AYTU Logo AYTU.com

Privacy Policy

Effective: July 11, 2023

Controller

AYTU GmbH
Vennhof 2
52224 Stolberg

Authorized Representatives:
Mustafa Ören

Email Address:
datenschutz@aytu.de

Legal Notice:
https://www.aytu.de/impressum/

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence or establishment. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6(1) sentence 1 lit. a GDPR) - The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
  • Performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR) - The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the data subject.
  • Legal obligation (Art. 6(1) sentence 1 lit. c GDPR) - The processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) - The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG). The BDSG contains specific regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission as well as automated decision-making in individual cases including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Notice on the applicability of the GDPR and Swiss DSG: These privacy notices serve both to provide information under the Swiss Federal Act on Data Protection (Swiss DSG) and the General Data Protection Regulation (GDPR). Therefore, please note that due to broader geographical application and comprehensibility, the terms of the GDPR have been replaced by Swiss terms. In particular, instead of the terms used in the GDPR "processing" of "personal data" (or simply "data"), and "legitimate interest", the terms used in the Swiss DSG "handling" of "personal data" and "overriding interest" are used. The legal meaning of the terms, however, will continue to be determined according to the Swiss DSG within the framework of the applicability of the Swiss DSG.

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing and refers to the affected individuals.

Types of processed data

  • Inventory data
  • Location data
  • Contact data
  • Content data
  • Usage data
  • Meta, communication, and procedural data

Categories of affected individuals

  • Customers
  • Interested parties
  • Communication partners
  • Applicants
  • Users
  • Business and contractual partners

Purposes of processing

  • Performance of contractual services and customer service
  • Contact requests and communication
  • Security measures
  • Direct marketing
  • Reach measurement
  • Office and organizational procedures
  • A/B tests
  • Management and response to inquiries
  • Firewall
  • Feedback
  • Heatmaps
  • Marketing
  • Profiles with user-related information
  • Provision of our online offering and user-friendliness
  • Information technology infrastructure

Security measures

We take appropriate technical and organizational measures to ensure a level of security appropriate to the risk, considering the state of the art, implementation costs, and the nature, scope, context, and purposes of processing as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons.

The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access, input, transfer, securing of availability, and separation of the data. We have also established procedures to ensure the exercise of data subject rights, deletion of data, and responses to data threats. Furthermore, we consider the protection of personal data already during the development or selection of hardware, software, and procedures according to the principle of data protection by design and data protection-friendly default settings.

TLS encryption (https): To protect your data transmitted via our online offering, we use TLS encryption. You can recognize encrypted connections by the prefix https:// in the address line of your browser.

Transmission of Personal Data

In the course of our processing of personal data, it may happen that the data is transmitted to other entities, companies, legally independent organizational units, or persons or disclosed to them. Recipients of this data may include, for example, IT service providers or providers of services and content that are embedded in a website. In such cases, we comply with legal requirements and conclude appropriate contracts or agreements with the recipients of your data, which serve to protect your data.

Data transmission within the organization: We may transmit personal data to other entities within our organization or grant them access to this data. If this transmission is for administrative purposes, the transmission of the data is based on our legitimate business and economic interests or occurs if it is necessary to fulfill our contractual obligations or if there is consent from the data subjects or a legal permission.

International Data Transfers

Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if processing occurs in the context of using third-party services or disclosing or transmitting data to other persons, entities, or companies, this is done only in accordance with the legal requirements.

Subject to express consent or contractual or legally required transmission (cf. Art. 49 GDPR), we process or allow data to be processed only in third countries with a recognized level of data protection (Art. 45 GDPR), or based on contractual obligations through so-called standard contractual clauses of the EU Commission (Art. 46 GDPR) or the presence of certifications or binding internal data protection regulations (cf. Art. 44 to 49 GDPR, information page of the EU Commission).

Trans-Atlantic Data Privacy Framework (TADPF): The EU Commission has also recognized the level of data protection for certain companies from the USA (under the so-called "Trans-Atlantic Data Privacy Framework", or "TADPF"). The list of certified companies and further information about the TADPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). Information in German and other languages can be found on the website of the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_de. We also inform you about the companies we use that are certified under the Trans-Atlantic Data Privacy Framework.

Business Services

We process data from our contractual and business partners, such as customers and interested parties (collectively referred to as "contractual partners") in the context of contractual and similar legal relationships and related measures, and in the context of communication with the contractual partners (or pre-contractually), for example, to answer inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, the obligations to provide the agreed services, any update obligations, and remedies in the event of warranty and other service disruptions. In addition, we process the data to safeguard our rights and for the purposes of the administrative tasks associated with these obligations and for business organization. Furthermore, we process the data based on our legitimate interests in proper and economic business management and in security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information, and rights (e.g., involvement of telecommunications, transport, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). In accordance with applicable law, we only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about further forms of processing, such as for marketing purposes, within the framework of this privacy policy.

Which data is required for the aforementioned purposes, we inform the contractual partners before or in the context of data collection, for example in online forms, through special labeling (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete the data after the expiration of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as they must be retained for legal reasons of archiving. The statutory retention period for tax-relevant documents as well as for commercial books, inventories, opening balances, annual financial statements, the necessary work instructions and other organizational documents, and booking vouchers is ten years and for received commercial and business letters and copies of sent commercial and business letters six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance, the annual financial statement, or the management report was prepared, the commercial or business letter was received or sent, or the booking voucher was created.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

  • Processed data types: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email, phone numbers); contract data (e.g., contract subject, term, customer category); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Affected individuals: Customers; interested parties; business and contractual partners.
  • Purposes of processing: Performance of contractual services and customer service; security measures; contact requests and communication; office and organizational procedures; management and response to inquiries.
  • Legal bases: Performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR); legal obligation (Art. 6(1) sentence 1 lit. c GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

  • Customer account: Customers can create an account within our online offering (e.g., customer or user account, referred to as "customer account"). If the registration of a customer account is required, customers are informed of this as well as of the required information for the registration. The customer accounts are not public and cannot be indexed by search engines. In the context of registration as well as subsequent logins and use of the customer account, we store the IP addresses of customers along with the access times to be able to prove the registration and to prevent misuse of the customer account. If the customer account is terminated, the data of the customer account will be deleted after the termination, provided that they are not retained for other purposes (e.g., internal storage of customer data, order processes, or invoices) or for legal reasons. It is the responsibility of the customers to secure their data upon termination of the customer account; legal bases: performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR).
  • Agency services: We process the data of our customers in the context of our contractual services, which may include conceptual and strategic consulting, campaign planning, software and design development/consulting or maintenance, implementation of campaigns and processes, handling, server administration, data analysis/consulting services, and training services; legal bases: performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR).
  • Project and development services: We process the data of our customers and clients (collectively referred to as "customers") to enable them to select, acquire, or commission the chosen services or works and associated activities as well as their payment and provision or execution or performance. The required information is marked as such in the context of the order, purchase, or comparable contract conclusion and includes the information required for the provision of services and billing as well as contact information to hold any necessary consultations. If we receive access to information of end customers, employees, or other persons, we process this in accordance with legal and contractual requirements; legal bases: performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR).
  • Offer of software and platform services: We process the data of our users, registered and any test users (collectively referred to as "users"), to be able to provide them with our contractual services and based on legitimate interests to ensure the security of our offering and to be able to further develop it. The required information is marked as such in the context of the order, purchase, or comparable contract conclusion and includes the information required for the provision of services and billing as well as contact information to hold any necessary consultations; legal bases: performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR).
  • Technical services: We process the data of our customers and clients (collectively referred to as "customers") to enable them to select, acquire, or commission the chosen services or works and associated activities as well as their payment and provision or execution or performance. The required information is marked as such in the context of the order, purchase, or comparable contract conclusion and includes the information required for the provision of services and billing as well as contact information to hold any necessary consultations. If we receive access to information of end customers, employees, or other persons, we process this in accordance with legal and contractual requirements; legal bases: performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR).

Providers and Services Used in the Course of Business Operations

In the course of our business operations, we use additional services, platforms, interfaces, or plugins from third-party providers (short "services") while complying with the legal requirements. Their use is based on our interests in proper, lawful, and - This text area must be unlocked with a premium license.

  • Processed data types: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history - This text area must be unlocked with a premium license.); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); contract data (e.g., contract subject, term, customer category - This text area must be unlocked with a premium license. - premium text premium text).
  • Affected individuals: Customers; interested parties; users (e.g., website visitors, users of - This text area must be unlocked with a premium license.); business and contractual partners.
  • Purposes of processing: Performance of contractual services and customer service; office and organizational procedures.
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Provision of Online Offerings and Web Hosting

We process the data of users to be able to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user's browser or device.

  • Processed data types: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); content data (e.g., entries in online forms).
  • Affected individuals: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures; performance of contractual services and customer service; firewall.
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

    • Further notes on processing procedures, methods, and services:

    • Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". The server log files may include the address and name of the accessed websites and files, date and time of access, transferred data volumes, message about successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), and usually IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure server utilization and stability; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); deletion of data: Log file information is stored for a maximum of 90 days and then deleted or anonymized. Data that needs to be retained for evidence purposes is excluded from deletion until the respective incident is finally clarified.
    • STRATO: Services in the field of providing information technology infrastructure and associated services (e.g., storage space and/or computing capacities); service provider: STRATO AG, Pascalstraße 10, 10587 Berlin, Germany; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.strato.de; privacy policy: https://www.strato.de/datenschutz; processing agreement: Provided by the service provider.
    • 1&1 IONOS: Services in the field of providing information technology infrastructure and associated services (e.g., storage space and/or computing capacities); service provider: 1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.ionos.de; privacy policy: https://www.ionos.de/terms-gtc/terms-privacy; processing agreement: https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/auftragsverarbeitung/.
    • Wordfence: Firewall and security as well as error detection functions to detect and prevent unauthorized access attempts and technical vulnerabilities that could allow such access. For these purposes, cookies and similar storage procedures required for this purpose can be used, and security protocols can be created during the check and especially in the event of unauthorized access. In this context, the IP addresses of the users, a user identification number, and their activities, including the time of access, are processed and stored and compared with the data provided by the provider of the firewall and security function and transmitted to them; service provider: Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.wordfence.com; privacy policy: https://www.wordfence.com/privacy-policy/; standard contractual clauses (ensuring data protection level in case of processing in third countries): https://www.wordfence.com/standard-contractual-clauses/; further information: https://www.wordfence.com/help/general-data-protection-regulation/.

Blogs and Publication Media

We use blogs or similar means of online communication and publication (hereinafter referred to as "publication medium"). The data of readers are processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. In other respects, we refer to the information on the processing of visitors of our publication medium in the context of this privacy policy.

  • Processed data types: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Affected individuals: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Performance of contractual services and customer service; feedback (e.g., collecting feedback via online form); provision of our online offering and user-friendliness; security measures; management and response to inquiries.
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

  • Comments and contributions: When users leave comments or other contributions, their IP addresses may be stored based on our legitimate interests. This is done for our security in case someone leaves illegal content in comments and contributions (insults, prohibited political propaganda, etc.). In this case, we can be held liable for the comment or contribution and are therefore interested in the identity of the author. We also reserve the right, based on our legitimate interests, to process the information of users for spam detection purposes. On the same legal basis, we reserve the right to store IP addresses of users for the duration of surveys and to use cookies to avoid multiple votes. The information provided in the context of comments and contributions regarding the person, any contact, and website information as well as the content will be permanently stored by us until the users object; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
  • Medium: Hosting platform for blogs/websites; service provider: A Medium Corporation, P.O. Box 602, San Francisco, CA 94104–0602, USA; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://medium.com/; privacy policy: https://medium.com/policy/medium-privacy-policy-f03bf92035c9.

Contact and Inquiry Management

When contacting us (e.g., by post, contact form, email, phone, or via social media) and within existing user and business relationships, the information of the requesting persons is processed to the extent necessary to respond to the contact inquiries and any requested measures.

  • Processed data types: Contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Affected individuals: Communication partners.
  • Purposes of processing: Contact requests and communication; management and response to inquiries; feedback (e.g., collecting feedback via online form); provision of our online offering and user-friendliness.
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR).

Further notes on processing procedures, methods, and services:

  • Contact form: When users contact us via our contact form, email, or other communication channels, we process the data provided in this context to handle the communicated request; legal bases: performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
  • HubSpot: Customer management as well as process and sales support with personalized customer care through multi-channel communication, i.e., management of customer inquiries from various channels as well as with analysis and feedback functions; service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; legal bases: performance of a contract and prior requests (Art. 6(1) sentence 1 lit. b GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.hubspot.de; privacy policy: https://legal.hubspot.com/de/privacy-policy; processing agreement: https://legal.hubspot.com/dpa; standard contractual clauses (ensuring data protection level in case of processing in third countries): https://legal.hubspot.com/dpa.

Newsletters and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter "newsletters") only with the consent of the recipients or a legal permission. If the contents of the newsletter are specifically described within the scope of a registration, they are decisive for the consent of the users. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal address in the newsletter or other information, if necessary, for the purposes of the newsletter.

Double-opt-in procedure: Registration for our newsletter generally takes place in a so-called double-opt-in procedure. This means that after registration, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with external email addresses. The registrations for the newsletter are logged to be able to prove the registration process in accordance with the legal requirements. This includes the storage of the registration and confirmation times as well as the IP address. Likewise, the changes to your data stored with the shipping service provider are logged.

Deletion and restriction of processing: We can store the unsubscribed email addresses for up to three years based on our legitimate interests before deleting them to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that at the same time, the former existence of consent is confirmed. In the case of obligations to permanently observe objections, we reserve the right to store the email address alone for this purpose in a blocklist (so-called "blocklist").

The logging of the registration process is based on our legitimate interests for the purposes of proving its proper course. If we commission a service provider to send emails, this is done based on our legitimate interests in an efficient and secure dispatch system.

Contents:

Information about us, our services, promotions, and offers.

  • Processed data types: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); usage data (e.g., visited websites, interest in content, access times).
  • Affected individuals: Communication partners.
  • Purposes of processing: Direct marketing (e.g., by email or post).
  • Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR).
  • Opt-out option: You can unsubscribe from our newsletter at any time, i.e., revoke your consents or object to further receipt. A link to cancel the newsletter can be found either at the end of each newsletter or you can otherwise use one of the above contact options, preferably email, for this purpose.

Further notes on processing procedures, methods, and services:

  • Measurement of open and click rates: The newsletters contain a so-called "web-beacon", i.e., a pixel-sized file that is retrieved from our server or, if we use a shipping service provider, from its server when the newsletter is opened. Within the scope of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, are initially collected. This information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. This information is assigned to individual newsletter recipients and stored in their profiles until their deletion. The evaluations help us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of open rates and click rates and the storage of the measurement results in the profiles of the users - This text area must be unlocked with a premium license. Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR).

Promotional Communication via Email, Post, Fax, or Phone

We process personal data for the purposes of promotional communication, which can be carried out via various channels, such as email, phone, post, or fax, in accordance with legal requirements.

The recipients have the right to revoke given consents at any time or to object to promotional communication at any time.

After revocation or objection, we store the data required to prove the previous authorization to contact or send for up to three years after the end of the year of revocation or objection based on our legitimate interests. The processing of this data is limited to the purpose of possible defense against claims. Based on the legitimate interest in permanently observing the objection or revocation of the users, we also store the data necessary to avoid further contact (e.g., depending on the communication channel, the email address, phone number, name).

  • Processed data types: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers).
  • Affected individuals: Communication partners.
  • Purposes of processing: Direct marketing (e.g., by email or post).
  • Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Web Analytics, Monitoring, and Optimization

Web analytics (also referred to as "reach measurement") serves the evaluation of visitor flows to our online offering and can include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can recognize, for example, when our online offering or its functions or content are most frequently used or invite reuse. Likewise, we can understand which areas need optimization.

In addition to web analytics, we may also use test procedures to optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e., data compiled into a usage process, can be created and information stored in a browser, or a device can be accessed. The collected information includes, in particular, visited websites and used elements, as well as technical information such as the browser used, the computer system used, and information on usage times. If users have consented to the collection of their location data, this can also be processed.

IP addresses of users are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. Generally, the IP addresses of users are shortened within web analytics, A/B testing, and optimization, and no clear data of users (such as email addresses or names) are stored, but pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the data stored in their profiles for the respective procedures.

  • Processed data types: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Affected individuals: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); profiles with user-related information (creating user profiles); A/B tests; feedback (e.g., collecting feedback via online form); heatmaps (mouse movements by users, summarized into an overall picture).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

  • Matomo: Matomo is a privacy-friendly web analytics software that is used without cookies and where the recognition of returning users is done with the help of a so-called "digital fingerprint" that is anonymously stored and changed every 24 hours; In the case of the "digital fingerprint", user movements within our online offering are recorded with the help of pseudonymized IP addresses in combination with user-side browser settings so that conclusions about the identity of individual users are not possible. The data collected as part of the use of Matomo are only processed by us and not shared with third parties; legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://matomo.org/.
  • Visual Website Optimizer: Visual Website Optimizer - Testing and optimization; service provider: Wingify Software Private Limited, 404, Gopal Heights, Netaji Subhash Place, Pitam Pura, Delhi 110034, India; legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR); website: https://vwo.com; privacy policy: https://vwo.com/privacy-policy/.

Customer Reviews and Rating Procedures

We participate in review and rating procedures to evaluate, optimize, and promote our services. If users rate us via the participating rating platforms or procedures or otherwise provide feedback, the General Terms and Conditions or Terms of Use and the privacy notices of the providers also apply. As a rule, rating also requires registration with the respective providers.

To ensure that the reviewers have actually used our services, we transmit the necessary data regarding the customer and the service used to the respective rating platform (including name, email address, and order number or item number) with the customer's consent. This data is used solely to verify the authenticity of the user.

  • Processed data types: Contract data (e.g., contract subject, term, customer category); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Affected individuals: Customers; users (e.g., website visitors, users of online services).
  • Purposes of processing: Feedback (e.g., collecting feedback via online form); marketing.
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

  • Rating widget: We integrate so-called "rating widgets" into our online offering. A widget is a functional and content element embedded in our online offering that displays variable information. It can be displayed, for example, in the form of a seal or similar element, sometimes also called a "badge". The corresponding content of the widget is displayed within our online offering, but it is retrieved from the servers of the respective widget provider at that moment. Only in this way can the current content always be displayed, especially the respective current rating. For this, a data connection from the website called up within our online offering to the server of the widget provider must be established, and the widget provider receives certain technical data (access data, including the IP address) that are necessary to deliver the content of the widget to the user's browser. Furthermore, the widget provider receives information that users have visited our online offering. This information can be stored in a cookie and used by the widget provider to recognize which online offerings that participate in the rating procedure have been visited by the user. The information can be stored in a user profile and used for advertising or market research purposes; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
  • kununu: Rating platform; service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.kununu.com/de; privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Presences in Social Networks (Social Media)

We maintain online presences within social networks and process data from users in this context to communicate with the users active there or to offer information about us.

We point out that the data of users may be processed outside the European Union. This can result in risks for the users because, for example, the enforcement of the users' rights could be more difficult.

Furthermore, the data of users within social networks are usually processed for market research and advertising purposes. For example, user profiles can be created based on the usage behavior and resulting interests of the users. The usage profiles can, in turn, be used to place advertisements inside and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behavior and interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective processing forms and the opt-out options, we refer to the privacy statements and information provided by the operators of the respective networks.

Also, in the case of information requests and the assertion of data subject rights, we point out that these can be most effectively asserted with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, you can contact us.

  • Processed data types: Contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Affected individuals: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Contact requests and communication; feedback (e.g., collecting feedback via online form); marketing.
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

  • LinkedIn: Social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; processing agreement: https://legal.linkedin.com/dpa; standard contractual clauses (ensuring data protection level in case of processing in third countries): https://legal.linkedin.com/dpa; opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
  • YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); privacy policy: https://policies.google.com/privacy; opt-out option: https://adssettings.google.com/authenticated.
  • Xing: Social network; service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.xing.de; privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plugins and Embedded Functions as well as Contents

We integrate function and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, graphics, videos, or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the users, as they could not send the content to their browser without the IP address. The IP address is therefore necessary for the presentation of this content or functions. We endeavor to use only such content whose respective providers use the IP address only for the delivery of the content. Third-party providers can also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Through the "pixel tags", information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information can also be stored in cookies on the user's device and include technical information about the browser and operating system, referring websites, visit time, and other information about the use of our online offering, as well as being linked to such information from other sources.

  • Processed data types: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); location data (information on the geographical position of a device or a person).
  • Affected individuals: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; marketing; profiles with user-related information (creating user profiles).
  • Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

  • Integration of third-party software, scripts, or frameworks (e.g., jQuery): We integrate software into our online offering that we retrieve from the servers of other providers (e.g., functional libraries that we use for the presentation or user-friendliness of our online offering). The respective providers collect the IP address of the users and can process it for the purposes of transmitting the software to the users' browsers and for security purposes, as well as for the evaluation and optimization of their offer; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
  • Google Fonts (retrieval from the Google server): Retrieval of fonts (and symbols) for the purpose of a technically secure, maintenance-free, and efficient use of fonts and symbols regarding up-to-dateness and loading times, their uniform display, and consideration of possible licensing restrictions. The IP address of the user is communicated to the provider of the fonts so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, used hardware) are transmitted, which are necessary for the provision of the fonts depending on the devices used and the technical environment. This data can be processed on a server of the font provider in the USA - When visiting our online offering, the users' browsers send their browser HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving the fonts). The Google Fonts Web API provides the users with the Cascading Style Sheets (CSS) from Google Fonts and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the Internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the User-Agent, which describes the browser and operating system versions of the website visitors, as well as the referring URL (i.e., the website on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, User-Agent, and referring URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families that the user wants to load fonts for. This data is logged so that Google can determine how often a particular font family is requested. For the Google Fonts Web API, the User-Agent must adjust the font generated for the respective browser type. The User-Agent is primarily logged and used for debugging and generating aggregated usage statistics to measure the popularity of font families. These aggregated usage statistics are published on the "Analytics" page of Google Fonts. Finally, the referring URL is logged so that the data can be used for production maintenance and to generate an aggregated report on the top integrations based on the number of font requests. According to its own information, Google does not use any of the information collected by Google Fonts to create profiles of end users or to display targeted ads; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://fonts.google.com/; privacy policy: https://policies.google.com/privacy; further information: https://developers.google.com/fonts/faq/privacy?hl=de.
  • Google Maps: We integrate the maps of the service "Google Maps" of the provider Google. The processed data may include, in particular, IP addresses and location data of the users; service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://mapsplatform.google.com/; privacy policy: https://policies.google.com/privacy.
  • LinkedIn Plugins and Content: LinkedIn Plugins and Content - These can include, for example, content such as images, videos, or texts and buttons that allow users to share content from this online offering within LinkedIn; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; processing agreement: https://legal.linkedin.com/dpa; standard contractual clauses (ensuring data protection level in case of processing in third countries): https://legal.linkedin.com/dpa; opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
  • YouTube Videos: Video content; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy; opt-out option: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://adssettings.google.com/authenticated.
  • Xing Plugins and Buttons: Xing Plugins and Buttons - These can include, for example, content such as images, videos, or texts and buttons that allow users to share content from this online offering within Xing; service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); website: https://www.xing.com; privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.