Privacy policy

Controller

Contact details of our data protection officer

Introduction and general information on data processing

A. Definitions

• 1. Personal data

  According to Art. 4 No. 1 GDPR, personal data means any information relating to an identified or identifiable natural person (data subject).

  A person is identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or information relating to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

  Identifiability can also be provided by linking such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photos, vid-eo or audio recordings can also contain personal data).

• 2. Processing

  According to Art. 4 No. 2 GDPR, processing means any operation which is performed on personal data, whether or not by automated means (i.e. using technical specifications). This includes, in particular, the collection (i.e. acquisition), recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data, or alteration of the purposes for which they were originally processed.

• 3. Controller

  According to Art. 4 No. 7 GDPR, the controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

• 4. Processor

  According to Art. 4 No. 8 GDPR, a processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller in accordance with the controller’s instructions (e.g. IT service provider). In terms of data protection law, a processor is not a third party.

• 5. Third party

  According to Art. 4 No. 10 GDPR, a third party is any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorized to process the personal data; this also includes other legal entities belonging to the group.

• 6. Consent

  According to Art. 4 No. 11 GDPR, consent means any freely given, specific, informed and unambiguous indication of the data subject’s wish by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

B. General information on data processing

• 1. Scope of the processing of personal data

  As a matter of principle, we only collect data whose processing is either required by law, which is necessary for the conclusion and execution of a contract, in whose processing we have an overriding legitimate interest or which is provided to us voluntarily on the basis of consent.

  We collect, store and use personal data from you as a visitor to our website only insofar as this is necessary to provide a functional website and to present our content and services. In addition, the collection and use of your personal data only takes place regularly with your consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

• 2. Legal bases for the processing of personal data

  a. Data processing for contract initiation and fulfillment
  When processing personal data that is required to initiate or fulfill a contract with you, Art. 6 (1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

  b. Data processing on the basis of consent
  Insofar as we obtain your consent for the processing of personal data, Art. 6 (1)(a) GDPR serves as the legal basis. We only base the processing of your personal data on consent if this is not already permitted on other legal grounds.

  We also ask for your consent if we wish to provide information about our own products and services and events, and it is not possible to process your data in order to protect legit-imate interests or if we ask you to take part in a survey.

  c. Data processing for the protection of legitimate interests
  We only process your personal data in accordance with Art. 6 (1)(f) GDPR to safeguard legitimate interests if the further requirements of Art. 6 (1)(f) GDPR are met, i.e. if our interests in data processing or the interests of a third party outweigh your interests or fun-damental rights and freedoms in the individual case.

  Furthermore, we use your personal data if and insofar as this is necessary to protect our legitimate interests, e.g. for the defense and enforcement of claims. In this respect, data processing is also based on Art. 6 (1)(f) GDPR.

  d. Data processing for the fulfillment of legal obligations
  If and to the extent necessary, we process your personal data in order to comply with any statutory documentation obligations, e.g. vis-à-vis tax offices and supervisory authorities. In this case, data processing is carried out on the basis of Art. 6 (1)(c) GDPR.

  In addition, we process your personal data in accordance with Art. 6 (1)(c) GDPR for the purpose of a detailed examination as to whether an order may be accepted. The same applies to the statutory obligation imposed on us to identify our business partners and the other obligations under the provisions of the German Money Laundering Act (Geldwäschegesetz).

• 3. Data erasure and storage duration

  Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which we are subject.

  Your personal data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage for the conclusion or fulfillment of a contract.

• 4. Security through the use of TLS/SSL

  If you transmit your personal data to us via our website, we use current, secure technologies, in particular the so-called “Transport Layer Security” (TLS) transmission (previously also known as “Secure Socket Layer” (SSL) transmission). All information and data transmitted using these secure methods is encrypted before it is sent to us. In addition, to protect you and us from misuse, the IP address of your device is transmitted to us. We would like to point out that encryption using these technical methods only works if the corresponding technical default settings have also been initiated on your side.

• 5. Data recipients

  Your personal data may be passed on by us to third parties. We only transfer your person-al data to third parties if we are authorized to do so under data protection law. The transfer of data to third parties is based either on the fulfillment of legal obligations, on legitimate interests, on the necessity of fulfilling a contract or on the basis of any consent given.

  If external service providers act as processors, the data transfer takes place within the framework of an data processing agreement pursuant to Art. 28 GDPR, which ensures that the data is only processed on and within our instructions and that the processor com-plies with the data protection regulations.

  If it is necessary to transfer data to third parties or processors in countries outside the Eu-ropean Economic Area, this is done either on the basis of approved EU standard contractual clauses or on the basis of an adequacy decision issued by the EU Commission.

C. Data processing when using the website

• 1. Storage of cookies

  We use so-called cookies to make visiting our website attractive and to enable the use of certain functions. Cookies are small text files that are automatically stored on your device.

  Some of the cookies we use are deleted again after the end of the browser session, i.e. after closing the browser (so-called “session cookies”). Other cookies remain on your device and enable us to recognize your browser on your next visit (so-called “persistent cookies”). The duration of storage can be found in the overview in the cookie settings of the web browser.

  We also differentiate between cookies that are technically necessary for the operation of the website and those that are used for analysis and statistical purposes. When you visit our website for the first time, a GDPR-compliant notice (hereinafter: “consent banner”) appears and you can select which cookies are stored. There you can also see which cookies are stored in detail and for which processing purposes.

  You can also adjust your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings.

  We expressly point out that the functionality of our website may be restricted if cookies are not accepted.

  If personal data is also processed by implemented cookies, which are technically necessary for the operation of our website, the processing is carried out in accordance with Art. 6 (1)(f) GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.

  If personal data is processed by implemented cookies, which are used for analysis and statistical purposes, the processing is carried out in accordance with Art. 6 (1)(a) GDPR on the basis of your consent, which you give us by making the corresponding selection decision in the consent banner. You can withdraw your consent at any time. You can call up our consent banner in the footer again and adjust your settings.

• 2. Provision of the website and storage of log files

  Each time our website is accessed, our system automatically collects data and information from the system of the accessing device.

  The following data is collected:

  • IP address
  • Browser type and browser version
  • Operating system
  • Date and time of the visit to the website
  • Access status / Http status code
  • GMT time zone difference
  • Amount of data transferred 
  • Website/source/reference from which the website was accessed

  This data is also collected and stored by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, which hosts our website.

  This data is not stored together with your other personal data.

  Temporary storage of the IP address by the system is necessary to enable delivery of the website to your device. For this purpose, your IP address must remain stored for the duration of the session. The data is stored in log files to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. The data is not analyzed for any other purpose.

  This is also our legitimate interest in data processing within the meaning of Art. 6 (1)(f) GDPR, which serves as the legal basis for the processing of your personal data in the context of the collection of log files.

  The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. If the data is stored in log files, this is the case after 7 days at the latest. Storage beyond this period is possible. In this case, your IP address will be deleted or anonymized so that it is no longer possible to identify the accessing client.

• 3. Use of Borlabs Cookie

  We use the WordPress plugin Borlabs Cookie on our website. The provider of the plugin is Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg, Germany (hereinafter “Borlabs”).

  Borlabs Cookie automatically creates a consent banner for our website visitors and allows you to give your consent to data processing – in particular to the setting of cookies – on our website and to exercise your right of revocation for consents already provided.

  With the help of Borlabs Cookie, we are able to keep track of the cookies used on our website and inform you accurately and transparently about their use at any time. You will always receive a consent banner that complies with data protection regulations and you can decide which types of cookies should be allowed.

  Your consent status is stored in the consent banner so that our website can recognize and follow the stored status even during future visits to the site. To do this, a cookie is set and the following data is stored:

  • Cookie lifetime
  • Cookie version
  • Domain and path of the WordPress website
  • Einwilligungen
  • UID (randomly generated ID)

  This data is not transferred to Borlabs or any other third parties.

  For more information on data protection at Borlabs, please visit:

  https://borlabs.io/privacy/

  If you would like to change the settings you made when you first visited our website, you can either delete the cookie in your browser or call up our consent banner again and adjust your settings. You will find the corresponding link in the footer of our website.

  The legal basis for the processing of your personal data is Art. 6 (1)(c) GDPR. We are legally obliged under Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz; TDDDG) to provide a data protection-compliant consent banner on our website that allows you to select and deselect cookies.

  The data is stored for twelve months, starting from the time you give your consent in the consent banner. After that, your data will be automatically deleted.

• 4. Use of Google Tag Manager

  We use the service called Google Tag Manager from Google. Google is a group of companies and consists of the companies Google Ireland Ltd (provider of the service), Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as well as other affiliated companies of Google LLC (hereinafter: "Google").

  This service allows website tags to be managed via an interface. The service does not set any cookies and does not collect any personal data itself. Google Tag Manager ensures that other components are loaded, which in turn may collect data, but does not access this data. You can find more information about Google Tag Manager in Google's privacy policy at

  https://policies.google.com/privacy?hl=en.

  Google Tag Manager used on our website executes the tags according to your selection decision in the consent banner.

  If you decide against the storage of cookies for purposes other than those required for the operation of the website, the consent banner ensures that only tags are executed via the Google Tag Manager, as a result of which technically necessary cookies are set. In this case, the legal basis for the processing of your personal data by Google Tag Manager is Art. 6 (1)(f) GDPR. Our legitimate interest lies in the optimization of our website.

  If you accept cookies in the consent banner that are not only technically necessary for the operation of the website, your personal data will be processed based on your consent in accordance with Art. 6 (1)(a) GDPR.

  Your consent can be revoked at any time with effect for the future. You can call up our consent banner in the footer again and adjust your settings.

• 5. Use Google Analytics

  Our website uses Google Analytics, a web analysis service from Google.

  Google Analytics uses cookies that enable us to analyze the use of our website. The information generated by the cookies about your use of our website (including IP address) is transmitted to a Google server in the USA and stored there.

  Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google may associate your IP address with other data held by Google.

  You can prevent the installation of cookies by selecting the appropriate settings in your browser software. You can prevent tracking by Google Analytics by using the deactiva-tion tools that Google offers for some Internet browsers. You can also prevent the collec-tion of data generated by Google Analytics and related to your use of the website (including IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link:

  https://tools.google.com/dlpage/gaoptout?hl=en

  However, we would like to point out that you may not be able to use all functions of our website to their full extent if you take respective measures to prevent this.

  Your personal data is processed on the basis of your consent in accordance with Art. 6 (1)(a) GDPR, which you give us by making your selection decision in the consent banner.

  The transfer of your personal data to the USA takes place in accordance with Art. 45 GDPR on the basis of the adequacy decision issued for the USA, with which the EU Commission has determined a level of data protection in the USA comparable to that in the EU. Google has certified itself for the EU-US Data Privacy Framework on which the adequacy decision is based (please see https://www.dataprivacyframework.gov/s/participant-search).

  Your consent can be revoked at any time with effect for the future. You can call up our consent banner in the footer again and adjust your settings.

• 6. Use of Google Ads

  We use Google Ads from Google on our website.

  Google Ads is an online advertising program that enables us to display advertisements in the Google search engine or on third-party websites when you enter certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be displayed to you based on the user data available at Google (e.g. location data and interests) (target group targeting). As a website operator, we can evaluate this data quantitatively by analyzing, for example, which search terms led to the display of our advertisements and how many advertisements resulted in corresponding clicks.

  Your personal data is processed on the basis of your consent in accordance with Art. 6 (1)(a) GDPR, which you give us by making your selection decision in the consent banner.

  The transfer of your personal data to the USA takes place in accordance with Art. 45 GDPR on the basis of the adequacy decision issued for the USA, with which the EU Commission has determined a level of data protection in the USA comparable to that in the EU. Google has certified itself for the EU-US Data Privacy Framework on which the adequacy decision is based (please see https://www.dataprivacyframework.gov/s/participant-search).

  Your consent can be revoked at any time with effect for the future. You can call up our consent banner in the footer again and adjust your settings.

• 7. Use of Google Fonts

  We use Google Fonts from Google on our website. Google Fonts is an interactive directory with more than 800 fonts that Google provides for free use.

  The Google fonts are integrated on our web server and not on Google’s servers. We therefore use Google Fonts locally. Personal data is not processed and data is not transferred to Google in connection with the use of Google Fonts.

• 8. Use of Pipedrive

  We use Pipedrive, a service provided by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia (hereinafter “Pipedrive”) as our Customer Relationship Management System (CRM).

  Pipedrive serves us to manage customer and prospect data and to organize and optimize our sales and communication processes. In doing so, we process the personal data that you provide to us in the context of your inquiry, the business relationship between us, or in the course of using one of our services (e.g., name, e-mail address, telephone number, company position, other communication content). The use of the CRM system also enables us to analyze our customer-related processes. The data is stored on Pipedrive’s servers.

  Pipedrive is used to fulfill the contract with you or to initiate it in accordance with Art. 6 (1)(b) GDPR. If you contact us outside of an existing or pending customer relation-ship, Art. 6 (1)(f) GDPR serves as the legal basis. In the latter case, our legitimate interest lies in managing inquiries and communicating as efficiently as possible.

• 9. External links

  We maintain online presences on social networks as well as on career- and streaming platforms in order to exchange information with the users registered there, to get in touch easily and to make our company better known. On our website you will therefore find link buttons to our company profiles on Facebook, Instagram, LinkedIn and YouTube.

  We do not use any plugins from these networks, but only link to our accounts on our website. You will therefore only be redirected to our accounts on the websites of the indi-vidual networks. This means that no data is transmitted to the servers of these networks when you visit our website. Your data will only be forwarded to their servers when you are on the network pages via a link.

  Please log out of your respective accounts beforehand if you do not want your visit to our website to be assigned to your personal account on the respective third-party site of its operators.

  Clicking on the link buttons opens the login screen of the respective third-party site. If you are already logged in there at this time, you will be taken directly to our stored profile.

  In principle, the operators of the networks are responsible for the processing of your personal data on these external websites. However, we would like to draw your attention to the following:

  a. Instagram and Facebook
  Clicking on the Instagram link button will take you to our company profile on Instagram and clicking on the Facebook link button will take you to our company profile on Facebook.

  Instagram is a social media platform and is operated by Instagram LLC, which since 2012 has been a subsidiary of Meta Platforms Inc, 1601 Willow Road, Menlo Park, CA 94025, USA, and Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: "Meta"). Facebook is also a social media platform and is also operated by Meta.

  We would like to point out that you use Instagram and Facebook and their functions at your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also access parts of the information offered via this page on our website.

  When you visit our company profiles on Instagram or Facebook, Meta collects, among other things, your IP address and other information that is stored on your device in the form of cookies. This information is used to provide us, as the operator of the Instagram or Facebook profile, with statistical information about the use of the company profile.

  The data collected about you in this context will be processed by Meta and may be transferred to countries outside the European Union. What information Meta receives and how it is used is described in general terms in Meta’s data usage guidelines. There you will also find information on how to contact Meta and on the settings options for advertisements. The data usage guidelines are available at the following link:

  https://www.facebook.com/privacy/policy/?entry_point=facebook_page_footer

  Meta does not clearly state how it uses the data from visits to Instagram and Facebook pages for its own purposes, to what extent activities on Instagram and Facebook pages are assigned to individual users, how long Meta stores this data and whether data from a visit to the Instagram and Facebook pages is passed on to third parties, and we are not aware of this.

  When you access the Instagram and Facebook page, the IP address assigned to your device is transmitted to Meta. According to Meta, this IP address is anonymized (for "German" IP addresses). Meta also stores information about the devices of its users (e.g. as part of the "login notification" function); Meta may thus be able to assign IP addresses to individual users.

  If you are currently logged in to Instagram or Facebook as a user, a cookie with your Instagram or Facebook ID is stored on your device. This enables Meta to recognize that you have visited this page. This also applies to all other Instagram and Facebook pages.

  Instagram and Facebook buttons integrated into websites enable Meta to record your visits to these websites and assign them to your Instagram or Facebook profile. This data can be used to tailor content or advertise to you.

  If you want to avoid this, you should log out of Instagram or Facebook or deactivate the "stay logged in" function, delete the cookies on your device and close and restart your browser. In this way, information that can be used to directly identify you will be deleted. This allows you to use our Instagram or Facebook page without revealing your Instagram or Facebook ID. If you access interactive functions on the page (like, comment, share, message, etc.), an Instagram or Facebook login screen will appear. After logging in, you will again be recognizable to Meta as a specific user.

  Information on how to manage or delete information about you can be found on the following support page:

  https://www.facebook.com/privacy/policy/?entry_point=facebook_page_footer

  b. LinkedIn
  If you click the LinkedIn button on our website, you will be redirected to our LinkedIn account. LinkedIn is operated by LinkedIn Corporation, 1000 West Maude Avenue Sunnyvale, CA 94085, USA, or as the controller in terms of data protection for users from Germany by LinkedIn Ireland Unlimited Company, 70 Sir John Rogerson's Quay, Dublin 2, Dublin, D02r296, Ireland (hereinafter: "LinkedIn").

  LinkedIn is an internet-based social network for connecting users with existing business contacts and for generating new business contacts. Companies can create profiles and post job offers on LinkedIn.

  We would like to point out that you use LinkedIn and its functions at your own responsibility. This applies to the use of the interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also access parts of the information offered via this page on our website.

  When you visit our LinkedIn page, LinkedIn collects, among other things, your IP address and other information that is stored on your device in the form of cookies. This information is used to provide us, as the operator of the LinkedIn page, with statistical information about the use of the LinkedIn page.

  LinkedIn provides more information on this under the following link:

  https://www.linkedin.com/legal/privacy-policy

  The data collected about you in this context is processed by LinkedIn and may be transferred to countries outside the European Union. LinkedIn describes in general terms what information LinkedIn receives and how it is used in its data usage guidelines.

  There you will also find information on how to contact LinkedIn and on the settings options for advertisements. LinkedIn's data usage guidelines are available at the following link:

  https://www.linkedin.com/legal/privacy-policy

  LinkedIn does not conclusively and clearly state how it uses the data from visits to LinkedIn pages for its own purposes, to what extent activities on the LinkedIn page are assigned to individual users, how long LinkedIn stores this data and whether data from a visit to the LinkedIn page is passed on to third parties, and we are not aware of this.

  When you access a LinkedIn page, the IP address assigned to your device is transmitted to LinkedIn. According to LinkedIn, this IP address is anonymized (for "German" IP addresses) and deleted after 90 days. LinkedIn also stores information about the devices of its users (e.g. as part of the "login notification" function); LinkedIn may thus be able to assign IP addresses to individual users.

  If you are currently logged in to LinkedIn, a cookie with your LinkedIn ID is stored on your device. This enables LinkedIn to track that you have visited this website and how you have used it. This also applies to all other LinkedIn pages. LinkedIn buttons integrated into websites enable LinkedIn to record your visits to these websites and assign them to your LinkedIn profile. This data can be used to tailor content or advertise to you.

  If you want to avoid this, you should log out of LinkedIn or deactivate the "stay logged in" function, delete the cookies on your device and close and restart your browser. In this way, LinkedIn information that can be used to directly identify you will be deleted. This allows you to use our LinkedIn page without revealing your LinkedIn ID. If you access interactive functions on the page (like, comment, share, message, etc.), a LinkedIn login screen will appear. After logging in, you will again be recognizable to LinkedIn as a specific user.

  You can find information on how to manage or delete information about you on the following LinkedIn support page:

  https://www.linkedin.com/legal/privacy-policy

  c. YouTube
  If you click on the YouTube button on our website, you will be redirected to the YouTube platform. YouTube is operated by Google.

  We would like to point out that you use this YouTube channel and its functions on your own responsibility. This applies to the use of the "Discuss" function. We would also like to point out that we have no influence or control over the type and scope of data processed by Google, the type of data processing and the use and disclosure of this data to third parties.

  When using YouTube, your personal data may be collected, transmitted, stored, disclosed, used and transferred to and stored by Google in the USA or third countries in which Google does business, regardless of your place of residence. Data may also be transferred to companies affiliated with Google and other companies and/or persons who process data on behalf of Google.

  Google processes your voluntarily entered data such as name and username, e-mail address and telephone number. Google also records the content that you create, upload or receive from third parties when using the services (e.g. photos, videos, documents, charts, comments) and processes the personal data contained therein. The content you share is analyzed by Google to determine which topics are of interest to you. Google can also determine your location based on your IP address and send you customized advertising or other content.

  Google may use analysis tools such as Google Analytics for evaluation purposes. We have no influence on the use of such tools by Google and have not been informed about their potential use. We have neither commissioned the use of such tools, nor do we support Google in any way. We are also not provided with any data obtained as part of the analysis and we have no way of stopping the use of such tools on our YouTube channel. We can only view certain profiles of subscribers to our YouTube channel.

  Even if you are not registered with YouTube, Google retrieves certain information when you use our YouTube channel, such as IP address, browser type, operating system, previously accessed websites, search terms used, stored cookies and – if you access via a cell phone – mobile phone provider and the device used (including device ID and application ID).

  You can restrict data processing in the general settings of your Google account. Google also offers specific data protection settings for YouTube. You can find more information on this at

  https://policies.google.com/technologies?hl=en

  Information about which data is processed by Google and for what purposes it is used can be found in Google’s data protection information at

  https://policies.google.com/privacy?hl=en

  Finally, you have the option of requesting information from Google via the data protection form:

  https://support.google.com/policies/answer/9581826?visit_id=637054532384299914-2421490167&amp%3Bhl=de&amp%3Brd=3&hl=en&sjid=668704397021306434-EU

D. Further data processing

• 1. Contact by e-mail, telephone or fax

  If you contact us by e-mail, telephone or fax, your request, including the personal data resulting from it, will be processed for the purpose of handling your request.

  The processing of your personal data is based on your consent in accordance with Art. 6 (1)(a) GDPR, which you give us by contacting us. If your request is aimed at concluding a contract with us, the data processing is based on Art. 6 (1)(b) GDPR.

  Subject to statutory retention periods, your personal data will be deleted as soon as we have finally processed your request. If you do not receive a response from us within a period of 10 days, your personal data will also be deleted.

  Your consent can be revoked at any time with effect for the future. To do so, please send us an e-mail to datenschutz@metzen.org. However, we would like to point out that your request cannot be processed further in the event of revocation.

• 2. Contact form

  We have a contact form on our website that you can use to get in touch with us. Depending on the data you enter in the form, this data will be transmitted to us and stored. We al-so record your IP address and the time of sending.

  To use our contact form, we require your name and your e-mail address in order to identify you and send you our reply. However, it is not necessary to provide the other data marked as optional. The same applies to any personal data stored in attachments that you can upload to your request.

  Your personal data is processed on the basis of your consent in accordance with Art. 6 (1)(a) GDPR, which you give us by providing your data. If you wish to work to-wards the conclusion of a contract through your request or your request is made within an existing contractual relationship with us, Art. 6 (1)(b) GDPR serves as the legal basis for the processing of this data.

  Subject to statutory retention periods, your personal data will be deleted as soon as we have finally processed your request. If you do not receive a response from us within a period of 10 days, your personal data will also be deleted.

  Your consent can be revoked at any time with effect for the future. To do so, please send us an e-mail to datenschutz@metzen.org. However, we would like to point out that your request cannot be processed further in the event of revocation.

• 3. Payment and payment processing

  If we offer chargeable services, payment and payment processing is carried out either via external service providers (e.g. Klarna, PayPal, etc.) or by bank transfer by you after receipt of the invoice.

  Your personal data (name, address, bank details, e.g. account numbers as well as the contract, total and recipient-related details) will be stored and, depending on which payment service provider you select in the ordering process, forwarded to the credit institution commissioned with the payment and, if applicable, to the commissioned payment service provider in order to process the payments. In some cases, the selected payment service providers also collect this data and possibly other data (such as credit card numbers, passwords, TANs, checksums) themselves if you have created or are creating an account with them. In this case, you must log in to the payment service provider with your payment details during the ordering process.

  The processing and transfer of your personal data is necessary to be able to process payment transactions for chargeable services offered by us. Furthermore, the processing and transfer of your personal data is necessary to offer you an effective and secure payment option. In the context of the fulfillment of contracts, Art. 6 (1)(b) GDPR serves as the legal basis for the processing and transfer of your personal data. In addition, we use external payment service providers based on our legitimate interests pursuant to Art. 6 (1)(f) GDPR, which consists in the simplest possible processing of order and payment transactions and in fraud prevention.

  The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is usually the case once the contract has been fully processed, provided there is no reasonable likelihood of claims arising from the contractual relationship. However, we are subject to a statutory retention period of 8-10 years starting on the first of January of the year following the year in which the invoice was issued.

E. Your rights as a data subject

• 1. Right of access

  You can request confirmation from us as to whether your personal data is being processed by us. If such processing is taking place, you can request the following information from us in accordance with Art. 15 GDPR:

  • the purposes for which the personal data are processed
  • the categories of personal data that are processed
  • the recipients or categories of recipients to whom your personal data have been or will be disclosed
  • the planned duration of the storage of your personal data or, if specific information on this is not possible, criteria for determining the storage period
  • the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by us or a right to object to such processing
  • the existence of a right to lodge a complaint with a supervisory authority
  • all available information about the origin of the data if the personal data is not collected from you
  • the existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved and the scope and intended impact of such processing on you

  Furthermore, you have the right to request information as to whether your personal data is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

• 2. Right to rectification

  In accordance with Art. 16 GDPR, you have a right to rectification and/or completion vis-à-vis us if your personal data is incorrect and/or incomplete. We must make the correction without delay.

• 3. Right to restriction of processing

  Under the following conditions, you can request the restriction of the processing of your personal data in accordance with Art. 18 GDPR:

  • if you contest the accuracy of your personal data for a period enabling us to verify the accuracy of the personal data
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
  • we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or
  • if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet certain whether our legitimate reasons outweigh your reasons

  If the processing of your personal data has been restricted, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. You will be informed by us before the restriction is lifted.

• 4. Right to erasure

  a. Obligation to delete
  In accordance with Art. 17 GDPR, you can demand that we delete your personal data immediately. We are obliged to delete this data immediately if one of the following reasons applies:

  • your personal data is no longer necessary for the purposes for which it was collected or otherwise processed
  • your consent, on which the processing was based pursuant to Art. 6 (1)(a) GDPR, is revoked by you and there is no other legal basis for the processing
  • you object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing
  • you object to the processing in accordance with Art. 21 (2) GDPR
  • your personal data has been processed unlawfully
  • the deletion of your personal data is necessary to fulfill a legal obligation under Union law or the law of the Member States to which we are subject
  • your personal data was collected in relation to information society services offered in accordance with Art. 8 (1) GDPR

  b. Information to third parties
  If we have made your personal data public and we are obliged to delete it in accordance with Art. 17 (1) GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform controllers who process the personal data that you have requested them to delete all links to this personal data or copies or replications of this personal data.

  c. Exceptions to the right to erasure
  The right to erasure does not exist if the processing is necessary:

  • to exercise the right to freedom of expression and information
  • for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us
  • for reasons of public interest in the area of public health pursuant to Art. 9 (2)(h) and (i) GDPR and Art. 9 (3) GDPR
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in Section 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing
  • for the assertion, exercise or defense of legal claims

• 5. Right to notification

  If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged pursuant to Art. 19 GDPR to notify all recipients to whom your per-sonal data have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.

• 6. Right to data portability

  In accordance with Art. 20 GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller to whom the personal data has been provided without hindrance from us, provided that

  • the processing is based on consent pursuant to Art. 6 (1)(a) GDPR or on a contract pursuant to Art. 6 (1)(b) GDPR and
  • the processing is carried out using automated procedures

  In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be affected by this.

  The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

• 7. Right to object

  Pursuant to Art. 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 (1)(e) or (f) GDPR, including profiling based on those provisions. The objection must be justified.

  If we receive an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

  If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

  Notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object in connection with the use of information society services by means of automated procedures using technical specifications.

• 8. Right to revoke the declaration of consent

  In accordance with Art. 7 (3) GDPR, you have the right to revoke your declaration of consent under data protection law at any time – even before the GDPR came into force (May 25, 2018). The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The revocation of consent can be declared by e-mail to datenschutz@metzen.org or by letter or telephone to our contact details above.

  In addition, you can revoke the consent given in our consent banner at any time. To do so, call up our consent banner again. You will find the link button to the banner in the footer of every subpage of our website.

• 9. Automated decision-making in individual cases including profiling

  In accordance with Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

  • is necessary for the conclusion or performance of a contract between you and us, or
  • is authorized by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
  • with your express consent

  However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2)(a) or (g) GDPR applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests.

  We take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person on our side, to express your own point of view and to contest the decision.

• 10. Right to lodge a complaint with a supervisory authority

  Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.

  The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

  The supervisory authority responsible for us is

  Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
  Ludwig-Erhard-Straße 22
  20459 Hamburg
  Phone: +49 (0)428 54-4040
  E-mail: mailbox@datenschutz.hamburg.de