our website, YouTube provides a code snippet that we have embedded on our site.

Why do we use YouTube videos on our website?

YouTube is the video platform with the most visitors and the best content. We strive to provide you with the best possible user experience on our website, and interesting videos are a part of that. With our embedded videos, we provide you with additional helpful content alongside our texts and images. Furthermore, our website is easier to find on the Google search engine due to the embedded videos. Even if we run ads via Google Ads, Google can show these ads to people who are interested in our offerings thanks to the collected data.

What data does YouTube store?

As soon as you visit one of our pages with an embedded YouTube video, YouTube sets at least one cookie that stores your IP address and our URL. If you are logged into your YouTube account, YouTube can usually associate your interactions on our website with your profile using cookies. This includes data such as session duration, bounce rate, approximate location, technical information such as browser type, screen resolution, or your internet provider. Other data can include contact information, ratings, sharing content via social media, or adding videos to your favorites on YouTube.

If you are not logged into a Google or YouTube account, Google stores data with a unique identifier linked to your device, browser, or app. For example, your preferred language setting is retained. However, many interaction data cannot be stored as fewer cookies are set.

The following list shows cookies that were set during a test in the browser. We show cookies set without a logged-in YouTube account as well as cookies set with a logged-in account. The list cannot claim to be complete because user data always depends on interactions on YouTube.

Name: YSC
Value: b9-CV6ojI5Y122845050-1
Purpose: This cookie registers a unique ID to store statistics of the viewed video.
Expiration: End of session

Name: PREF
Value: f1=50000000
Purpose: This cookie also registers your unique ID. Google receives statistics through PREF on how you use YouTube videos on our website.
Expiration: 8 months

Name: GPS
Value: 1
Purpose: This cookie registers your unique ID on mobile devices to track GPS location.
Expiration: 30 minutes

Name: VISITOR_INFO1_LIVE
Value: 95Chz8bagyU
Purpose: This cookie tries to estimate the user’s bandwidth on our web pages (with embedded YouTube video).
Expiration: 8 months

Additional cookies set when logged into your YouTube account:

Name: APISID
Value: zILlvClZSkqGsSwI/AU1aZI6HY7122845050-
Purpose: This cookie is used to create a profile of your interests. The data is used for personalized advertisements.
Expiration: 2 years

Name: CONSENT
Value: YES+AT.de+20150628-20-0
Purpose: The cookie stores the status of a user’s consent to the use of various Google services. CONSENT also serves security purposes to verify users and protect user data from unauthorized attacks.
Expiration: 19 years

Name: HSID
Value: AcRwpgUik9Dveht0I
Purpose: This cookie is used to create a profile of your interests. This data helps to display personalized advertising.
Expiration: 2 years

Name: LOGIN_INFO
Value: AFmmF2swRQIhALl6aL…
Purpose: This cookie stores information about your login data.
Expiration: 2 years

Name: SAPISID
Value: 7oaPxoG-pZsJuuF5/AnUdDUIsJ9iJz2vdM
Purpose: This cookie works by uniquely identifying your browser and device. It is used to create a profile of your interests.
Expiration: 2 years

Name: SID
Value: oQfNKjAsI122845050-
Purpose: This cookie stores your Google account ID and your last login time in a digitally signed and encrypted form.
Expiration: 2 years

Name: SIDCC
Value: AN0-TYuqub2JOcDTyL
Purpose: This cookie stores information about how you use the website and any advertisements you may have seen before visiting our site.
Expiration: 3 months

How long and where are the data stored?

The data that YouTube receives and processes from you is stored on Google's servers. Most of these servers are located in America. You can see exactly where Google's data centers are located at https://www.google.com/about/datacenters/locations/?hl=de. Your data is distributed across the servers. This makes the data more accessible and better protected against manipulation.

The data collected by Google is stored for varying lengths of time. Some data can be deleted at any time, others are automatically deleted after a limited time, and some are stored by Google for longer periods. Some data (such as items from "My Activity", photos, or documents) stored in your Google account remain until you delete them. Even if you are not logged into a Google account, some data associated with your device, browser, or app can be deleted.

How can I delete my data or prevent data storage?

In general, you can manually delete data in your Google account. With the automatic deletion function for location and activity data introduced in 2019, information is stored for either 3 or 18 months depending on your decision, and then deleted.

Whether you have a Google account or not, you can configure your browser to delete or disable Google cookies. The way this works depends on the browser you use. In the "Cookies" section, you will find the corresponding links to the instructions for the most popular browsers.

If you generally do not want cookies, you can set your browser to notify you whenever a cookie is set. This allows you to decide whether to allow each individual cookie.

Legal Basis

If you have consented to the processing and storage of your data by embedded YouTube elements, this consent constitutes the legal basis for the data processing (Art. 6 para. 1 lit. a GDPR). Your data is also stored and processed based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in maintaining fast and good communication with you or other customers and business partners. We only use the embedded YouTube elements to the extent that you have given your consent. YouTube also sets cookies in your browser to store data. Therefore, we recommend that you read our privacy policy on cookies carefully and review the privacy policy or cookie guidelines of the respective service provider.

YouTube processes data from you in the USA, among other places. YouTube or Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Google also uses standard contractual clauses (= Art. 46 para. 2 and 3 GDPR). Standard Contractual Clauses (SCC) are template clauses provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and standard contractual clauses, Google commits to complying with the European data protection level when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

Since YouTube is a subsidiary of Google, there is a joint privacy policy. If you want to learn more about how your data is handled, we recommend reading the privacy policy at https://policies.google.com/privacy?hl=de.

Review Platforms Introduction

Review Platforms Summary 👥 Affected: Visitors to the website or a review platform 🤝 Purpose: Feedback on our products and/or services 📓 Processed Data: E.g., IP address, email address, name. More details can be found below or in the respective review platforms. 📅 Storage Duration: depends on the respective platform ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What are review platforms?

On various review platforms, you can evaluate our products or services. We participate in some of these platforms to receive feedback from you and improve our offerings. When you rate us on a review platform, the privacy policy and terms and conditions of the respective review service apply. You often need to register to leave a review. Review technologies (widgets) can also be embedded in our website. By using such an embedded tool, data is transmitted, processed, and stored by the respective provider.

Many of these embedded programs work similarly. After you order a product or use a service from us, you will be asked to leave a review via email or on the website. You are usually redirected to a review page via a link where you can quickly and easily create a review. Some review systems also offer an interface to various social media channels to make the feedback accessible to more people.

Why do we use review platforms?

Review platforms collect feedback and reviews about our offerings. Through your reviews, we receive quick feedback and can improve our products and/or services more efficiently. The reviews serve us to optimize our offerings and give you and all our future customers a good overview of the quality of our products and services.

What data is processed?

With your consent, we transmit information about you and the services you have used to the respective review platform. We do this to ensure that you have used one of our services. Only then can you provide genuine feedback. The transmitted data is only for user identification. The exact data stored and processed depends on the providers used. Usually, the review platforms are also provided with personal data such as IP address, email address, or your name. After submitting your review, order information such as the order number of a purchased item is forwarded to the respective platform. If your email address is transmitted, it is so that the review platform can send you an email after purchasing a product. To integrate your review into our website, we also inform the providers that you have visited our site. The review platform is responsible for the collected personal data.

How long and where are the data stored?

Details about the duration of data processing can be found further below in the respective provider's privacy policy if we have additional information. Generally, we process personal data only as long as necessary to provide our services and products. Personal data mentioned in a review is usually anonymized by the platform's employees and thus visible only to the company's administrators. The collected data is stored on the providers' servers and is deleted by most providers after the order is completed.

Right to object

You also have the right and the opportunity to revoke your consent to the use of cookies or third-party providers at any time. This works either through our cookie management tool or through other opt-out functions. For example, you can prevent data collection through cookies by managing, deactivating, or deleting cookies in your browser.

Legal basis

If you have consented to the use of a review platform, the legal basis for the corresponding data processing is this consent. According to Art. 6 para. 1 lit. a GDPR (Consent), this consent constitutes the legal basis for processing personal data as it can occur through a review portal.

We also have a legitimate interest in using a review platform to optimize our online service. The corresponding legal basis is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). However, we only use a review platform if you have given your consent.

We hope we have provided you with the most important general information about the data processing of review platforms. More information can be found further below in the privacy texts or in the linked privacy policies of the companies.

Web Design Introduction

Web Design Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Improvement of user experience 📓 Processed Data: The data processed depends heavily on the services used. Usually, it is IP address, technical data, language settings, browser version, screen resolution, and browser name. More details can be found in the respective web design tools. 📅 Storage Duration: depends on the tools used ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Web Design?

We use various tools on our website that serve our web design. Web design is not just about making our website look pretty, but also about functionality and performance. However, the appropriate appearance of a website is also one of the major goals of professional web design. Web design is a subarea of media design and deals with both the visual and structural and functional design of a website. The goal is to improve your experience on our website with the help of web design. In web design jargon, this is referred to as user experience (UX) and usability. User experience encompasses all the impressions and experiences that the website visitor has on a website. A sub-point of user experience is usability. This is about the user-friendliness of a website. Emphasis is placed on clearly structured content, subpages, or products so that you can easily and quickly find what you are looking for. To provide you with the best possible experience on our website, we also use so-called web design tools from third-party providers. In this privacy policy, "web design" includes all services that improve our website's design. These can be fonts, various plugins, or other integrated web design functions.

Why do we use web design tools?

How you absorb information on a website depends greatly on the structure, functionality, and visual perception of the website. Therefore, good and professional web design has become increasingly important to us. We are constantly working on improving our website and see this as an extended service for you as a website visitor. Additionally, a beautiful and functional website also has economic advantages for us. After all, you will only visit us and use our offers if you feel completely comfortable.

What data is stored by web design tools?

When you visit our website, web design elements may be embedded in our pages that can also process data. The exact data depends on the tools used. Below you will find exactly which tools we use for our website. We recommend that you read the respective privacy policies of the used tools for more information about data processing. Usually, you will learn which data is processed, whether cookies are used, and how long the data is stored. For example, using fonts like Google Fonts, information such as language settings, IP address, browser version, screen resolution, and browser name is automatically transmitted to Google servers.

Duration of data processing

How long data is processed is very individual and depends on the web design elements used. For example, if cookies are used, the storage duration can be only one minute but also several years. Please make yourself familiar with this. We recommend reading our general text section about cookies as well as the privacy policies of the used tools. There you will usually find out which cookies are used and what information is stored in them. For example, Google Font files are stored for one year. This is to improve the loading time of a website. In general, data is always stored only as long as it is necessary to provide the service. In the case of legal requirements, data may be stored for longer.

Right to object

You also have the right and the opportunity to revoke your consent to the use of cookies or third-party providers at any time. This works either through our cookie management tool or through other opt-out functions. You can also prevent data collection through cookies by managing, deactivating, or deleting cookies in your browser. However, with web design elements (usually with fonts), there are also data that cannot be easily deleted. This is the case when data is automatically collected and transmitted to a third party (such as Google) directly upon page access. Please contact the respective provider's support in such cases. You can reach Google support at https://support.google.com/?hl=de.

Legal basis

If you have consented to the use of web design tools, the legal basis for the corresponding data processing is this consent. According to Art. 6 para. 1 lit. a GDPR (Consent), this consent constitutes the legal basis for processing personal data, as it can occur through the use of web design tools. We also have a legitimate interest in improving the web design on our website. After all, we can only provide you with a beautiful and professional web offer if we improve our web design. The corresponding legal basis is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). However, we only use web design tools if you have given your consent. We want to emphasize this once again.

Information about specific web design tools can be found in the following sections, if available.

Google Fonts Local Privacy Policy

We use Google Fonts from Google Inc. on our website. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible. We have integrated the Google fonts locally, i.e., on our web server, not on Google's servers. This means there is no connection to Google servers and thus no data transmission or storage.

What are Google Fonts?

Previously, Google Fonts was also known as Google Web Fonts. It is an interactive directory of over 800 fonts that Google provides for free. With Google Fonts, one could use fonts without uploading them to their own server. However, to prevent any data transmission to Google servers, we have downloaded the fonts to our server. In this way, we act in compliance with data protection and do not send any data to Google Fonts.

Online Map Services Introduction

Online Map Services Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Improvement of user experience 📓 Processed Data: The data processed depends heavily on the services used. Usually, it is IP address, location data, search terms, and/or technical data. More details can be found in the respective tools. 📅 Storage Duration: depends on the tools used ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What are online map services?

We use online map services on our website as an extended service. Google Maps is probably the most well-known service to you, but there are other providers specializing in creating digital maps. These services enable locations, route plans, or other geographic information to be displayed directly on our website. With an embedded map service, you do not have to leave our website to view, for example, the route to a location. To make the online map work on our website, map sections are embedded using HTML code. The services can then display street maps, the Earth's surface, or aerial and satellite images. If you use the embedded map offer, data will be transmitted to and stored by the tool used. These data may also include personal data.

Why do we use online map services on our website?

Generally speaking, our goal is to provide you with a pleasant time on our website. And your time is pleasant only if you can easily find your way around our website and quickly and easily find all the information you need. Therefore, we thought an online map system could significantly optimize our service on the website. Without leaving our website, you can easily view routes, locations, or points of interest with the help of the map system. It is also very convenient to see where our company is located at a glance, so you can quickly and safely find us. As you can see, there are many advantages, and we clearly see online map services on our website as part of our customer service.

What data is stored by online map services?

If you open a page on our website that has an embedded online map function, personal data may be transmitted to and stored by the respective service. Usually, this includes your IP address, through which your approximate location can be determined. In addition to the IP address, data such as search terms entered and latitude and longitude coordinates are stored. If you enter an address for route planning, this data is also stored. The data is not stored by us but on the servers of the embedded tools. You can roughly imagine it like this: you are on our website, but when you interact with a map service, this interaction actually takes place on their website. For the service to work correctly, at least one cookie is usually set in your browser. Google Maps, for example, also uses cookies to record user behavior and optimize its service and display personalized advertising. More about cookies can be found in our section "Cookies."

How long and where are the data stored?

Each online map service processes user data differently. If we have additional information, we will inform you about the duration of data processing further below in the respective sections for the individual tools. Generally, personal data is only stored as long as necessary to provide the service. Google Maps, for example, stores certain data for a fixed period, while other data must be deleted by you. With Mapbox, for example, the IP address is stored for 30 days and then deleted. You see, each tool stores data for different lengths of time. Therefore, we recommend that you read the privacy policies of the used tools carefully.

The providers also use cookies to store data about your user behavior with the map service. More general information about cookies can be found in our section "Cookies," but also in the privacy texts of the individual providers, you will learn which cookies can be used. However, it is usually only an exemplary list and is not complete.

Right to object

You always have the right and the opportunity to access your personal data and to object to its use and processing. You can also revoke your consent at any time. Usually, this works most easily through the cookie consent tool. There are also other opt-out tools that you can use. Possible cookies set by the used providers can also be managed, deleted, or deactivated with a few clicks. However, it may then happen that some functions of the service no longer work as usual. How you manage cookies in your browser also depends on the browser you use. In the section "Cookies," you will find links to the instructions for the most popular browsers.

Legal basis

If you have consented to the use of an online map service, the legal basis for the corresponding data processing is this consent. According to Art. 6 para. 1 lit. a GDPR (Consent), this consent constitutes the legal basis for processing personal data as it can occur through an online map service.

We also have a legitimate interest in using an online map service to optimize our service on our website. The corresponding legal basis is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). However, we only use an online map service if you have given your consent. We want to emphasize this again.

Information about specific online map services can be found in the following sections, if available.

Google Maps Privacy Policy

Google Maps Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Optimization of our service 📓 Processed Data: Data such as search terms entered, your IP address, and also the latitude and longitude coordinates. More details can be found further below in this privacy policy. 📅 Storage Duration: depends on the stored data ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Google Maps?

We use Google Maps on our website from Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. With Google Maps, we can better show you locations and thus tailor our service to your needs. Using Google Maps transfers data to Google and stores it on Google's servers. Here we want to go into more detail about what Google Maps is, why we use this Google service, what data is stored, and how you can prevent this.

Google Maps is an internet mapping service provided by Google. With Google Maps, you can search for precise locations of cities, attractions, accommodations, or businesses online via a PC, tablet, or app. If companies are represented on Google My Business, further information about the company will be displayed in addition to the location. To show directions, map sections of a location can be embedded into a website using HTML code. Google Maps displays the Earth's surface as a street map or as aerial and satellite images. Thanks to Street View images and high-quality satellite images, very accurate representations are possible.

Why do we use Google Maps on our website?

All our efforts on this site aim to provide you with a helpful and meaningful time on our website. By integrating Google Maps, we can provide you with the most important information about various locations. You can see at a glance where our company is located. The route description always shows you the best or fastest way to us. You can access the directions for routes by car, public transport, on foot, or by bike. For us, providing Google Maps is part of our customer service.

What data is stored by Google Maps?

For Google Maps to offer its service fully, the company must collect and store data from you. This includes, among other things, the search terms you enter, your IP address, and the latitude and longitude coordinates. If you use the route planner function, the entered start address is also stored. However, this data storage happens on the Google Maps websites. We can only inform you about it, but we have no influence on it. Since we have integrated Google Maps into our website, Google sets at least one cookie (name: NID) in your browser. This cookie stores data about your user behavior. Google uses this data primarily to optimize its services and provide personalized advertising.

The following cookie is set in your browser due to the integration of Google Maps:

Name: NID
Value: 188=h26c1Ktha7fCQTx8rXgLyATyITJ122845050-5
Purpose: NID is used by Google to customize ads in Google Search. With the help of the cookie, Google "remembers" your most frequent searches or your previous interactions with ads. This way, you always receive tailored advertisements. The cookie contains a unique ID that Google uses to collect your personal preferences for advertising purposes.
Expiration Date: after 6 months

Note: We cannot guarantee the completeness of the information about the stored data. Changes are never excluded, especially with the use of cookies. To identify the NID cookie, a separate test page was created where only Google Maps was integrated.

How long and where are the data stored?

The Google servers are located in data centers around the world. Most servers are located in America. Therefore, your data is also increasingly stored in the USA. Here you can read exactly where the Google data centers are located: https://www.google.com/about/datacenters/locations/?hl=de

Google distributes the data across various storage media. This ensures that the data is retrieved faster and better protected from potential manipulation attempts. Each data center also has specific emergency programs. For example, if there are problems with Google's hardware or a natural disaster paralyzes the servers, the data is still fairly well protected.

Google stores some data for a specified period. For other data, Google only offers the possibility to delete it manually. Furthermore, the company anonymizes information (such as advertising data) in server logs by deleting part of the IP address and cookie information after 9 and 18 months, respectively.

How can I delete my data or prevent data storage?

With the automatic deletion function introduced in 2019 for location and activity data, information for location determination and web/app activity is stored for either 3 or 18 months, depending on your decision, and then deleted. Additionally, you can manually delete these data from the history at any time through your Google account. If you want to completely prevent location tracking, you need to pause the "Web & App Activity" section in your Google account. Click on "Data & Personalization" and then on the "Activity Setting" option. Here you can turn activities on or off.

In your browser, you can also disable, delete, or manage individual cookies. Depending on which browser you use, this works differently. In the "Cookies" section, you will find the relevant links to the instructions for the most popular browsers.

If you generally do not want cookies, you can set your browser to always inform you when a cookie is to be set. This way, you can decide on a case-by-case basis whether you want to allow the cookie or not.

Legal Basis

If you have consented to the use of Google Maps, the legal basis for the corresponding data processing is this consent. According to Art. 6 para. 1 lit. a GDPR (Consent), this consent constitutes the legal basis for processing personal data, as it can occur through Google Maps.

Furthermore, we have a legitimate interest in using Google Maps to optimize our online service. The corresponding legal basis is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). However, we only use Google Maps to the extent that you have given your consent.

Google also processes data from you in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the proper and secure transfer of personal data of EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Google also uses so-called standard contractual clauses (= Art. 46 para. 2 and 3 GDPR). Standard contractual clauses (Standard Contractual Clauses - SCC) are template agreements provided by the EU Commission and are intended to ensure that your data also complies with European data protection standards when it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Google commits to maintaining the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

If you want to learn more about Google's data processing, we recommend the company's privacy policy at https://policies.google.com/privacy?hl=de.

Online Booking Systems Introduction

Online Booking Systems Privacy Policy Summary 👥 Affected: Visitors to the website 🤝 Purpose: Improvement of user experience and organization 📓 Processed Data: The data processed depends heavily on the services used. Usually, it is IP address, contact and payment data, and/or technical data. More details can be found in the respective tools. 📅 Storage Duration: depends on the tools used ⚖️ Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is an online booking system?

To enable you to make bookings through our website, we use one or more booking systems. For example, appointments can be easily created online. A booking system is a software application integrated into our website that displays available resources (such as available appointments) and allows you to book and usually pay for them directly online. You are probably already familiar with such booking systems from the hospitality or hotel industry. Nowadays, however, such systems are used in various industries. Depending on the tool and settings, booking systems can be used both internally by us and by customers like you. In doing so, your personal data is usually collected and stored.

Booking usually works as follows: You find the booking system on our website, where you can directly book an appointment for a service with a few clicks and by providing your data and usually pay for it immediately. You may be able to enter various personal details through a form. Please be aware that all data you enter can be stored and managed in a database.

Why do we use an online booking system?

We consider our website in a certain way as a free service for you. You should receive helpful information and feel comfortable on our site. This also includes an online service that makes booking appointments or services as easy as possible for you. The days are gone when you had to wait days for a booking confirmation by phone or email. With an online booking system, you have everything done after a few clicks and can take care of other things. The system also makes it easier for us to manage all bookings and appointments. Therefore, we consider such a booking system to be absolutely useful for both you and us.

What data is processed?

We cannot tell you exactly what data is processed in this general information text about booking systems. It always depends on the tool used and the functions and possibilities it contains. Many booking systems offer not only the conventional booking function but also a number of other features. For example, many systems also have an external online payment system (e.g., from Stripe, Klarna, or Paypal) and a calendar synchronization function integrated. Accordingly, different and varying amounts of data can be processed depending on the functions. Usually, data such as IP address, name and contact details, technical information about your device, and the time of a booking are processed. If you also make a payment in the system, bank details such as account number, credit card number, passwords, TANs, etc., are also stored and passed on to the respective payment provider. We recommend reading the respective privacy policy of the tool used to know which data is specifically processed.

Duration of data processing

Each booking system stores data for different lengths of time. Therefore, we cannot provide specific information about the duration of data processing here. However, personal data is generally stored only as long as it is necessary to provide the services. Booking systems usually also use cookies that store information for different lengths of time. Some cookies are deleted immediately after leaving the site, while others can be stored for several years. In our section "Cookies," you can learn more about this. Please also take a look at the respective providers' privacy policies. They should explain how long your data is stored in the specific case.

Right to object

If you have consented to the processing of data by a booking system, you also have the right and the option to revoke this consent at any time. Please always be aware that you have rights regarding your personal data and can exercise these rights at any time. If you do not want personal data to be processed, then no personal data should be processed. It's that simple. The easiest way to revoke data processing is through a cookie consent tool or other offered opt-out functions. For example, you can also manage the storage of cookies directly in your browser. The legality of data management remains unaffected until your revocation.

Legal Basis

If you have consented to the use of booking systems, the legal basis for the corresponding data processing is this consent. According to Art. 6 para. 1 lit. a GDPR (Consent), it constitutes the legal basis for the processing of personal data, as it can occur through booking systems.

Furthermore, we have a legitimate interest in using booking systems because we can thus expand our customer service on the one hand and optimize our internal booking organization on the other. The corresponding legal basis is Art. 6 para. 1 lit. f GDPR (Legitimate Interests). However, we only use the tools to the extent that you have given your consent. We want to emphasize this once again.

Information on specific booking systems can be found, if available, in the following sections.

Explanation of Terms Used

We always strive to make our privacy policy as clear and understandable as possible. However, this is not always easy, especially with technical and legal topics. It often makes sense to use legal terms (such as personal data) or certain technical expressions (such as cookies, IP address). However, we do not want to use these without explanation. Below you will find an alphabetical list of important terms used, which we may not have sufficiently explained in the previous privacy policy. If these terms are taken from the GDPR and are definitions, we will also cite the GDPR texts here and, if necessary, add our explanations.

Processor

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

"Processor" means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data that we process from you. In addition to the controllers, there can also be so-called processors. This includes any company or person who processes personal data on our behalf. Processors can therefore include service providers such as tax consultants, hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

Consent

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

"Consent" of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: Usually, such consent on websites is obtained through a cookie consent tool. You probably know this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree to data processing or consent to it. You can usually also make individual settings and decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data from you may be processed. In principle, consent can also be given in writing, not just through a tool.

Personal Data

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

"Personal Data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

Explanation: Personal data are all data that can identify you as a person. These are usually data such as:

• Name
• Address
• Email address
• Postal address
• Phone number
• Date of birth
• Identifiers such as social security number, tax identification number, ID number, or student ID number
• Bank data such as account number, credit information, account balances, etc.

According to the European Court of Justice (ECJ), your IP address is also considered personal data. IT experts can use your IP address to determine at least the approximate location of your device and subsequently identify you as the connection owner. Therefore, storing an IP address also requires a legal basis under the GDPR. There are also so-called "special categories" of personal data, which are also particularly worthy of protection. These include:

• Racial and ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data such as data obtained from blood or saliva samples
• Biometric data (these are information on physical, physiological, or behavioral characteristics that can identify a person).
  Health data
• Data on sexual orientation or sex life

Profiling

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular, to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;

Explanation: Profiling involves gathering various information about a person to learn more about them. In the web domain, profiling is often used for advertising purposes or credit checks. Web or advertising analysis programs collect data about your behavior and interests on a website. This creates a specific user profile, which helps to target ads at a specific audience.

 

Controller

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Explanation: In our case, we are responsible for processing your personal data and thus the "Controller." If we pass collected data on to other service providers for processing, they are "Processors." A "Data Processing Agreement (DPA)" must be signed for this purpose.

 

Processing

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we refer to processing in our privacy policy, we mean any kind of data processing. As mentioned above in the original GDPR definition, this includes not only the collection but also the storage and processing of data.

Closing Words

Congratulations! If you are reading these lines, you have either made it through our entire privacy policy or at least scrolled to this point. As you can see from the extent of our privacy policy, we take the protection of your personal data very seriously.
It is important to us to inform you to the best of our knowledge and belief about the processing of personal data. We not only want to tell you which data is processed but also explain the reasons for using various software programs. Generally, privacy policies sound very technical and legalistic. However, since most of you are not web developers or lawyers, we wanted to take a different approach linguistically and explain the matter in simple and clear language. Of course, this is not always possible due to the nature of the subject. Therefore, the most important terms are explained in more detail at the end of the privacy policy.
If you have any questions about data protection on our website, please do not hesitate to contact us or the responsible office. We wish you a pleasant time and hope to welcome you back to our website soon.