19. Newsletter and Electronic Communications

​

We send newsletters, e-mails and other electronic communications (hereinafter
referred to as "newsletters") only with the consent of the recipient or a legal
permission. Insofar as the contents of the newsletter are specifically described
within the framework of registration, they are decisive for the consent of the user.
Otherwise, our newsletters contain information about our services and us.

​

In order to subscribe to our newsletters, it is generally sufficient to enter your e-
mail address. We may, however, ask you to provide a name for the purpose of

contacting you personally in the newsletter or to provide further information if this
is required for the purposes of the newsletter.

Double opt-in procedure: The registration to our newsletter takes place in
general in a so-called Double-Opt-In procedure. This means that you will receive an
e-mail after registration asking you to confirm your registration. This confirmation
is necessary so that no one can register with external e-mail addresses.

The registrations for the newsletter are logged in order to be able to prove the
registration process according to the legal requirements. This includes storing the
login and confirmation times as well as the IP address. Likewise the changes of
your data stored with the dispatch service provider are logged.

Deletion and restriction of processing: We may store the unsubscribed email
addresses for up to three years based on our legitimate interests before deleting
them to provide evidence of prior consent. The processing of these data is limited to
the purpose of a possible defense against claims. An individual deletion request is
possible at any time, provided that the former existence of a consent is confirmed at
the same time. In the case of an obligation to permanently observe an objection, we
reserve the right to store the e-mail address solely for this purpose in a blocklist.

Information on legal bases: The sending of the newsletter is based on the
consent of the recipients or, if consent is not required, on the basis of our legitimate

interests in direct marketing. Insofar as we engage a service provider for sending e-
mails, this is done on the basis of our legitimate interests in efficient and secure

dispatch. The registration procedure is recorded on the basis of our legitimate
interests for the purpose of demonstrating that it has been conducted in accordance
with the law.

 

Contents:

Information about us, our services, promotions and offers.

 

• Processed data types: Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Meta/communication data (e.g. device information, IP addresses); Usage data (e.g. websites visited, interest in content, access times).

​

• Data subjects: Communication partner (Recipients of e-mails, letters, etc.).

​

• Purposes of Processing: Direct marketing (e.g. by e-mail or postal).

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

​

• Opt-Out: You can cancel the receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can otherwise use one of the contact options listed above, preferably e-mail.

Further information on processing methods, procedures and services used:

​

• Measurement of opening rates and click rates: The newsletters contain a

so-called "web-beacon", i.e. a pixel-sized file, which is retrieved from our
server when the newsletter is opened or, if we use a mailing service provider,
from its server. Within the scope of this retrieval, technical information such
as information about the browser and your system, as well as your IP address
and time of retrieval are first collected. This information is used for the
technical improvement of our newsletter on the basis of technical data or
target groups and their reading behaviour on the basis of their retrieval
points (which can be determined with the help of the IP address) or access
times. This analysis also includes determining whether newsletters are
opened, when they are opened and which links are clicked. This information
is assigned to the individual newsletter recipients and stored in their profiles
until the profiles are deleted. The evaluations serve us much more to
recognize the reading habits of our users and to adapt our content to them or
to send different content according to the interests of our users. The
measurement of opening rates and click rates as well as the storage of the
measurement results in the profiles of the users and their further processing
are based on the consent of the users. A separate objection to the
performance measurement is unfortunately not possible, in this case the
entire newsletter subscription must be cancelled or objected to. In this case,
the stored profile information will be deleted.

​

• HubSpot: Email marketing platform; Service provider: HubSpot, Inc., 25

First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Website:
https://www.hubspot.com; Privacy Policy: https://legal.hubspot.com/privacy-policy;

Data Processing Agreement: https://legal.hubspot.com/dpa; Standard Contractual Clauses
(Safeguarding the level of data protection when processing data in
third countries): https://legal.hubspot.com/dpa; Further Information:
https://legal.hubspot.com/dpa.

 

• Mailchimp: Email distribution and email marketing platform; Service

provider: Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000,
Atlanta, GA 30308, USA; Website: https://mailchimp.com; Privacy Policy:
https://mailchimp.com/legal/; Data Processing Agreement:
https://mailchimp.com/legal/data-processing-addendum/; Standard
Contractual Clauses (Safeguarding the level of data protection when
processing data in third countries): Inclusion in the Data Processing
Agreement; Further Information: Special safety measures:
https://mailchimp.com/help/Mailchimp-european-data-transfers/.

​

• SendGrid: Email sending and communication platform for transactional and

marketing emails; Service provider: SendGrid, Inc. 1801 California Street,
Suite 500 Denver, Colorado 80202, USA; Website: https://sendgrid.com;
Privacy Policy: https://sendgrid.com/policies/privacy/; Standard
Contractual Clauses (Safeguarding the level of data protection when
processing data in third countries): https://www.twilio.com/legal/data-protection-addendum.

​

​

20. Commercial communication by E-Mail, Postal Mail, Fax or Telephone

​

We process personal data for the purposes of promotional communication, which
may be carried out via various channels, such as e-mail, telephone, post or fax, in
accordance with the legal requirements.

The recipients have the right to withdraw their consent at any time or to object to
the advertising communication at any time.

After revocation or objection, we store the data required to prove the past
authorization to contact or send up to three years from the end of the year of
revocation or objection on the basis of our legitimate interests. The processing of
this data is limited to the purpose of a possible defense against claims. Based on the
legitimate interest to permanently observe the revocation, respectively objection of
the users, we further store the data necessary to avoid a renewed contact (e.g.
depending on the communication channel, the e-mail address, telephone number,
name).

 

• Processed data types: Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers).

​

• Data subjects: Communication partner (Recipients of e-mails, letters, etc.).

​

• Purposes of Processing: Direct marketing (e.g. by e-mail or postal).

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

​

​

21. Sweepstakes and Contests

​

We process the personal data of participants in We process personal data of
participants in competitions, contents, raffles, prize-draws or sweepstakes
(hereinafter referred to as "competitions") only in compliance with the relevant data
protection regulations and if the processing is contractually necessary for the
provision, execution and handling of the competition, the participants have
consented to the processing or the processing serves our legitimate interests (e.g.
in the security of the competition or the protection of our interests against misuse
by possible recording of IP addresses when submitting entries to the competition.

In the event that entries are published as part of the competitions (e.g. as part of a
vote or presentation of the competition entries, or the winner or reporting on the
competition), we would like to point out that the names of participants may also be
published in this context. The participants can object to this at any time.

If the competitions take place within an online platform or a social network (e.g.
Facebook or Instagram, hereinafter referred to as "online platform"), the usage and
data protection provisions of the respective online platforms also apply. In such
cases, we would like to point out that we are responsible for the information
provided by the participants as part of the competition and that we must be
contacted with regard to the competitions.

The data of the participants will be deleted as soon as the competition has ended
and the data is no longer required to inform the winners or because questions about
the competition can be expected. In general, the data of the participants will be
deleted at the latest 6 months after the end of the competition. Winners' data can
be retained for a longer period of time, e.g. in order to answer questions about the
prizes or to fulfil the prizes; in this case, the retention period depends on the type of
prize and is up to three years for items or services, e.g. in order to be able to
process warranty claims. Furthermore, the participants' data may be stored for
longer, e.g. in the form of coverage of the competition in online and offline media.

Insofar as data was collected for other purposes as part of the competition, its
processing and storage period shall be governed by the privacy information for this
use (e.g. in the case of registration for a newsletter as part of a competition).

 

• Processed data types: Inventory data (e.g. names, addresses); Content data (e.g. text input, photographs, videos).

​

• Data subjects: Participants in sweepstakes and competitions.

​

• Purposes of Processing: Conducting sweepstakes and contests.

​

• Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).

​

​

22. Surveys and Questionnaires

​

The surveys and questionnaires ("surveys") carried out by us are evaluated
anonymously. Personal data is only processed insofar as this is necessary for the
provision and technical execution of the survey (e.g. processing the IP address to
display the survey in the user's browser or to enable a resumption of the survey
with the aid of a temporary cookie (session cookie)) or participants have consented.

Information on legal basis: If we ask the participants for their consent to the
processing of their data, this is the legal basis for the processing, otherwise the

processing of the participants' data is based on our legitimate interests in
conducting an objective survey.

 

• Processed data types: Contact data (e.g. e-mail, telephone numbers); Content data (e.g. text input, photographs, videos); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).

​

• Data subjects: Communication partner (Recipients of e-mails, letters, etc.).

​

• Purposes of Processing: Contact requests and communication; Direct marketing (e.g. by e-mail or postal).

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

​

​

23. Web Analysis, Monitoring and Optimization

​

Web analysis is used to evaluate the visitor traffic on our website and may include
the behaviour, interests or demographic information of users, such as age or
gender, as pseudonymous values. With the help of web analysis we can e.g.
recognize, at which time our online services or their functions or contents are most
frequently used or requested for repeatedly, as well as which areas require
optimization.

In addition to web analysis, we can also use test procedures, e.g. to test and
optimize different versions of our online services or their components.

Unless otherwise stated below, profiles, i.e. data aggregated for a usage process,
can be created for these purposes and information can be stored in a browser or in
a terminal device and read from it. The information collected includes, in particular,
websites visited and elements used there as well as technical information such as
the browser used, the computer system used and information on usage times. If
users have agreed to the collection of their location data from us or from the
providers of the services we use, location data may also be processed.

Unless otherwise stated below, profiles, that is data summarized for a usage
process or user, may be created for these purposes and stored in a browser or
terminal device (so-called "cookies") or similar processes may be used for the same
purpose. The information collected includes, in particular, websites visited and
elements used there as well as technical information such as the browser used, the
computer system used and information on usage times. If users have consented to
the collection of their location data or profiles to us or to the providers of the
services we use, these may also be processed, depending on the provider.

The IP addresses of the users are also stored. However, we use any existing IP
masking procedure (i.e. pseudonymisation by shortening the IP address) to protect
the user. In general, within the framework of web analysis, A/B testing and
optimisation, no user data (such as e-mail addresses or names) is stored, but
pseudonyms. This means that we, as well as the providers of the software used, do
not know the actual identity of the users, but only the information stored in their
profiles for the purposes of the respective processes.

Information on legal basis: If we ask the users for their consent to the use of
third party providers, the legal basis of the processing is consent. Furthermore, the
processing can be a component of our (pre)contractual services, provided that the
use of the third party was agreed within this context. Otherwise, user data will be
processed on the basis of our legitimate interests (i.e. interest in efficient, economic
and recipient friendly services). In this context, we would also like to refer you to
the information on the use of cookies in this privacy policy.

 

• Processed data types: Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).

​

• Data subjects: Users (e.g. website visitors, users of online services).

​

• Purposes of Processing: Remarketing; Web Analytics (e.g. access statistics, recognition of returning visitors); Profiles with user-related information (Creating user profiles).

​

• Security measures: IP Masking (Pseudonymization of the IP address).

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

 

Further information on processing methods, procedures and services used:

​

• Google Analytics: Web analytics, reach measurement and measurement of

user traffic; Service provider: Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600
Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://marketingplatform.google.com/intl/en/about/analytics/; Privacy
Policy: https://policies.google.com/privacy; Data Processing Agreement:
https://business.safety.google/adsprocessorterms/; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries): https://business.safety.google/adsprocessorterms;
Opt-Out: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=en,
Settings for the Display of Advertisements: https://adssettings.google.com/authenticated;

Further Information: https://privacy.google.com/businesses/adsservices (Types of processing and data processed).

​

• Google Universal Analytics: Web Analytics and Reach Measurement - We

use Universal Analytics, a version of Google Analytics, to perform user
analysis based on a pseudonymous user identification number. This

identification number does not contain any clear data, such as names or e-
mail addresses. It is used to assign analysis information to a user, e.g., to

identify which content users have accessed within a usage session or whether
they visit our online services again. This involves creating pseudonymous
profiles of users with information from the use of various devices; Service
provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4,
Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain
View, CA 94043, USA; Website: https://marketingplatform.google.com;
Privacy Policy: https://policies.google.com/privacy; Data Processing
Agreement: https://business.safety.google/adsprocessorterms; Standard
Contractual Clauses (Safeguarding the level of data protection when
processing data in third countries): https://business.safety.google/adsprocessorterms;

Opt-Out: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=en,

Settings for the Display of Advertisements: https://adssettings.google.com/authenticated;

Further Information: https://privacy.google.com/businesses/adsservices (Types of
processing and data processed).

​

• Google Analytics 4: Web Analytics and Reach Measurement - We use Google

Analytics 4, a version of Google Analytics, to perform user analysis based on a
pseudonymous user identification number. This identification number does
not contain any clear data, such as names or e-mail addresses. It is used to
assign analysis information to a user, e.g., to identify which content users
have accessed within a usage session or whether they visit our online services
again. This involves creating pseudonymous profiles of users with information
from the use of various devices. The IP address of the user is shortened by the
last two digits by default; Service provider: Google Ireland Limited, Gordon
House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600
Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://marketingplatform.google.com/intl/en/about/analytics/; Privacy
Policy: https://policies.google.com/privacy; Data Processing Agreement:
https://business.safety.google/adsprocessorterms/; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries): https://business.safety.google/adsprocessorterms;
Opt-Out: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=en,
Settings for the Display of Advertisements: https://adssettings.google.com/authenticated;

Further Information: https://privacy.google.com/businesses/adsservices (Types of processing and data processed).

​

• Google Tag Manager: Google Tag Manager is a solution with which we can

manage so-called website tags via an interface and thus integrate other
services into our online services (please refer to further details in this privacy
policy). With the Tag Manager itself (which implements the tags), for
example, no user profiles are created or cookies are stored. Google only
receives the IP address of the user, which is necessary to run the Google Tag
Manager; Service provider: Google Ireland Limited, Gordon House, Barrow
Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre
Parkway, Mountain View, CA 94043, USA; Website:
https://marketingplatform.google.com; Privacy Policy:
https://policies.google.com/privacy; Data Processing Agreement:
https://business.safety.google/adsprocessorterms; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries): https://business.safety.google/adsprocessorterms;
Further Information: https://privacy.google.com/businesses/adsservices
(Types of processing and data processed).

​

​

24. Online Marketing

​

We process personal data for the purposes of online marketing, which may include
in particular the marketing of advertising space or the display of advertising and
other content (collectively referred to as "Content") based on the potential interests
of users and the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called
"cookie") or similar procedure in which the relevant user information for the display
of the aforementioned content is stored. This information may include, for example,
content viewed, websites visited, online networks used, communication partners
and technical information such as the browser used, computer system used and
information on usage times and used functions. If users have consented to the
collection of their sideline data, these can also be processed.

The IP addresses of the users are also stored. However, we use provided IP masking
procedures (i.e. pseudonymisation by shortening the IP address) to ensure the
protection of the user's by using a pseudonym. In general, within the framework of
the online marketing process, no clear user data (such as e-mail addresses or
names) is secured, but pseudonyms. This means that we, as well as the providers of
online marketing procedures, do not know the actual identity of the users, but only
the information stored in their profiles.

The information in the profiles is usually stored in the cookies or similar
memorizing procedures. These cookies can later, generally also on other websites
that use the same online marketing technology, be read and analyzed for purposes
of content display, as well as supplemented with other data and stored on the
server of the online marketing technology provider.

Exceptionally, clear data can be assigned to the profiles. This is the case, for
example, if the users are members of a social network whose online marketing
technology we use and the network links the profiles of the users in the
aforementioned data. Please note that users may enter into additional agreements
with the social network providers or other service providers, e.g. by consenting as
part of a registration process.

As a matter of principle, we only gain access to summarised information about the
performance of our advertisements. However, within the framework of so-called
conversion measurement, we can check which of our online marketing processes
have led to a so-called conversion, i.e. to the conclusion of a contract with us. The
conversion measurement is used alone for the performance analysis of our
marketing activities.

Unless otherwise stated, we kindly ask you to consider that cookies used will be
stored for a period of two years.

Information on legal basis: If we ask users for their consent (e.g. in the context
of a so-called "cookie banner consent"), the legal basis for processing data for
online marketing purposes is this consent. Otherwise, user data will be processed
on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and
economic operation of our online services. In this context, we would also like to
refer you to the information on the use of cookies in this privacy policy.

​

• Processed data types: Event Data (Facebook) ("Event Data" is data that can be transmitted from us to Facebook, e.g. via Facebook pixels (via apps or other means) and relates to persons or their actions; the data includes, for example, information about visits to websites, interactions with content, functions, installations of apps, purchases of products, etc.; Event data is processed for the purpose of creating target groups for content and advertising information (Custom Audiences); Event Data does not include the actual content (such as written comments), login information, and Contact Information (such as names, email addresses, and phone numbers). Event Data is deleted by Facebook after a maximum of two years, the Custom Audiences created from them with the deletion of our Facebook account); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).

​

• Data subjects: Users (e.g. website visitors, users of online services).

​

• Purposes of Processing: Remarketing; Custom Audiences (Selection of relevant target groups for marketing purposes or other output of content); Conversion tracking (Measurement of the effectiveness of marketing activities); Affiliate Tracking; Marketing; Profiles with user-related information (Creating user profiles).

​

• Security measures: IP Masking (Pseudonymization of the IP address).

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

​

• Opt-Out: We refer to the privacy policies of the respective service providers and the possibilities for objection (so-called "opt-out"). If no explicit opt-out option has been specified, it is possible to deactivate cookies in the settings of your browser. However, this may restrict the functions of our online offer. We therefore recommend the following additional opt-out options, which are offered collectively for each area: a) Europe: https://www.youronlinechoices.eu. b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Cross-regional: https://optout.aboutads.info.

Further information on processing methods, procedures and services used:

 

• Facebook Pixel and Custom Audiences (Custom Audiences): With the

help of the Facebook pixel (or equivalent functions, to transfer Event-Data or
Contact Information via interfaces or other software in apps), Facebook is on
the one hand able to determine the visitors of our online services as a target
group for the presentation of ads (so-called "Facebook ads"). Accordingly, we
use Facebook pixels to display Facebook ads placed by us only to Facebook

users and within the services of partners cooperating with Facebook (so-
called "audience network" https://www.facebook.com/audiencenetwork/ ) who

have shown an interest in our online services or who have certain
characteristics (e.g. interests in certain topics or products that are
determined on the basis of the websites visited) that we transmit to Facebook
(so-called "custom audiences"). With the help of Facebook pixels, we also
want to ensure that our Facebook ads correspond to the potential interest of
users and do not appear annoying. The Facebook pixel also enables us to
track the effectiveness of Facebook ads for statistical and market research
purposes by showing whether users were referred to our website after
clicking on a Facebook ad (known as "conversion tracking"); Service
provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand
Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com;
Privacy Policy: https://www.facebook.com/about/privacy; Data Processing
Agreement: https://www.facebook.com/legal/terms/dataprocessing;
Standard Contractual Clauses (Safeguarding the level of data
protection when processing data in third countries): The "Facebook EU
Data Transfer Addendum" (https://www.facebook.com/legal/EU_data_transfer_addendum) apply in case of processing of Event Data of EU citizens in the USA and the inclusion of the
SCC in the "Facebook Platform Terms of Use" (https://developers.facebook.com/terms) with regard to the processing of Event Data from Facebook as controller in the context of ad placement;
Further Information: The "Data Processing Terms"
(https://www.facebook.com/legal/terms/dataprocessing) apply with respect to
Event Data that Facebook processes to provide reporting and analytics to
businesses;The "Controller Addendum" as a joint responsibility agreement (
Article 26(1) p. 3 of the GDPR) is relevant in the case of processing of Event
Data by Facebook as controller for the purposes of targeting and improving
and securing Facebook's products.

​

• Google Ad Manager: We use the "Google Marketing Platform" (and services

like "Google Ad Manager") to place ads in the Google advertising network
(e.g., in search results, in videos, on websites, etc.). The Google Marketing
Platform" is characterised by the fact that ads are displayed in real time
according to the presumed interests of the users. This allows us to display ads
for and within our online services in a more targeted manner in order to
present users only with ads that potentially match their interests. If, for
example, a user is shown ads for products in which he is interested on other
online offers, this is referred to as "remarketing"; Service provider: Google
Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent
company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA
94043, USA; Website: https://marketingplatform.google.com; Privacy
Policy: https://policies.google.com/privacy; Further Information: Types of
processing and data processed: https://privacy.google.com/businesses/adsservices;

Google Ads Controller- Controller Data Protection Terms and standard contractual clauses for data

transfers to third countries: https://business.safety.google/adscontrollerterms;
where Google acts as processor, Data Processing Conditions for Google
Advertising Products and standard contractual clauses for data transfers to
third countries: https://business.safety.google/adsprocessorterms apply.

​

• Google Ads and Conversion Tracking: We use the Google "Ads" online

marketing method to place ads on the Google advertising network (e.g., in
search results, videos, websites, etc.) so that they are displayed to users who
have an alleged interest in the ads. We also measure the conversion of the ads
(so called "Konversion"). However, we only know the anonymous total number
of users who clicked on our ad and were redirected to a page tagged with a
conversion tracking tag. However, we ourselves do not receive any
information that can be used to identify users; Service provider: Google
Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent
company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA
94043, USA; Website: https://marketingplatform.google.com; Privacy
Policy: https://policies.google.com/privacy; Further Information: Types of
processing and data processed:

https://privacy.google.com/businesses/adsservices; Google Ads Controller-
Controller Data Protection Terms and standard contractual clauses for data

transfers to third countries: https://business.safety.google/adscontrollerterms.

​

• Enhanced Conversions for Google Ads: When customers click on our

Google ads and subsequently use the advertised service (so-called
"conversion"), data entered by the user, such as the email address, name,
home address or phone number, may be transmitted to Google. However, the
data is not transmitted clearly, but in the form of a mathematical numerical
value (so-called "hash value").The hash values are then matched with existing
Google accounts of users in order to better evaluate as well as improve the
interaction of users with the advertisements (e.g. clicks or views) and thus
their performance; Website: https://support.google.com/google-ads/answer/9888656.

 

• Google Analytics Audiences: We use Google Analytics to display ads placed

by Google and its partnersonly to users who have shown an interest in our
online services or who have specific characteristics (e.g. interests in specific
topics or products determined on the basis of the websites visited) that we
transmit to Google (so-called "Remarketing Audiences" or "Google Analytics
Audiences"). With the help of remarketing audiences, we also want to ensure
that our ads match the potential interest of users; Service provider: Google
Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent
company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA
94043, USA; Website: https://marketingplatform.google.com; Legal Basis:
https://business.safety.google/adsprocessorterms/; Privacy Policy:
https://policies.google.com/privacy; Data Processing Agreement:
https://business.safety.google/adsprocessorterms/; Further Information:
Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data Processing Conditions for Google Advertising Products and standard contractual clauses
for data transfers to third countries: https://business.safety.google/adsprocessorterms.

​

• LinkedIn: e.g. Insights Tag / Conversion tracking; Service provider:

LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA;
Website: https://www.linkedin.com; Privacy Policy:
https://www.linkedin.com/legal/privacy-policy, Cookie policy:
https://www.linkedin.com/legal/cookie_policy; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries): https://legal.linkedin.com/dpa; Opt-Out:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

​

• HubSpot: Software for customer relation management (CRM), process and

sales support ( multi-channel communication, i.e. management of customer
enquiries from different channels, sales, process management, analyses,
feedback and survey functions; Service provider: HubSpot, Inc., 25 First St.,
2nd floor, Cambridge, Massachusetts 02141, USA; Website: https://www.hubspot.de;

Privacy Policy: https://legal.hubspot.com/privacy-policy; Data Processing Agreement:
https://legal.hubspot.com/dpa; Standard Contractual Clauses
(Safeguarding the level of data protection when processing data in
third countries): https://legal.hubspot.com/dpa.

​

​

25. Affiliate-Programms und Affiliate-Links

​

Within our online services, we include so-called affiliate links or other references
(which for example may include search forms, widgets or discount codes) to the
offers and services of third parties (collectively referred to as "affiliate links").
When users follow affiliate links or subsequently take advantage of offers, we may
receive commission or other benefits (collectively referred to as "commission") from
these third parties.

In order to be able to track whether the users have followed the offers of an affiliate
link used by us, it is necessary for the respective third party to know that the users
have followed an affiliate link used within our online services. The assignment of
affiliate links to the respective business transactions or other actions (e.g., purchases)

serves the sole purpose of commission settlement and is removed as
soon as it is no longer required for this purpose.

For the purposes of the aforementioned affiliate link assignment, the affiliate links
may be supplemented by certain values that may be a component of the link or
otherwise stored, for example, in a cookie. The values may include in particular the
source website (referrer), time, an online identifier of the operator of the website
on which the affiliate link was located, an online identifier of the respective offer,
the type of link used, the type of offer and an online identifier of the user.

Information on legal basis: If we ask the users for their consent to the use of
third party providers, the legal basis of the processing is consent. Furthermore, the
processing can be a component of our (pre)contractual services, provided that the
use of the third party was agreed within this context. Otherwise, user data will be
processed on the basis of our legitimate interests (i.e. interest in efficient, economic
and recipient friendly services). In this context, we would also like to refer you to
the information on the use of cookies in this privacy policy.

 

• Processed data types: Contract data (e.g. contract object, duration, customer category); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses)

​​

• Data subjects: Users (e.g. website visitors, users of online services).

​

• Purposes of Processing: Affiliate Tracking.

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

​

​

26. Customer Reviews and Ratings

​

We participate in review and rating procedures to evaluate, optimise and advertise
our performance. If users rate us via the participating rating platforms or methods
or otherwise provide feedback, the General Terms and Conditions of Business or
Use and the data protection information of the providers also apply. As a rule, the
rating also requires registration with the respective provider.

In order to ensure that the evaluators have actually made use of our services, we
transmit, with the consent of the customer, the necessary data relating to the
customer and the service or products used to the respective rating platform (this
includes the name, e-mail address, order number or article number). This data is
used solely to verify the authenticity of the user.

 

• Processed data types: Contract data (e.g. contract object, duration, customer category); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).

​

• Data subjects: Customers; Users (e.g. website visitors, users of online services).

​

• Purposes of Processing: Feedback (e.g. collecting feedback via online form)

​​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

​

​

27. Profiles in Social Networks (Social Media)

​

We maintain online presences within social networks and process user data in this
context in order to communicate with the users active there or to offer information
about us.

We would like to point out that user data may be processed outside the European
Union. This may entail risks for users, e.g. by making it more difficult to enforce
users' rights.

In addition, user data is usually processed within social networks for market
research and advertising purposes. For example, user profiles can be created on
the basis of user behaviour and the associated interests of users. The user profiles
can then be used, for example, to place advertisements within and outside the
networks which are presumed to correspond to the interests of the users. For these
purposes, cookies are usually stored on the user's computer, in which the user's
usage behaviour and interests are stored. Furthermore, data can be stored in the
user profiles independently of the devices used by the users (especially if the users
are members of the respective networks or will become members later on).

For a detailed description of the respective processing operations and the opt-out
options, please refer to the respective data protection declarations and information
provided by the providers of the respective networks.

Also in the case of requests for information and the exercise of rights of data
subjects, we point out that these can be most effectively pursued with the
providers. Only the providers have access to the data of the users and can directly
take appropriate measures and provide information. If you still need help, please do
not hesitate to contact us.

 

• Processed data types: Contact data (e.g. e-mail, telephone numbers); Content data (e.g. text input, photographs, videos); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).

​

• Data subjects: Users (e.g. website visitors, users of online services).

​

• Purposes of Processing: Contact requests and communication; Feedback (e.g. collecting feedback via online form); Marketing.

​

• Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

​

• Instagram: Social network; Service provider: Instagram Inc., 1601 Willow

Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com;
Privacy Policy: https://instagram.com/about/legal/privacy.

​

• Facebook-Seiten: Profiles within the social network Facebook - We are

jointly responsible (so called "joint controller") with Meta Platforms Ireland
Limited for the collection (but not the further processing) of data of visitors to
our Facebook page. This data includes information about the types of content
users view or interact with, or the actions they take (see "Things that you and
others do and provide" in the Facebook Data Policy:
https://www.facebook.com/policy), and information about the devices used by
users (e.g., IP addresses, operating system, browser type, language settings,
cookie information; see "Device Information" in the Facebook Data Policy:
https://www.facebook.com/policy). As explained in the Facebook Data Policy
under "How we use this information?" Facebook also collects and uses
information to provide analytics services, known as "page insights," to site
operators to help them understand how people interact with their pages and
with content associated with them. We have concluded a special agreement
with Facebook ("Information about Page-Insights",
https://www.facebook.com/legal/terms/page_controller_addendum), which
regulates in particular the security measures that Facebook must observe and
in which Facebook has agreed to fulfill the rights of the persons concerned
(i.e. users can send information access or deletion requests directly to
Facebook). The rights of users (in particular to access to information, erasure,
objection and complaint to the competent supervisory authority) are not
restricted by the agreements with Facebook. Further information can be
found in the "Information about Page Insights"
(https://www.facebook.com/legal/terms/information_about_page_insights_data ); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in
third countries): https://www.facebook.com/legal/EU_data_transfer_addendum;

Further Information: Joint Controllership Agreement: 

https://www.facebook.com/legal/terms/information_about_page_insights_data.

​

• LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited

Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy Policy:
https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement:
https://legal.linkedin.com/dpa; Standard Contractual Clauses
(Safeguarding the level of data protection when processing data in
third countries): https://legal.linkedin.com/dpa; Opt-Out:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

​

• Pinterest: Social network; Service provider: Pinterest Inc., 635 High Street,

Palo Alto, CA, 94301, USA; Website: https://www.pinterest.com; Privacy
Policy: https://about.pinterest.com/de/privacy-policy; Further Information:
Pinterest Data Sharing Addendum (EXHIBIT A):
https://business.pinterest.com/de/pinterest-advertising-services-agreement/.

​

• Twitter: Social network; Service provider: Twitter International Company,

One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, parent
company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA
94103, USA; Privacy Policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).

​

• YouTube: Social network and video platform; Service provider: Google

Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent
company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA
94043, USA; Privacy Policy: https://policies.google.com/privacy; Opt-Out:
https://adssettings.google.com/authenticated.

​

• Xing: Social network; Service provider: XING AG, Dammtorstraße 29-32,20354

Hamburg, Germany; Website: https://www.xing.com; Privacy Policy: https://privacy.xing.com/en.

​

​

28. Plugins and embedded functions and content

​

Within our online services, we integrate functional and content elements that are
obtained from the servers of their respective providers (hereinafter referred to as
"third-party providers"). These may, for example, be graphics, videos or city maps
(hereinafter uniformly referred to as "Content").

The integration always presupposes that the third-party providers of this content
process the IP address of the user, since they could not send the content to their
browser without the IP address. The IP address is therefore required for the
presentation of these contents or functions. We strive to use only those contents,
whose respective offerers use the IP address only for the distribution of the
contents. Third parties may also use so-called pixel tags (invisible graphics, also
known as "web beacons") for statistical or marketing purposes. The "pixel tags" can
be used to evaluate information such as visitor traffic on the pages of this website.
The pseudonymous information may also be stored in cookies on the user's device
and may include technical information about the browser and operating system,
referring websites, visit times and other information about the use of our website,
as well as may be linked to such information from other sources.

Information on legal basis: If we ask users for their consent (e.g. in the context
of a so-called "cookie banner consent"), the legal basis for processing is this
consent. Otherwise, user data will be processed on the basis of our legitimate
interests (i.e. interest in the analysis, optimisation and economic operation of our
online services. We refer you to the note on the use of cookies in this privacy policy.

 

• Processed data types: Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Content data (e.g. text input, photographs, videos).

​

• Data subjects: Users (e.g. website visitors, users of online services).

​

• Purposes of Processing: Provision of our online services and usability.

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

​

• Google Fonts: Retrieval of fonts ("Google Fonts") from the provider Google

for the purpose of a technically secure, maintenance-free and efficient use of
fonts with regard to timeliness and loading times, their uniform presentation
and consideration of possible restrictions under licensing law. Google is
provided with the user's IP address so that Google can provide the fonts in
the user's browser. In addition, technical data (language settings, screen
resolution, operating system, hardware used) are transmitted that are
necessary for the provision of the fonts depending on the devices used and
the technical environment. ; Service provider: Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google
LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy.

 

• YouTube videos: Video contents; Service provider: Google Ireland Limited,

Gordon House, Barrow Street, Dublin 4, Ireland, , parent company: Google
LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://www.youtube.com; Privacy Policy:
https://policies.google.com/privacy; Opt-Out: Opt-Out-Plugin:
https://tools.google.com/dlpage/gaoptout?hl=en, Settings for the Display of
Advertisements: https://adssettings.google.com/authenticated.

​

​

29. Management, Organization and Utilities

​

We use services, platforms and software from other providers (hereinafter referred
to as " third-party providers") for the purposes of organizing, administering,
planning and providing our services. When selecting third-party providers and their
services, we comply with the legal requirements.

Within this context, personal data may be processed and stored on the servers of
third-party providers. This may include various data that we process in accordance
with this privacy policy. This data may include in particular master data and contact
data of users, data on processes, contracts, other processes and their contents.

If users are referred to the third-party providers or their software or platforms in

the context of communication, business or other relationships with us, the third-
party provider processing may process usage data and metadata that can be

processed by them for security purposes, service optimisation or marketing
purposes. We therefore ask you to read the data protection notices of the respective
third party providers.

Information on legal basis: If we ask the users for their consent to the use of
third party providers, the legal basis of the processing is consent. Furthermore, the
processing can be a component of our (pre)contractual services, provided that the
use of the third party was agreed within this context. Otherwise, user data will be
processed on the basis of our legitimate interests (i.e. interest in efficient, economic
and recipient friendly services). In this context, we would also like to refer you to

the information on the use of cookies in this privacy policy.

 

• Processed data types: Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Content data (e.g. text input, photographs, videos); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).

​

• Data subjects: Communication partner (Recipients of e-mails, letters, etc.); Users (e.g. website visitors, users of online services).

​

• Purposes of Processing: Web Analytics (e.g. access statistics, recognition of returning visitors); Profiles with user-related information (Creating user profiles); Office and organisational procedures.

​

• Legal Basis: Consent (Article 6 (1) (a) GDPR); Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR); Performance of a contract and prior requests (EKD) (§ 6 No. 5 DSG- EKD).

​

Further information on processing methods, procedures and services used:

​

• HubSpot: Social media publishing, reporting (e.g. traffic sources, access

figures, web analysis), contact management (e.g. contact forms, direct
communication and user segmentation), landing pages; Service provider:
HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA;
Website: https://www.hubspot.de; Privacy Policy:
https://legal.hubspot.com/de/privacy-policy; Data Processing Agreement:
https://legal.hubspot.com/dpa; Standard Contractual Clauses
(Safeguarding the level of data protection when processing data in
third countries): https://legal.hubspot.com/dpa.

​

• Google Docs: Online word processing application, document storage,

collaboration, and sharing; Service provider: Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google
LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://www.google.de/docs/about/; Privacy Policy:
https://cloud.google.com/privacy; Data Processing Agreement:
https://workspace.google.com/terms/dpa_terms.html; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries): https://cloud.google.com/terms/eu-model-contract-clause; Further
Information: https://cloud.google.com/privacy.

​

• Google Forms: Online forms (collection, storage and processing of input);

Service provider: Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway,
Mountain View, CA 94043, USA; Website: https://www.google.com/forms/about/; Privacy Policy:
https://cloud.google.com/privacy; Data Processing Agreement:
https://workspace.google.com/terms/dpa_terms.html; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries):
https://cloud.google.com/terms/eu-model-contract-clause; Further
Information: https://cloud.google.com/privacy.

​

• Google Sheets: Online spreadsheet application, document storage,

collaboration, and sharing; Service provider: Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google
LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://www.google.com/sheets/about/; Privacy Policy:
https://www.google.com/policies/privacy/; Data Processing Agreement:
https://workspace.google.com/terms/dpa_terms.html; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries): https://cloud.google.com/product-terms; Further
Information: https://cloud.google.com/privacy.

​

• Google Presentations: Online application for presentation creation,

document storage, collaboration, and sharing; Service provider: Google
Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent
company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA
94043, USA; Website: https://www.google.de/slides/about/; Privacy Policy:
https://cloud.google.com/privacy; Data Processing Agreement:
https://workspace.google.com/terms/dpa_terms.html; Standard Contractual
Clauses (Safeguarding the level of data protection when processing
data in third countries): https://cloud.google.com/terms/eu-model-contract-clause; Further
Information: https://cloud.google.com/privacy.

​

​

30. Changes and Updates to the Privacy Policy

​

We kindly ask you to inform yourself regularly about the contents of our data
protection declaration. We will adjust the privacy policy as changes in our data
processing practices make this necessary. We will inform you as soon as the
changes require your cooperation (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in
this privacy policy, we ask you to note that addresses may change over time and to
verify the information before contacting us.