Data protection

York Freiling
E-Mail: freiling@contentlaw.de

1. Basic information on data processing and legal bases

1.1. This privacy policy explains the nature, scope and purpose of the processing of personal data within our online offering and the associated websites, functions and content (hereinafter collectively referred to as ‘online offering’ or ‘website’). The privacy policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) on which the website is run.

1.2. The terms used, such as ‘personal data’ or its ‘processing’, refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

1.3. The personal data of users processed within the scope of this online offer includes contact data (e.g. first name, last name, email address, telephone number), usage data (e.g. the websites visited on our online offer, interest in our products) and content data (e.g. entries in the contact form).

1.4. The term ‘user’ covers all categories of persons affected by data processing. These include our business partners, customers, interested parties and other visitors to our online offering. The terms used, such as ‘user’, are to be understood as gender-neutral.

1.5. We process users' personal data only in compliance with the relevant data protection regulations. This means that user data is only processed if there is legal permission to do so. This applies in particular if data processing is necessary or legally required for the provision of our contractual services (e.g. order processing) and online services, if the user has given their consent, or if it is based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation and security of our online offering within the meaning of Art. 6 (1) lit. f. GDPR, in particular for reach measurement, creation of profiles for advertising and marketing purposes, collection of access data and use of third-party services.

1.6. We would like to point out that the legal basis for consent is Art. 6 (1) (a) and Art. 7 GDPR, the legal basis for processing for the performance of our services and the implementation of contractual measures is Art. 6 (1) (b) GDPR, the legal basis for processing for the fulfilment of our legal obligations is Art. 6(1)(c) GDPR, and the legal basis for processing to safeguard our legitimate interests is Art. 6(1)(f) GDPR.

2. Security measures

2.1. We take organisational, contractual and technical security measures in line with the latest technology to ensure compliance with data protection laws and to protect the data we process against accidental or intentional manipulation, loss, destruction or access by unauthorised persons.

2.2. The security measures include, in particular, the encrypted transmission of data between your browser and our server.

3. Transfer of data to third parties and third-party providers

3.1. Data will only be disclosed to third parties within the scope of legal requirements. We only disclose user data to third parties if this is necessary for contractual purposes, e.g. on the basis of Art. 6 (1) lit. b) GDPR, or on the basis of legitimate interests pursuant to Art. 6 (1) lit. f) GDPR for the economic and effective operation of our business.

3.2. If we use subcontractors to provide our services, we take appropriate legal precautions and technical and organisational measures to ensure the protection of personal data in accordance with the relevant legal provisions.

3.3. If content, tools or other means from other providers (hereinafter collectively referred to as ‘third-party providers’) are used within the scope of this privacy policy and their registered office is located in a third country, it can be assumed that data will be transferred to the countries where the third-party providers are based. Third countries are countries in which the GDPR is not directly applicable law, i.e. generally countries outside the EU or the European Economic Area. Data is transferred to third countries either if an adequate level of data protection is ensured, if the user has given their consent or if there is other legal permission.

4. Registration

4.1. We process inventory data (e.g. names and addresses as well as contact details of users) for the purpose of fulfilling our contractual obligations and providing services in accordance with Art. 6 (1) lit. b GDPR.

4.2. When you register, log in again, or use our online services, we store your IP address and the time of the respective user action. This storage is based on our legitimate interests, as well as the user's interests in protection against misuse and other unauthorised use. This data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 (1) lit. c GDPR.

4.3. We process usage data (e.g. the websites visited on our online offering, interest in our products) and content data (e.g. entries in the contact form or user profile) for advertising purposes in a user profile in order to display product information to the user based on the services they have used so far or to send it to them by email.

5. Contacting us

5.1. When contacting us (via contact form or email), the user's details are processed for the purpose of handling the contact request and its processing in accordance with Art. 6 (1) lit. b) GDPR.

5.2. User details are stored in our marketing automation software Act-On and HubSpot. For this purpose, we have concluded a contract with Act-On and HubSpot containing standard contractual clauses, in which the company undertakes to process user data only in accordance with our instructions and to comply with EU data protection standards. Act-On and HubSpot are also certified under the Privacy Shield Agreement, which provides an additional guarantee of compliance with European data protection law.

6. Collection of access data and log files

6.1. Based on our legitimate interests within the meaning of Art. 6 (1) lit. f GDPR, we collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, the file, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

6.2. Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum of seven days and then deleted. Data that must be retained for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

6.3. Our website also contains a so-called ‘web beacon’, i.e. a pixel-sized file that is retrieved from the server of the software provider Act-On and HubSpot (see above) when you visit the website. During this retrieval, technical information such as information about your browser and your system, as well as your IP address and the time of retrieval, is initially collected. This information is used to improve the technical aspects of the services based on the technical data or the target groups and their reading behaviour based on their retrieval locations (which can be determined using the IP address) or access times. Statistical surveys also include determining when a website was visited and which links were clicked. This information can be assigned to individual website visitors. The evaluations help us to identify the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

6.4. Our website uses tracking pixel technology from wiredminds GmbH (www.wiredminds.de) to analyse visitor behaviour. In doing so, data may be collected, processed and stored, from which usage profiles are created under a pseudonym. Where possible and appropriate, these usage profiles are completely anonymised. Cookies may be used for this purpose. Cookies are small text files that are stored in the visitor's Internet browser and serve to recognise the Internet browser. The data collected, which may also include personal data, is transmitted to wiredminds or collected directly by wiredminds. wiredminds may use information left behind by visits to the websites to create anonymised user profiles. The data obtained in this way will not be used to personally identify visitors to this website without the express consent of the person concerned, and will not be merged with personal data about the bearer of the pseudonym. If IP addresses are recorded, they are immediately anonymised by deleting the last number block. You can opt out of tracking here:

7. Cookies & reach measurement

7.1. Cookies are pieces of information that are transferred from our web server or third-party web servers to users' web browsers and stored there for later retrieval. Cookies can be small files or other types of information storage.

7.2. We use ‘session cookies’, which are only stored for the duration of the current visit to our website. A randomly generated unique identification number, known as a session ID, is stored in a session cookie. A cookie also contains information about its origin and storage period. These cookies cannot store any other data. Session cookies are deleted when you have finished using our online presence and, for example, log out or close your browser.

7.3. Users are informed about the use of cookies for pseudonymous reach measurement in this privacy policy.

7.4. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. The exclusion of cookies may lead to functional restrictions of this online offer.

7.5. You can object to the use of cookies for reach measurement and advertising purposes via the deactivation page of the Network Advertising Initiative and additionally via the US website or the European website.

8. Google Analytics

8.1. Based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6 para. 1 lit. f. GDPR), we use Google Analytics, a web analytics service provided by Google Inc. (‘Google’). Google uses cookies. The information generated by the cookie about the use of the online offer by users is usually transferred to a Google server in the USA and stored there.

8.2. Google is certified under the Privacy Shield Agreement and thus offers a guarantee to comply with European data protection law.

8.3. Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on the activities within this online offering and to provide us with further services related to the use of this online offering and the Internet. In doing so, pseudonymous user profiles of users can be created from the processed data.

8.4. We use Google Analytics to display ads placed within Google's advertising services and those of its partners only to users who have shown an interest in our online offering or who have certain characteristics (e.g. interests in specific topics or products, which are determined based on the websites visited) that we transmit to Google (so-called ‘Remarketing Audiences’ or ‘Google Analytics Audiences’). With the help of remarketing audiences, we also want to ensure that our ads correspond to the potential interests of users and do not appear intrusive.

8.5. We only use Google Analytics with IP anonymisation enabled. This means that the IP address of users is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.

8.6. The IP address transmitted by the user's browser is not merged with other data from Google. Users can prevent the storage of cookies by adjusting their browser software settings accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online offer, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link or, alternatively, by clicking on the following link to set a so-called opt-out cookie.

8.7. Further information on data use by Google, settings and objection options can be found on Google's websites:
Data use by Google when you use our partners' websites or apps
Data use for advertising purposes
Manage information that Google uses to show you ads

9. Google-Re/Marketing-Services

9.1. Based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6 para. 1 lit. f. GDPR), we use the marketing and remarketing services (in short, ‘Google Marketing Services’) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (‘Google’).

9.2. Google is certified under the Privacy Shield Agreement and thus offers a guarantee of compliance with European data protection law.

9.3. Google Marketing Services allow us to display advertisements for and on our website in a more targeted manner, so that users are only shown advertisements that potentially match their interests. If, for example, a user is shown advertisements for products that they have shown interest in on other websites, this is referred to as ‘remarketing’. For these purposes, when our website and other websites on which Google Marketing Services are active are accessed, a code from Google is executed directly by Google and so-called (re)marketing tags (invisible graphics or code, also known as ‘web beacons’) are integrated into the website. With their help, an individual cookie, i.e. a small file, is stored on the user's device (comparable technologies can also be used instead of cookies). The cookies can be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com and googleadservices.com. This file records which websites the user has visited, which content they are interested in and which offers they have clicked on, as well as technical information about the browser and operating system, referring websites, visit time and other information about the use of the online offer. The IP address of the user is also recorded, whereby we inform you within the scope of Google Analytics that the IP address is truncated within member states of the European Union or in other signatory states to the Agreement on the European Economic Area and only in exceptional cases is it transferred in full to a Google server in the USA and truncated there. The IP address is not merged with user data within other Google services. The above-mentioned information may also be linked by Google to information from other sources. When the user subsequently visits other websites, advertisements tailored to their interests may be displayed.

Translated with DeepL.com (free version)

9.4. User data is processed pseudonymously within the framework of Google Marketing Services. This means that Google does not store and process the name or email address of users, for example, but processes the relevant data in relation to cookies within pseudonymous user profiles. This means that, from Google's perspective, the ads are not managed and displayed for a specifically identified person, but for the cookie owner, regardless of who that cookie owner is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymisation. The information collected by Google Marketing Services about users is transmitted to Google and stored on Google's servers in the United States.

9.5. The Google marketing services we use include the online advertising programme ‘Google AdWords’. In the case of Google AdWords, each AdWords customer receives a different ‘conversion cookie’. Cookies cannot therefore be tracked across the websites of AdWords customers. The information collected using the cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking. AdWords customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.

9.6. We may also use the Google Optimizer service. Google Optimizer allows us to use A/B testing to track the impact of various changes to a website (e.g. changes to input fields, design, etc.). Cookies are stored on users' devices for these testing purposes. Only pseudonymous user data is processed.

9.7. Furthermore, we may use Google Tag Manager to integrate and manage Google's analytics and marketing services on our website.

9.8. For more information on Google's use of data for marketing purposes, please refer to Google's overview page and privacy policy.

9.9. If you wish to object to interest-based advertising by Google Marketing Services, you can use the settings and opt-out options provided by Google.

10. Newsletter

10.1. The following information explains the content of our newsletter, the registration, dispatch and statistical evaluation procedures, and your rights of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.

10.2. Content of the newsletter: We send newsletters, emails and other electronic notifications with promotional information (hereinafter referred to as ‘newsletters’) only with the consent of the recipients or with legal permission. If the content of the newsletter is specifically described during the registration process, this description is decisive for the consent of the users. Our newsletters also contain information about our products, offers, promotions and our company.

10.3. Double opt-in and logging: Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary to prevent anyone from registering with someone else's email address. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address. Changes to your data stored by the mailing service provider are also logged.

10.4. Shipping service providers: The newsletter is sent using Evalanche from SC-Networks GmbH, SC-Networks GmbH, Enzianstr. 2, 82319 Starnberg, Germany, or Act-On from Act-On Software, Inc, 121 SW Morrison St, #1600, Portland, Oregon 97204, USA, as well as HubSpot from HubSpot, Unter den Linden 26, 10117 Berlin, hereinafter referred to as ‘shipping service providers’. You can view the shipping service providers' privacy policies here:
SC-Networks GmbH
Act-On Software, Inc
HubSpot, Inc

10.5. Furthermore, according to their own information, the shipping service providers may use this data in pseudonymous form, i.e. without assignment to a user, to optimise or improve their own services, e.g. for technical optimisation of the dispatch and presentation of the newsletters or for statistical purposes to determine which countries the recipients come from. However, the shipping service provider does not use the data of our newsletter recipients to write to them itself or pass it on to third parties.

10.6. Registration data: To register for the newsletter, we require your email address and, optionally, your title and name so that we can address you personally in the newsletter.

10.7. Statistical collection and analysis: The newsletters contain a so-called ‘web beacon’, i.e. a pixel-sized file that is retrieved from the server of the mailing service provider when the newsletter is opened. During this retrieval, technical information such as information about your browser and your system, as well as your IP address and the time of retrieval, is initially collected. This information is used for technical improvement of the services based on the technical data or the target groups and their reading behaviour based on their retrieval locations (which can be determined using the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. This information can be assigned to the individual newsletter recipients. The evaluations help us to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

10.8. The use of the shipping service provider, the performance of statistical surveys and analyses, and the logging of the registration process are based on our legitimate interests pursuant to Art. 6 (1) lit. f GDPR. Our interest is focused on the use of a user-friendly and secure newsletter system that serves both our business interests and meets the expectations of users.

10.9. Termination/revocation: You can unsubscribe from our newsletter at any time, i.e. revoke your consent. This also revokes your consent to the newsletter being sent by the mailing service provider and to statistical analyses. Unfortunately, it is not possible to revoke the dispatch by the dispatch service provider or the statistical evaluation separately. A link to unsubscribe from the newsletter can be found at the end of each newsletter. If users have only subscribed to the newsletter and have cancelled this subscription, their personal data will be deleted.

11. Online presence on social media

We maintain online presences within social networks and platforms in order to communicate with interested parties and users and to inform them about our services there.

We expressly point out that user data may be processed outside the European Union. This may result in risks for users. With regard to US providers certified under the Privacy Shield, we point out that they are obliged to comply with EU data protection standards.

Furthermore, user data is generally processed for market research and advertising purposes. For example, usage profiles can be created based on user behaviour and the resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements within and outside the platforms that are presumed to correspond to the interests of the users. For these purposes, cookies are usually stored on users' computers, in which the usage behaviour and interests of users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by users (especially if users are members of the respective platforms and are logged in to them).

The processing of users' personal data is based on our legitimate interests in effectively informing users and communicating with them in accordance with Art. 6(1)(f) GDPR. If users are asked by the respective providers to consent to data processing (i.e. to declare their consent, e.g. by ticking a checkbox or confirming a button), the legal basis for the processing is Art. 6 para. 1 lit. a, Art. 7 GDPR.

For a detailed description of the respective processing operations and the options for objection (opt-out), we refer to the information provided by the providers linked below.

In the case of requests for information and the assertion of user rights, we would also like to point out that these can be most effectively asserted with the providers. Only the providers have access to the user data and can take appropriate measures and provide information directly. However, if you still require assistance, please contact us.

In the case of requests for information and the assertion of user rights, we would like to point out that these can be most effectively asserted with the providers. Only the providers have access to user data and can take appropriate measures and provide information directly. If you still require assistance, please contact us.

Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – Privacy Policy: https://www.facebook.com/about/privacy/, Opt-Out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com, Privacy Shield: https://www.privacyshield.gov/

Google/YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Privacy policy: https://policies.google.com/privacy, opt-out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/

Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) – Privacy Policy: https://twitter.com/de/privacy, Opt-Out: https://twitter.com/personalization, Privacy Shield: https://www.privacyshield.gov/

Pinterest (Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA) – Privacy Policy/Opt-Out: https://about.pinterest.com/de/privacy-policy.

Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) – Privacy policy/opt-out: https://privacy.xing.com/de/datenschutzerklaerung.

12. Integration of third-party services and content

12.1. Within our online offering, we use third-party content or services on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6 para. 1 lit. f. GDPR) content or service offerings from third-party providers in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as ‘content’). This always requires that the third-party providers of this content perceive the IP address of the users, as they would not be able to send the content to their browsers without the IP address. The IP address is therefore necessary for the display of this content. We endeavour to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as ‘web beacons’) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, visit time and other information about the use of our online offering, and may also be linked to such information from other sources.

12.2. The following list provides an overview of third-party providers and their content, along with links to their privacy policies, which contain further information on data processing and, in some cases, already mentioned here, options for objection (so-called opt-out):

External fonts from Google, Inc., www.google.com/fonts (‘Google Fonts’). Google Fonts are integrated by calling up a server at Google (usually in the USA). Privacy policy: www.google.com/policies/privacy/, opt-out: www.google.com/settings/ads/.

Maps from the ‘Google Maps’ service provided by the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: www.google.com/policies/privacy/, opt-out: www.google.com/settings/ads/.

Videos from the YouTube platform provided by third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: www.google.com/policies/privacy/, opt-out: www.google.com/settings/ads/.

13.  User rights

13.1. Users have the right to request, free of charge, information about the personal data we have stored about them.

13.2. In addition, users have the right to correct inaccurate data, restrict the processing and deletion of their personal data, where applicable, to assert their rights to data portability and, in the event of unlawful data processing, to lodge a complaint with the competent supervisory authority.

13.3. Users may also revoke their consent, in principle with effect for the future.

14.  Deletion of data

14.1. The data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no legal retention obligations preventing its deletion. If the user data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to user data that must be retained for commercial or tax reasons.

14.2. In accordance with legal requirements, data is stored for 6 years in accordance with Section 257 (1) of the German Commercial Code (HGB) (trading books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting documents, etc.) and for 10 years in accordance with Section 147 (1) of the German Fiscal Code (AO) (books, records, management reports, accounting documents, commercial and business letters, documents relevant for taxation, etc.).

15. Right to object

Users may object to the future processing of their personal data at any time in accordance with the statutory provisions. In particular, the objection may be made against processing for direct marketing purposes.

16. Changes to the privacy policy

16.1. We reserve the right to change the privacy policy in order to adapt it to changed legal situations or in the event of changes to the service or data processing. However, this only applies to statements regarding data processing. If user consent is required or if parts of the privacy policy contain provisions governing the contractual relationship with users, changes will only be made with the consent of the users.

16.2. Users are asked to regularly review the content of the privacy policy.