Privacy

WACH Studio GmbH
Hakenbusch 5
49078 Osnabrück, Germany

Represented by the managing directors Torben Heuer and Fredo Gerdes

Email address: hell@wach.studio
Phone: +49 541 93 93 33 0

Legal notice: wach.studio/impressum

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Master data.
• Payment data.
• Location data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.
• Log data.

Categories of data subjects

• Service recipients and clients.
• Prospective customers.
• Communication partners.
• Users.
• Business and contractual partners.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security measures.
• Reach measurement.
• Office and organisational procedures.
• Organisational and administrative procedures.
• Feedback.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.
• Public relations.
• Business processes and business management procedures.

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6 (1) sentence 1 lit. a) GDPR) – Die betroffene Person hat ihre Einwilligung in die Verarbeitung der sie betreffenden personenbezogenen Daten für einen spezifischen Zweck oder mehrere bestimmte Zwecke gegeben.
• Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b) GDPR) – Die Verarbeitung ist für die Erfüllung eines Vertrags, dessen Vertragspartei die betroffene Person ist, oder zur Durchführung vorvertraglicher Maßnahmen erforderlich, die auf Anfrage der betroffenen Person erfolgen.
• Legal obligation (Art. 6 (1) sentence 1 lit. c) GDPR) – Die Verarbeitung ist zur Erfüllung einer rechtlichen Verpflichtung erforderlich, der der Verantwortliche unterliegt.
• Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR) – die Verarbeitung ist zur Wahrung der berechtigten Interessen des Verantwortlichen oder eines Dritten notwendig, vorausgesetzt, dass die Interessen, Grundrechte und Grundfreiheiten der betroffenen Person, die den Schutz personenbezogener Daten verlangen, nicht überwiegen.

National data protection regulations in Germany: Zusätzlich zu den Datenschutzregelungen der DSGVO gelten nationale Regelungen zum Datenschutz in Deutschland. Hierzu gehört insbesondere das Gesetz zum Schutz vor Missbrauch personenbezogener Daten bei der Datenverarbeitung (Bundesdatenschutzgesetz – BDSG). Das BDSG enthält insbesondere Spezialregelungen zum Recht auf Auskunft, zum Recht auf Löschung, zum Widerspruchsrecht, zur Verarbeitung besonderer Kategorien personenbezogener Daten, zur Verarbeitung für andere Zwecke und zur Übermittlung sowie automatisierten Entscheidungsfindung im Einzelfall einschließlich Profiling. Ferner können Landesdatenschutzgesetze der einzelnen Bundesländer zur Anwendung gelangen.

Note on the applicability of the GDPR and the Swiss FADP: This privacy notice serves to provide information under both the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used because of their broader territorial application and comprehensibility. In particular, instead of the terms used in the Swiss FADP, “processing” of “personal data”, “overriding interest” and “particularly sensitive personal data”, the terms used in the GDPR, “processing” of “personal data”, “legitimate interest” and “special categories of data”, are used. However, the legal meaning of the terms continues to be determined by the Swiss FADP within the scope of its application.

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to it, input, disclosure, ensuring availability and separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the deletion of data and responses to threats to the data. We also take the protection of personal data into account when developing or selecting hardware, software and procedures in accordance with the principle of data protection by design and by default.

Securing online connections with TLS/SSL encryption technology (HTTPS): to protect users’ data transmitted via our online services from unauthorised access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), protecting the data from unauthorised access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by HTTPS in the URL. This serves as an indicator for users that their data is transmitted securely and in encrypted form.

In the course of our processing of personal data, it may happen that such data is transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and in particular conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

Data transfer within the organisation: data transfer within the group of companies: we may transfer personal data to other companies within our group of companies or grant them access to it. Where the data is shared for administrative purposes, this is based on our legitimate business and commercial interests or takes place insofar as it is necessary to fulfil our contractual obligations or if the consent of the data subjects or a legal permission exists.

We delete the personal data we process in accordance with the legal provisions as soon as the underlying consents are withdrawn or there are no further legal bases for processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule exist where legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where there are several statements on the retention period or deletion deadlines for an item of data, the longest period always applies.

If a period does not expressly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in which data is stored, the event triggering the period is the time at which the termination or other ending of the legal relationship takes effect.

Data that is no longer retained for its originally intended purpose but due to legal requirements or other reasons is processed by us exclusively for the reasons that justify its retention.

Further information on processing operations, procedures and services

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

• 10 Jahre – Aufbewahrungsfrist für Bücher und Aufzeichnungen, Jahresabschlüsse, Inventare, Lageberichte, Eröffnungsbilanz sowie die zu ihrem Verständnis erforderlichen Arbeitsanweisungen und sonstigen Organisationsunterlagen, Buchungsbelege und Rechnungen (§ 147 Abs. 3 i. V. m. Abs. 1 Nr. 1, 4 und 4a AO, § 14b Abs. 1 UStG, § 257 Abs. 1 Nr. 1 u. 4, Abs. 4 HGB).
• 6 Jahre – Übrige Geschäftsunterlagen: empfangene Handels- oder Geschäftsbriefe, Wiedergaben der abgesandten Handels- oder Geschäftsbriefe, sonstige Unterlagen, soweit sie für die Besteuerung von Bedeutung sind, z. B. Stundenlohnzettel, Betriebsabrechnungsbögen, Kalkulationsunterlagen, Preisauszeichnungen, aber auch Lohnabrechnungsunterlagen, soweit sie nicht bereits Buchungsbelege sind und Kassenstreifen (§ 147 Abs. 3 i. V. m. Abs. 1 Nr. 2, 3, 5 AO, § 257 Abs. 1 Nr. 2 u. 3, Abs. 4 HGB).
• 3 Jahre – Daten, die erforderlich sind, um potenzielle Gewährleistungs- und Schadensersatzansprüche oder ähnliche vertragliche Ansprüche und Rechte zu berücksichtigen sowie damit verbundene Anfragen zu bearbeiten, basierend auf früheren Geschäftserfahrungen und üblichen Branchenpraktiken, werden für die Dauer der regulären gesetzlichen Verjährungsfrist von drei Jahren gespeichert (§§ 195, 199 BGB).

Rights of data subjects under the GDPR: as a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to access this data as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of incorrect data concerning you.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be deleted immediately or, alternatively, to request a restriction of the processing of the data in accordance with the legal requirements.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”), within the framework of contractual and comparable legal relationships and related measures and with regard to communication with the contractual partners (or pre-contractually), for example to answer enquiries.

We use this data to fulfil our contractual obligations. These include in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we use the data to safeguard our rights and for the purpose of the administrative tasks associated with these obligations as well as company organisation. We also process the data on the basis of our legitimate interests in proper and economical business management as well as in security measures to protect our contractual partners and our business operations from misuse and from threats to their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisers, payment service providers or tax authorities). Within the scope of applicable law, we only pass on the data of contractual partners to third parties insofar as this is necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners are informed about other forms of processing, for example for marketing purposes, within the scope of this privacy policy.

We inform the contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after four years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archiving reasons (e.g. generally ten years for tax purposes). We delete data disclosed to us by the contractual partner in the course of an order in accordance with the requirements and generally after the end of the order.

• Types of data processed: Master data (e.g. full name, home address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers). Contract data (e.g. subject matter of the contract, term, customer category).
• Data subjects: Service recipients and clients; prospective customers. Business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures; organisational and administrative procedures. Business processes and business management procedures.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b) GDPR); legal obligation (Art. 6 (1) sentence 1 lit. c) GDPR). Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services

• Agency services: We process our customers’ data within the scope of our contractual services, which may include, for example, conceptual and strategic consulting, campaign planning, software and design development/consulting or maintenance, implementation of campaigns and processes, handling, server administration, data analysis/consulting services and training services; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b) GDPR).

We process users’ data in order to be able to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved). Log data (e.g. log files relating to logins or the retrieval of data or access times).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures. Provision of contractual services and fulfilment of contractual obligations.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services

• Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files can be used on the one hand for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks), and on the other hand to ensure the utilisation and stability of the servers; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is necessary for evidence purposes is excluded from deletion until the respective incident has been finally clarified.
• 1&1 IONOS: Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: 1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR); Website: https://www.ionos.de; Privacy policy: https://www.ionos.de/terms-gtc/terms-privacy. Data processing agreement: https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/auftragsverarbeitung/.

Cookies are small text files or other storage notes that store information on devices and read information from them. For example, to save the login status in a user account, the contents of a shopping basket in an online shop, the content accessed or functions used in an online offering. Cookies can also be used for various purposes, such as the functionality, security and convenience of online offerings and the analysis of visitor flows.

Information on consent: We use cookies in accordance with the statutory provisions. We therefore obtain prior consent from users unless it is not required by law. Consent is in particular not required if the storage and reading of information, including cookies, is strictly necessary to provide users with a telemedia service they have expressly requested (i.e. our online offering). The revocable consent is clearly communicated to them and contains the information on the respective use of cookies.

Information on legal bases under data protection law: The legal basis on which we process users’ personal data with the help of cookies depends on whether we ask them for consent. If users accept, the legal basis for processing their data is the declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in the economic operation of our online offering and improving its usability) or, if this takes place in the context of fulfilling our contractual obligations, if the use of cookies is necessary to meet our contractual obligations. We explain the purposes for which we use cookies in the course of this privacy policy or as part of our consent and processing procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device has been closed. For example, the login status can be saved and preferred content displayed directly when the user visits a website again. Likewise, the user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information on the type and storage period of cookies (e.g. when obtaining consent), they should assume that the cookies are permanent and that the storage period can be up to two years.

General information on withdrawal and objection (opt-out): Users can withdraw the consent they have given at any time and also object to the processing in accordance with the legal requirements, including via the privacy settings of their browser.

• Types of data processed: Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR). Consent (Art. 6 (1) sentence 1 lit. a) GDPR).

Further information on processing operations, procedures and services

• Processing of cookie data on the basis of consent: We use a consent management solution in which users’ consent to the use of cookies or to the procedures and providers named within the consent management solution is obtained. This procedure serves to obtain, log, manage and withdraw consents, in particular with regard to the use of cookies and comparable technologies used to store, read and process information on users’ devices. As part of this procedure, users’ consents to the use of cookies and the associated processing of information, including the specific processing operations and providers named in the consent management procedure, are obtained. Users also have the option of managing and withdrawing their consents. The declarations of consent are stored in order to avoid asking again and to be able to provide proof of consent in accordance with the legal requirements. Storage takes place on the server side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies in order to be able to assign the consent to a specific user or their device. Unless specific information on the providers of consent management services is available, the following general information applies: consent is stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g. relevant categories of cookies and/or service providers) and information about the browser, system and device used; Legal bases: Consent (Art. 6 (1) sentence 1 lit. a) GDPR).
• Our own consent management: Via the cookie notice at the bottom of the website, we obtain your consent to the categories “Statistics” and “Marketing”, store your choice and allow you to withdraw it. Your choice (selected categories and time) is stored exclusively in the cookie “wach_consent” on your device (storage period 12 months) and is not transmitted to third parties. Without consent, no statistics or marketing services are loaded. You can change or withdraw your choice at any time via the “Cookies” link in the footer of the website; Service provider: Executed on our own web server under our own responsibility under data protection law; Legal bases: Legal obligation (Art. 6 (1) sentence 1 lit. c) GDPR), Section 25 (2) TDDDG.

When you contact us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information provided by the persons making the enquiry is processed insofar as this is necessary to answer the contact enquiries and any requested measures.

• Types of data processed: Master data (e.g. full name, home address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts as well as information relating to them, such as authorship or time of creation); usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: Communication partners.
• Purposes of processing: Communication; organisational and administrative procedures; feedback (e.g. collecting feedback via an online form). Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR). Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b) GDPR).
• Customer management (CRM): Anfragen über das Kontaktformular und Einträge über das Freelancer-Formular werden zusätzlich in unseren eigenen internen Systemen gespeichert (Kundenverwaltung und Team-App „WACH Hub“), damit wir sie im Team bearbeiten und nachverfolgen können. Die Kundenverwaltung läuft bei Google Cloud (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland) auf Servern in der EU (Belgien und Deutschland). Der WACH Hub speichert seine Daten bei Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapur 318992) auf Servern in Frankfurt am Main (Deutschland). Mit beiden Anbietern bestehen Auftragsverarbeitungsverträge; soweit dabei ein Zugriff aus Drittländern möglich ist, auf Grundlage der EU-Standardvertragsklauseln.
• Freelancer form: Wenn du dich über unsere Seite „Freelancer“ einträgst, speichern wir deine Angaben (Name, Kontaktdaten, Location, Bereiche, Erfahrung, Gear, Programme, Tagessatz, Portfolio) in unserer Kontaktverwaltung, um dich für passende Produktionen anzufragen. Rechtsgrundlage ist deine Einwilligung (Art. 6 Abs. 1 S. 1 lit. a) DSGVO). Du kannst sie jederzeit formlos widerrufen, dann löschen wir deine Angaben. Den Newsletter bekommst du nur, wenn du ihn ausdrücklich ankreuzt.

Further information on processing operations, procedures and services

• Contact form: Bei Kontaktaufnahme über unser Kontaktformular, per E-Mail oder anderen Kommunikationswegen, verarbeiten wir die uns übermittelten personenbezogenen Daten zur Beantwortung und Bearbeitung des jeweiligen Anliegens. Dies umfasst in der Regel Angaben wie Name, Kontaktinformationen und gegebenenfalls weitere Informationen, die uns mitgeteilt werden und zur angemessenen Bearbeitung erforderlich sind. Wir nutzen diese Daten ausschließlich für den angegebenen Zweck der Kontaktaufnahme und Kommunikation. Die Angaben aus unseren Anfrageformularen (Name, E-Mail-Adresse, optional Telefonnummer und Unternehmen, gewählte Leistungen und Zeitraum sowie Ihre Nachricht) werden per E-Mail an uns übermittelt und nicht in einer Datenbank der Website gespeichert. Zum Schutz vor Missbrauch und Spam speichern wir für die Dauer von einer Stunde einen nicht rückrechenbaren Hashwert Ihrer IP-Adresse, um die Zahl der Anfragen zu begrenzen. Wenn Sie in die Kategorie „Statistik“ bzw. „Marketing“ eingewilligt haben, erfassen Google Analytics, Google Ads und der Meta-Pixel lediglich, dass eine Anfrage abgeschickt wurde – nicht deren Inhalt; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b) GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Web analytics (also referred to as “reach measurement”) is used to evaluate the flow of visitors to our online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis we can, for example, recognise at what time our online offering or its functions or content are used most frequently, or invite visitors to use them again. It also enables us to understand which areas need optimisation.

In addition to web analytics, we may also use testing procedures, for example to test and optimise different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data combined into a usage process, may be created for these purposes and information may be stored in a browser or device and then read from it. The information collected includes in particular websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

In addition, users’ IP addresses are stored. However, we use an IP masking procedure (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no plain user data (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation, but pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, only the information stored in their profiles for the purpose of the respective procedures.

Information on legal bases: if we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles). Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”. Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users’ devices for a period of two years).
• Security measures: IP masking (pseudonymisation of the IP address).
• Legal bases: Consent (Art. 6 (1) sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services

• Google Analytics: We use Google Analytics to measure and analyse the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain any unique data such as names or email addresses. It is used to assign analysis information to a device in order to recognise which content users have accessed within one or different usage processes, which search terms they have used, accessed again or interacted with our online offering. The time and duration of use are also stored, as well as the sources of users referring to our online offering and technical aspects of their devices and browsers. Pseudonymous user profiles are created with information from the use of different devices, and cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, IP address data is used exclusively for this derivation of geolocation data before being deleted immediately. It is not logged, is not accessible and is not used for any further purposes. When Google Analytics collects measurement data, all IP lookups are carried out on EU-based servers before the traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/en/about/analytics/; Security measures: IP masking (pseudonymisation of the IP address); Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: Data Privacy Framework (DPF); Option to object (opt-out): Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=en, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and data processed).

We process personal data for the purpose of online marketing. This includes in particular measuring the success of our advertisements (conversion measurement) and showing ads specifically to people who have already shown an interest in our services (remarketing). For this purpose, information is stored in and read from cookies or similar technologies on your device, e.g. pages visited, time of the visit, technical information about the browser and device, and whether a request was sent via our form. We do not transmit plain data such as name or email address.

We only use these services if you have consented to the “Marketing” category in the cookie notice. We only load Google services in so-called consent mode after you have given your consent. You can withdraw your consent at any time with effect for the future via the “Cookies” link in the footer of the website.

• Types of data processed: Usage data (e.g. pages visited, access times, click paths); meta, communication and procedural data (e.g. IP addresses, device and browser information, time stamps).
• Data subjects: Users (e.g. website visitors, prospective customers).
• Purposes of processing: Conversion measurement (measuring the effectiveness of advertising measures); remarketing; audience building; reach measurement.
• Retention and deletion: Cookies are stored for the period specified by the providers, usually up to 13 months (Google) or 90 days (Meta).
• Legal bases: Consent (Art. 6 (1) sentence 1 lit. a) GDPR, Section 25 (1) TDDDG).

Further information on processing operations, procedures and services:

• Google Ads and conversion measurement: We place ads via Google Ads in Google Search and the Google Display Network. Cookies or identifiers are used to measure whether users send us a request after clicking on an ad (conversion). We only receive statistical evaluations, but no information that can be used to identify users personally. In addition, users who have visited our website may be added to remarketing lists in order to show them relevant ads later; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 lit. a) GDPR); Website: https://ads.google.com; Privacy policy: https://policies.google.com/privacy; Contract terms: https://business.safety.google/adscontrollerterms. Basis for third-country transfers: Data Privacy Framework (DPF).
• Meta Pixel and audience building (Custom Audiences): With the Meta Pixel we measure whether users who have seen one of our ads on Facebook or Instagram subsequently visit our website or send a request, and we can show ads specifically to interested people. We are jointly responsible with Meta for the collection of the data and its transmission to Meta (Art. 26 GDPR); further processing is the sole responsibility of Meta; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 lit. a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/; Joint controller agreement: https://www.facebook.com/legal/controller_addendum. Basis for third-country transfers: Data Privacy Framework (DPF).

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users, for example because it could make it more difficult to enforce users’ rights.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on usage behaviour and the resulting interests of users. These in turn may be used, for example, to place advertisements within and outside the networks that presumably correspond to users’ interests. For this reason, cookies are generally stored on users’ computers in which the usage behaviour and interests of the users are stored. In addition, data may also be stored in the usage profiles independently of the devices used by the users (especially if they are members of the respective platforms and logged in there).

For a detailed description of the respective forms of processing and the options to object (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the user data and can take appropriate measures and provide information directly. Should you nevertheless need help, you can contact us.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts as well as information relating to them, such as authorship or time of creation). Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Communication; feedback (e.g. collecting feedback via an online form). Public relations.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services

• Instagram: Social network that enables sharing photos and videos, commenting on and favouriting posts, sending messages, subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: Data Privacy Framework (DPF).
• Facebook pages: Profile innerhalb des sozialen Netzwerks Facebook – Wir sind gemeinsam mit Meta Platforms Ireland Limited für die Erhebung (jedoch nicht die weitere Verarbeitung) von Daten der Besucher unserer Facebook-Seite (sog. „Fanpage“) verantwortlich. Zu diesen Daten gehören Informationen zu den Arten von Inhalten, die Nutzer sich ansehen oder mit denen sie interagieren, oder die von ihnen vorgenommenen Handlungen (siehe unter „Von dir und anderen getätigte und bereitgestellte Dinge“ in der Facebook-Datenrichtlinie: https://www.facebook.com/privacy/policy/), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see “Device information” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, so-called “Page Insights”, to page operators so that they can gain insights into how people interact with their pages and with the content associated with them. We have concluded a special agreement with Facebook (“Information about Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfil the rights of data subjects (i.e. users can, for example, send requests for information or deletion directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information about Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data). Joint responsibility is limited to the collection of data by and its transmission to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which in particular concerns the transfer of the data to the parent company Meta Platforms, Inc. in the USA; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: Data Privacy Framework (DPF).
• LinkedIn: Soziales Netzwerk – Wir sind gemeinsam mit LinkedIn Irland Unlimited Company für die Erhebung (jedoch nicht die weitere Verarbeitung) von Daten der Besucher, die zu Zwecken der Erstellung der „Page-Insights“ (Statistiken) unserer LinkedIn-Profile erstellt werden, verantwortlich. Zu diesen Daten gehören Informationen zu den Arten von Inhalten, die Nutzer sich ansehen oder mit denen sie interagieren, oder die von ihnen vorgenommenen Handlungen sowie Informationen über die von den Nutzern genutzten Geräte (z. B. IP-Adressen, Betriebssystem, Browsertyp, Spracheinstellungen, Cookie-Daten) und Angaben aus dem Profil der Nutzer, wie Berufsfunktion, Land, Branche, Hierarchieebene, Unternehmensgröße und Beschäftigungsstatus. Datenschutzinformationen zur Verarbeitung von Daten der Nutzer durch LinkedIn können den Datenschutzhinweisen von LinkedIn entnommen werden: https://www.linkedin.com/legal/privacy-policy We have concluded a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum (the ‘Addendum’)”, https://legal.linkedin.com/pages-joint-controller-addendum), which regulates in particular which security measures LinkedIn must observe and in which LinkedIn has agreed to fulfil the rights of data subjects (i.e. users can, for example, send requests for information or deletion directly to LinkedIn). The rights of users (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection of data by and its transmission to Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of Ireland Unlimited Company, which in particular concerns the transfer of the data to the parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for third-country transfers: Data Privacy Framework (DPF). Option to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may be, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content”).

Integration always requires that the third-party providers of this content process users’ IP addresses, as they could not send the content to their browsers without the IP address. The IP address is therefore required to display this content or these functions. We endeavour to use only content whose providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offering, but may also be linked to such information from other sources.

Information on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved); master data (e.g. full name, home address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts as well as information relating to them, such as authorship or time of creation). Location data (information on the geographical position of a device or person).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; marketing. Profiles with user-related information (creation of user profiles).
• Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”. Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users’ devices for a period of two years).
• Legal bases: Consent (Art. 6 (1) sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services

• Google Fonts (provided on our own server): Provision of font files for a user-friendly display of our online offering; Service provider: Google Fonts are hosted on our server; no data is transmitted to Google; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).