Privacy policy

Note: This English version of the Privacy Policy is a translation provided for convenience. The legally binding and authoritative version is the German Privacy Policy. In the event of any discrepancies between the two versions, the German version shall prevail.

Preamble

With the following Privacy Policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, the purposes for which we process them, and the extent of such processing. This Privacy Policy applies to all processing of personal data carried out by us, both in connection with the provision of our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the "Online Offering").

The terms used are gender-neutral.

Last updated: October 12, 2026

Controller

Kaffeerösterei Gewinner
Tödistrasse 21
8810 Horgen
Switzerland

Authorized Representative: Joscha Gewinner

Email address: datenschutz@beanwatch.ch

Legal Notice: https://beanwatch.ch/policies/legal-notice

Beanwatch is a trademark of Kaffeerösterei Gewinner.

Overview of Processing Activities

The following overview summarizes the types of data processed, the purposes of processing, and refers to the categories of data subjects concerned.

Types of Data Processed

• Inventory data.
• Payment data.
• Location data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.
• Contact information (Facebook).
• Event data (Facebook).
• Log data.

Categories of Data Subjects

• Service recipients and clients.
• Employees.
• Prospective customers.
• Communication partners.
• Users.
• Business and contractual partners.
• Third parties.
• Customers.

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Direct marketing.
• Reach measurement.
• Tracking.
• Office and organizational procedures.
• Remarketing.
• Conversion measurement.
• Click tracking.
• Audience building.
• A/B testing.
• Organizational and administrative procedures.
• Feedback.
• Heatmaps.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.
• Financial and payment management.
• Public relations.
• Sales promotion.
• Business processes and commercial procedures.
• Artificial Intelligence (AI).

Applicable Legal Bases

Applicable legal bases under the Swiss Federal Act on Data Protection (FADP): If you are located in Switzerland, we process your data on the basis of the Swiss Federal Act on Data Protection ("Swiss FADP"). Unlike the GDPR, the Swiss FADP generally does not require that a specific legal basis be stated for the processing of personal data. Instead, personal data must be processed lawfully, in good faith, and proportionately (Art. 6 para. 1 and 2 Swiss FADP). Furthermore, personal data is only collected for a specific purpose that is recognizable to the data subject and is processed only in a manner compatible with that purpose (Art. 6 para. 3 Swiss FADP).

Security Measures

In accordance with legal requirements and taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data through controls on physical and electronic access to data, as well as access, input, disclosure, availability protection and separation of data. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data and responses to data breaches. We also take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principles of privacy by design and privacy by default.

IP address truncation: Where IP addresses are processed by us or by the service providers and technologies we use, and processing of the full IP address is not required, the IP address is shortened (also referred to as "IP masking"). In this process, the last two digits or the last part of the IP address after a period are removed or replaced with placeholders. The purpose of IP masking is to prevent or significantly hinder the identification of a person based on their IP address.

Securing online connections using TLS/SSL encryption technology (HTTPS): To protect user data transmitted via our online services against unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information exchanged between a website or app and a user's browser (or between two servers), thereby protecting data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is transmitted securely and in encrypted form.

International Data Transfers

Disclosure of personal data abroad: In accordance with the Swiss FADP, we only disclose personal data abroad if an adequate level of protection for the data subjects is ensured (Art. 16 Swiss FADP). If the Swiss Federal Council has not recognized an adequate level of protection (list available at https://www.bj.admin.ch/en/recognition-by-switzerland-of-states-that-guarantee-an-adequate-level-of-data-protection), we implement alternative safeguards.

For data transfers to the United States, we primarily rely on the Data Privacy Framework (DPF), which has been recognized as an adequate legal framework by Switzerland through an adequacy decision dated June 7, 2024. In addition, we have concluded Standard Contractual Clauses (SCCs) with the respective providers, approved by the Swiss Federal Data Protection and Information Commissioner (FDPIC), which establish contractual obligations to protect your data.

This dual protection mechanism ensures comprehensive protection of your data. The DPF serves as the primary layer of protection, while the Standard Contractual Clauses provide an additional safeguard. Should changes occur regarding the DPF, the SCCs act as a reliable fallback mechanism. This ensures that your data remains adequately protected even in the event of political or legal changes.

For each service provider, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. A list of certified companies and further information about the DPF can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (available in English).

For data transfers to other third countries, appropriate safeguards apply, including international agreements, specific guarantees, Standard Contractual Clauses approved by the FDPIC, or binding corporate rules previously recognized by the FDPIC or another competent supervisory authority.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with legal requirements as soon as the underlying consent is withdrawn or no other legal basis for processing exists. This applies in cases where the original purpose of processing no longer applies or the data is no longer required. Exceptions apply where statutory obligations or legitimate interests require longer retention or archiving of data.

In particular, data that must be retained for commercial or tax law purposes, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information regarding the retention and deletion of data that specifically applies to particular processing activities.

If several retention periods or deletion deadlines apply to a particular item of data, the longest retention period shall always prevail. Data that is no longer required for its original purpose but is retained due to legal requirements or other reasons will only be processed for the reasons justifying its retention.

Retention and deletion of data: The following general retention periods apply under Swiss law:

• 10 years: Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting records and invoices, as well as all necessary work instructions and organizational documents (Art. 958f Swiss Code of Obligations).
• 10 years: Data required for the consideration of potential claims for damages or similar contractual claims and rights, as well as the processing of related inquiries, based on previous business experience and common industry practices, is stored for the statutory limitation period of ten years, unless a shorter limitation period of five years applies in specific cases (Art. 127, 130 Swiss Code of Obligations). Claims for rent, lease payments, interest, recurring services, delivery of food, catering, innkeeper claims, craftsmanship, retail sales of goods, medical services, professional services of lawyers, legal agents, procurators and notaries, as well as employment relationships, become time-barred after five years (Art. 128 Swiss Code of Obligations).

Commencement of retention periods at year-end: If a period does not expressly begin on a specific date and lasts at least one year, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in which data is stored, the triggering event is the date on which the termination or other ending of the legal relationship becomes effective.

Rights of Data Subjects

Rights of data subjects under the Swiss FADP:

As a data subject, you have the following rights under the Swiss Federal Act on Data Protection:

• Right of access: You have the right to request confirmation as to whether personal data concerning you is being processed and to receive the information necessary to exercise your rights under this Act and to ensure transparent data processing.
• Right to data portability or disclosure: You have the right to request that the personal data you have provided to us be handed over to you in a commonly used electronic format.
• Right to rectification: You have the right to request the correction of inaccurate personal data concerning you.
• Right to object, erase and destroy: You have the right to object to the processing of your data and to request that personal data concerning you be deleted or destroyed.

Business Services

We process the data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as "contractual partners"), within the scope of contractual and comparable legal relationships as well as related measures and with regard to communication with contractual partners (or pre-contractually), for example to respond to inquiries.

We use this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed services, any update obligations, and remedies for warranty claims and other service disruptions. Furthermore, we use the data to safeguard our rights and for administrative tasks associated with these obligations as well as for corporate organization. In addition, we process the data based on our legitimate interests in proper business management and security measures to protect our contractual partners and our business operations against misuse, risks to their data, confidential information and rights (e.g. involving telecommunications providers, transport and auxiliary services, subcontractors, banks, tax advisors, legal advisors, payment service providers or public authorities). Within the scope of applicable law, we only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about additional forms of processing, such as marketing activities, within this Privacy Policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, for example in online forms, through special markings (e.g. colors), symbols (e.g. asterisks), or personal communication.

We delete data after the expiration of statutory warranty obligations and comparable obligations, generally after four years, unless the data is stored in a customer account or must be retained for legal archiving purposes (for example, ten years for tax purposes). Data disclosed to us by contractual partners within the scope of an assignment is deleted in accordance with the instructions provided and generally upon completion of the assignment.

• Categories of processed data: Inventory data (e.g. full name, residential address, contact information, customer number); payment data (e.g. bank account details, invoices, payment history); contact data (e.g. postal addresses, email addresses and telephone numbers); contract data (e.g. contract subject matter, term, customer category); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Service recipients and clients; prospective customers; business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; communication; office and organizational procedures; organizational and administrative procedures; business processes and commercial procedures.
• Retention and deletion: In accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR); legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Online shop, order forms, e-commerce and fulfillment of services: We process customer data in order to enable the selection, purchase and ordering of products, goods and related services, as well as their payment, provision, delivery or execution. Where necessary for the fulfillment of an order, we use service providers, particularly postal, freight and shipping companies, to carry out delivery or execution for our customers. For payment processing, we use the services of banks and payment service providers. Required information is marked accordingly during the ordering or comparable purchasing process and includes information necessary for delivery, provision and invoicing, as well as contact information for any necessary communication; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR).
• Event management: We process the data of participants in events, functions and similar activities offered or organized by us (hereinafter collectively referred to as "participants" and "events") in order to enable participation and the use of associated services or activities.
  
  If, within this context, we process health-related data, religious, political or other special categories of personal data, this is done either because such information has been made manifestly public (e.g. at topic-specific events), serves health protection or safety purposes, or is processed with the consent of the data subjects.
  
  Required information is marked accordingly within the order, booking or comparable contractual process and includes information necessary for service provision and invoicing, as well as contact details for communication purposes. Where we receive access to information relating to end customers, employees or other individuals, we process such information in accordance with legal and contractual requirements; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR).

Business Processes and Procedures

Personal data of service recipients and clients, including customers, clients, and in special cases principals, patients or business partners, as well as other third parties, is processed within the scope of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates commercial activities in areas such as customer management, sales, payment processing, accounting and project management.

The collected data is used to fulfill contractual obligations and efficiently manage business processes. This includes the execution of business transactions, customer relationship management, optimization of sales strategies, and the maintenance of internal accounting and financial processes. In addition, the data supports the protection of the controller's rights and promotes administrative tasks and corporate organization.

Personal data may be disclosed to third parties where necessary for the fulfillment of the aforementioned purposes or to comply with legal obligations. After statutory retention periods expire or when the purpose of processing ceases to apply, the data is deleted. This also includes data that must be retained for longer periods due to tax or statutory documentation requirements.

• Categories of processed data: Inventory data, payment data, contact data, content data, contract data, usage data, meta, communication and procedural data, and log data.
• Data subjects: Service recipients and clients; prospective customers; communication partners; business and contractual partners; customers; third parties; users (e.g. website visitors and users of online services); employees (e.g. staff members, applicants, temporary workers and other personnel).
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and commercial procedures; security measures; provision of our online offering and user-friendliness; communication; marketing; sales promotion; public relations; financial and payment management; information technology infrastructure.
• Retention and deletion: In accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR).

Further information on processing activities, procedures and services:

• Customer Management and Customer Relationship Management (CRM): Procedures required within the scope of customer management and customer relationship management (CRM), such as customer acquisition in compliance with data protection requirements, measures to promote customer retention and loyalty, effective customer communication, complaint management and customer service while taking data protection into account, data management and analysis to support customer relationships, CRM system administration, secure account management, customer segmentation and audience creation; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Contact Management and Contact Maintenance: Procedures required for organizing, maintaining and safeguarding contact information, such as establishing and maintaining a central contact database, regularly updating contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, conducting backups and restoring contact data, training employees in the effective use of contact management software, and regularly reviewing communication histories and adjusting contact strategies; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Customer Account: Customers may create an account within our online offering (e.g. customer or user account). If registration is required, customers will be informed accordingly and advised of the data required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of the registration process and subsequent logins and use of the customer account, we store customers' IP addresses together with access times in order to verify registration and prevent misuse of customer accounts. If the customer account is terminated, customer account data will be deleted after termination unless retained for purposes other than providing the account functionality or where legal retention obligations apply (e.g. internal storage of customer data, orders or invoices). Customers are responsible for backing up their data before terminating their customer account; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• General Payment Transactions: Procedures required for processing payments, monitoring bank accounts and controlling cash flows, such as preparing and reviewing transfers, processing direct debit transactions, checking account statements, monitoring incoming and outgoing payments, managing returned payments, reconciling accounts and cash management; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Accounting, Accounts Payable and Accounts Receivable: Procedures required for recording, processing and monitoring business transactions in accounts payable and accounts receivable, such as creating and reviewing incoming and outgoing invoices, monitoring and managing outstanding balances, processing payments, debt collection management and account reconciliation; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Financial Accounting and Taxation: Procedures required for recording, managing and monitoring financial transactions as well as calculating, reporting and paying taxes, such as bookkeeping, preparation of quarterly and annual financial statements, payment processing, debt collection management, account reconciliation, tax consulting, preparation and filing of tax returns and tax administration; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Marketing, Advertising and Sales Promotion: Procedures required within the scope of marketing, advertising and sales promotion, such as market analysis and audience identification, development of marketing strategies, planning and execution of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, as well as budget and cost management; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Public Relations: Procedures required within the scope of public relations and communications, such as developing and implementing communication strategies, planning and conducting PR campaigns, preparing and distributing press releases, maintaining media contacts, monitoring and analyzing media coverage, organizing press conferences and public events, crisis communications, creating content for social media and corporate websites, and managing corporate branding; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Use of Online Platforms for Offer and Sales Purposes

We offer our services on online platforms operated by other service providers. In this context, the privacy notices of the respective platforms apply in addition to our privacy notices. This applies in particular with regard to the processing of payments and the procedures used on the platforms for reach measurement and interest-based marketing.

• Categories of processed data: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank account details, invoices, payment history); contact data (e.g. postal addresses, email addresses and telephone numbers); contract data (e.g. contract subject matter, term, customer category); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Service recipients and clients; business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; marketing; business processes and commercial procedures.
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• shopify: Platform through which e-commerce services are offered and provided. The services and the processes carried out in connection with them include, in particular, online stores, websites and their offerings and content, community features, purchasing and payment transactions, customer communication, as well as analytics and marketing; Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.shopify.com/de/. Privacy Policy: https://www.shopify.com/de/legal/datenschutz.

Payment Procedures

Within the framework of contractual and other legal relationships, on the basis of legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, use other service providers in addition to banks and credit institutions (collectively referred to as "payment service providers").

The data processed by the payment service providers includes inventory data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, amount- and recipient-related information. This information is required to carry out the transactions. However, the data entered is processed only by the payment service providers and stored with them. This means that we do not receive any account- or credit card-related information, but only information confirming or declining the payment. Under certain circumstances, the payment service providers transmit the data to credit agencies. The purpose of this transmission is to verify identity and creditworthiness. In this regard, we refer to the general terms and conditions and the privacy notices of the payment service providers.

The terms and conditions and the privacy notices of the respective payment service providers, which can be accessed within the respective websites or transaction applications, apply to the payment transactions. We also refer to these for further information and for the exercise of rights of withdrawal, rights of access and other data subject rights.

• Categories of processed data: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank account details, invoices, payment history); contract data (e.g. contract subject matter, term, customer category); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Service recipients and clients; business and contractual partners; prospective customers.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; business processes and commercial procedures.
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• PayPal: Payment services (technical integration of online payment methods) (e.g. PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal basis: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b GDPR); Website: https://www.paypal.com/de. Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full.
• Shopify Payments: Payment services (technical integration of online payment methods). Payments are processed via Shopify Payments, Shopify's integrated payment platform. It enables customers to use various supported payment methods, depending on the region. Payment processing is carried out on the basis of the Shopify Payments terms of use, which are displayed to the customer during the checkout process. Further information is available at https://www.shopify.com/de/payments; Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal basis: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b GDPR); Website: https://www.shopify.de. Privacy Policy: https://www.shopify.de/legal/datenschutz.

Provision of the Online Offering and Web Hosting

We process users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

• Categories of processed data: Usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons); log data (e.g. log files relating to logins, the retrieval of data or access times).
• Data subjects: Users (e.g. website visitors and users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
• Retention and deletion: In accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Provision of the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also referred to as "web hoster"); Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files may be used, on the one hand, for security purposes, e.g. to prevent server overload (particularly in the event of abusive attacks, so-called DDoS attacks), and, on the other hand, to ensure server load management and stability; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

Use of Cookies

The term "cookies" refers to functions that store information on users' devices and read information from them. Cookies may also be used for various purposes, such as ensuring the functionality, security and convenience of online offerings, as well as analyzing visitor flows. We use cookies in accordance with legal requirements. To this end, we obtain users' prior consent where required. Where consent is not required, we rely on our legitimate interests. This applies where the storage and reading of information is essential in order to provide expressly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online offering. Consent may be withdrawn at any time. We provide clear information about its scope and about which cookies are used.

Information on legal bases under data protection law: Whether we process personal data by means of cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage duration: With regard to storage duration, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device has been closed. For example, the login status can be saved and preferred content can be displayed directly when the user visits a website again. Likewise, user data collected by means of cookies may be used for reach measurement. Unless we provide users with explicit information on the type and storage duration of cookies (e.g. when obtaining consent), users should assume that cookies are permanent and that the storage duration may be up to two years.

General information on withdrawal and objection (opt-out): Users may withdraw any consent they have given at any time and may also object to processing in accordance with legal requirements, including by means of the privacy settings of their browser.

Cookie settings/option to object:

Open cookie settings

• Categories of processed data: Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Users (e.g. website visitors and users of online services).
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

Further information on processing activities, procedures and services:

• Processing of cookie data on the basis of consent: We use a consent management solution through which users' consent to the use of cookies, or to the procedures and providers named within the consent management solution, is obtained. This procedure serves to obtain, log, manage and withdraw consent, in particular with regard to the use of cookies and comparable technologies used to store, read and process information on users' devices. As part of this procedure, users' consent to the use of cookies and the associated processing of information, including the specific processing operations and providers named in the consent management procedure, is obtained. Users also have the option to manage and withdraw their consent. Consent declarations are stored in order to avoid repeated prompts and to be able to provide evidence of consent in accordance with legal requirements. Storage takes place on the server side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies in order to associate the consent with a specific user or their device. Unless specific information is provided about the providers of consent management services, the following general information applies: Consent is stored for up to two years. In this process, a pseudonymous user identifier is generated and stored together with the time of consent, details of the scope of consent (e.g. relevant categories of cookies and/or service providers), as well as information about the browser, the system and the device used; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

Registration, Login and User Account

Users may create a user account. As part of the registration process, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of the fulfillment of contractual obligations. The processed data includes, in particular, the login information (username, password and an email address).

When our registration and login functions are used and when the user account is used, we store the IP address and the time of the respective user action. This storage is based on our legitimate interests as well as those of the users in protection against misuse and other unauthorized use. As a rule, this data is not disclosed to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about processes relevant to their user account, such as technical changes.

• Categories of processed data: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal addresses, email addresses and telephone numbers); content data (e.g. textual or visual messages and contributions, as well as information relating to them, such as information on authorship or time of creation); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); log data (e.g. log files relating to logins, the retrieval of data or access times).
• Data subjects: Users (e.g. website visitors and users of online services).
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; organizational and administrative procedures; provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion". Deletion after termination.
• Legal bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Registration with real names: Due to the nature of our community, we ask users to use our offering only under their real names. This means that the use of pseudonyms is not permitted; Legal basis: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b GDPR).

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (hereinafter referred to as "publication medium"). Readers' data is processed for the purposes of the publication medium only to the extent necessary for its presentation and for communication between authors and readers or for security reasons. Otherwise, we refer to the information on the processing of visitors to our publication medium within this Privacy Policy.

• Categories of processed data: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal addresses, email addresses and telephone numbers); content data (e.g. textual or visual messages and contributions, as well as information relating to them, such as information on authorship or time of creation); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Users (e.g. website visitors and users of online services).
• Purposes of processing: Feedback (e.g. collecting feedback via online form); provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Contact and Inquiry Management

When contacting us (e.g. by post, contact form, email, telephone or via social media) as well as within the context of existing user and business relationships, the information provided by the inquiring persons is processed to the extent necessary to respond to the inquiries and any requested measures.

• Categories of processed data: Contact data (e.g. postal addresses, email addresses and telephone numbers); content data (e.g. textual or visual messages and contributions, as well as related information such as authorship or time of creation); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Communication partners; users; business and contractual partners; prospective customers.
• Purposes of processing: Communication; organizational and administrative procedures; feedback; provision of our online offering and user-friendliness.
• Retention and deletion: In accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Contact form: When contacting us via our contact form, by email or through other communication channels, we process the personal data transmitted to us in order to handle and respond to the respective request. This generally includes information such as name, contact details and, where applicable, further information provided to us that is necessary for appropriate processing. We use this data exclusively for the stated purpose of establishing contact and communication; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Artificial Intelligence (AI)

We use artificial intelligence (AI), in the course of which personal data is processed. The specific purposes and our interest in the use of AI are set out below. In accordance with the term "AI system" as defined in Article 3 No. 1 of the AI Act, we understand AI to mean a machine-based system that is designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that generates, from the input it receives, outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Our AI systems are used in strict compliance with legal requirements. These include both specific rules for artificial intelligence and data protection requirements. In this context, we adhere in particular to the principles of lawfulness, transparency, fairness, human oversight, purpose limitation, data minimization, and integrity and confidentiality. We ensure that the processing of personal data is always carried out on a legal basis. This may be either the consent of the data subjects or a statutory permission.

When using external AI systems, we carefully select their providers (hereinafter referred to as "AI providers"). In accordance with our legal obligations, we ensure that the AI providers comply with the applicable provisions. We likewise observe the obligations incumbent upon us when using or operating the AI services obtained. The processing of personal data by us and by the AI providers takes place exclusively on the basis of consent or statutory authorization. In this context, we place particular emphasis on transparency, fairness and maintaining human oversight over AI-supported decision-making processes.

To protect the processed data, we implement appropriate and robust technical and organizational measures. These ensure the integrity and confidentiality of the processed data and minimize potential risks. Through regular reviews of the AI providers and their services, we ensure ongoing compliance with current legal and ethical standards.

• Categories of processed data: Content data (e.g. textual or visual messages and contributions, as well as information relating to them, such as information on authorship or time of creation); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions).
• Data subjects: Users (e.g. website visitors and users of online services); third parties.
• Purposes of processing: Artificial intelligence (AI).
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• ChatGPT: AI-based service designed to understand and generate natural language and related inputs and data, to analyze information and to make predictions ("AI", i.e. "artificial intelligence", is to be understood in the legal sense of the term applicable at the relevant time); Service provider: OpenAI Ireland Ltd, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://openai.com/de-DE/chatgpt/overview/; Privacy Policy: https://openai.com/de-DE/policies/privacy-policy/. Option to object (opt-out): https://privacy.openai.com/policies?modal=select-subject.
• OpenAI API: An API (application programming interface) for artificial intelligence that gives developers access to language and image models such as GPT and DALL·E. It enables the integration of functions such as automatic text generation, natural language processing (NLP), translation, code generation, image generation and image analysis into their own applications. Standardized interfaces make it possible to integrate complex AI functions and to automate processes; Service provider: OpenAI Ireland Ltd, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://openai.com/; Privacy Policy: https://openai.com/de/policies/eu-privacy-policy; Data Processing Agreement: https://openai.com/policies/data-processing-addendum; Basis for third-country transfers: Standard Contractual Clauses (https://openai.com/policies/data-processing-addendum), Standard Contractual Clauses (https://openai.com/policies/data-processing-addendum). Option to object (opt-out): https://privacy.openai.com/policies?modal=select-subject.

Cloud Services

We use software services that are accessible via the internet and run on the servers of their providers (so-called "cloud services", also referred to as "Software as a Service") for the storage and management of content (e.g. document storage and management, exchange of documents, content and information with specific recipients, or publication of content and information).

Within this framework, personal data may be processed and stored on the providers' servers insofar as such data forms part of communication processes with us or is otherwise processed by us as described in this Privacy Policy. This data may include, in particular, master data and contact data of users, data relating to transactions, contracts, other processes and their contents. The providers of the cloud services also process usage data and metadata, which they use for security purposes and for service optimization.

If we use the cloud services to provide forms or other documents and content to other users or on publicly accessible websites, the providers may store cookies on the users' devices for the purposes of web analytics or to remember user settings (e.g. in the case of media controls).

• Categories of processed data: Inventory data (e.g. full name, residential address, contact information, customer number); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and contributions as well as information relating to them, such as details of authorship or time of creation); usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Prospective customers; communication partners; business and contractual partners. Users (e.g. website visitors, users of online services).
• Purposes of processing: Office and organizational procedures; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Google Workspace: Cloud-based application software (e.g. word processing and spreadsheet editing, calendar and contact management), cloud storage and cloud infrastructure services; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://workspace.google.com/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause), Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause). Further information: https://cloud.google.com/privacy.
• Proton Drive: Secure storage and management of files, encryption of user data, sharing of files with other persons, access to files across different devices; Service provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://proton.me/de/drive; Privacy Policy: https://proton.me/de/legal/privacy. Data Processing Agreement: Provided by the service provider.
• Supabase: Storage and retrieval of the star ratings of our recipes. When you open a recipe page or submit a rating, your browser transmits your IP address and technical connection data to Supabase for this purpose. For each rating, our database holds the recipe and the number of stars, no information about you. Only your browser stores the fact that you have already rated a recipe (local storage), to prevent duplicate votes; this information is not transmitted; Service provider: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, technical support by Supabase, Inc., USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://supabase.com/; Privacy Policy: https://supabase.com/privacy; Data Processing Agreement: https://supabase.com/legal/customer-resources/data-processing-addendum; Basis for third-country transfers: Standard Contractual Clauses (https://supabase.com/legal/customer-resources/data-processing-addendum).

Newsletters and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter referred to as "newsletters") exclusively with the consent of the recipients or on the basis of a statutory provision. If the contents of the newsletter are described in the course of registering for the newsletter, these contents are decisive for the users' consent. To subscribe to our newsletter, it is normally sufficient to provide your email address. However, in order to offer you a personalized service, we may ask you to provide your name so that we can address you personally in the newsletter, or to provide further information if this is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a potential defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a block list (so-called "blocklist").

The registration procedure is logged on the basis of our legitimate interests for the purpose of demonstrating that it was carried out properly. Where we engage a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure dispatch system.

Contents:

Information about us, our services, promotions and offers.

• Categories of processed data: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal addresses, email addresses and telephone numbers); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions).
• Data subjects: Communication partners.
• Purposes of processing: Direct marketing (e.g. by email or post).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).
• Option to object (opt-out): You may cancel your subscription to our newsletter at any time, i.e. withdraw your consent or object to further receipt. You will find a link to cancel the newsletter at the end of each newsletter, or you may otherwise use one of the contact options stated above, preferably email, for this purpose.

Further information on processing activities, procedures and services:

• Measurement of open and click rates: The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from that provider's server. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected. This information is used for the technical improvement of our newsletter on the basis of the technical data or the target groups and their reading behavior, based on their retrieval locations (which can be determined using the IP address) or access times. This analysis also includes determining whether and when the newsletters are opened and which links are clicked. The information is assigned to the individual newsletter recipients and stored in their profiles until deletion. The evaluations serve to identify the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of open and click rates, the storage of the measurement results in the users' profiles and their further processing are carried out on the basis of the users' consent. Unfortunately, it is not possible to withdraw consent to the performance measurement separately; in this case, the entire newsletter subscription must be canceled or objected to. In that case, the stored profile information will be deleted; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).
• Reminder emails regarding the ordering process: If users do not complete an ordering process, we may remind them of the ordering process by email and send them a link to continue it. This function may be useful, for example, if the purchasing process could not be continued due to a browser crash, an oversight or forgetfulness. The emails are sent on the basis of consent, which users may withdraw at any time; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

Web Analytics, Monitoring and Optimization

Web analytics (also referred to as "reach measurement") serves to evaluate the flow of visitors to our online offering and may include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, identify at what times our online offering or its functions or content are used most frequently, or encourage users to use them again. Likewise, we are able to determine which areas require optimization.

In addition to web analytics, we may also use testing procedures, for example to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data combined into a usage session, may be created for these purposes, and information may be stored in a browser or on a device and subsequently read out. The data collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data, either to us or to the providers of the services we use, the processing of location data is also possible.

In addition, users' IP addresses are stored. However, we use an IP masking procedure (i.e. pseudonymization by truncating the IP address) to protect users. In general, no directly identifying data of users (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimization, but only pseudonyms. This means that neither we nor the providers of the software used know the actual identity of users, but only the information stored in their profiles for the purposes of the respective procedures.

Information on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this Privacy Policy.

• Categories of processed data: Usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Users (e.g. website visitors and users of online services).
• Purposes of processing: Remarketing; audience building; reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles); provision of our online offering and user-friendliness; tracking (e.g. interest-based and behavioral profiling, use of cookies); click tracking; A/B testing; heatmaps (mouse movements of users that are combined into an overall picture).
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion". Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Google Analytics: We use Google Analytics to measure and analyze the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to assign analytics information to a device in order to recognize which content users have accessed within one or several usage sessions, which search terms they have used, whether they have accessed content again or whether they have interacted with our online offering. Likewise, the time and duration of use are stored, as well as the sources of users referring to our online offering and technical aspects of their devices and browsers.
  In this process, pseudonymous user profiles are created with information from the use of various devices, and cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides coarse geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, IP address data is used exclusively for this derivation of geolocation data before being deleted immediately. It is not logged, is not accessible and is not used for any further purposes. When Google Analytics collects measurement data, all IP lookups are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms); Option to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and of the data processed).
• Audience building with Google Analytics: We use Google Analytics to display advertisements placed via the advertising services of Google and its partners specifically to those users who have already shown an interest in our online offering or who exhibit certain characteristics (e.g. interests in specific topics or products, determined on the basis of the websites they have visited). We transmit this data to Google within the framework of so-called "remarketing" or "Google Analytics Audiences". The aim of using Remarketing Audiences is to ensure that our advertisements correspond as closely as possible to the potential interests of users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://marketingplatform.google.com; Legal bases: https://business.safety.google/adsprocessorterms/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms for Google advertising products and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adsprocessorterms.
• Google Tag Manager: We use Google Tag Manager, software provided by Google that enables us to manage so-called website tags centrally via a user interface. Tags are small code elements on our website that serve to record and analyze visitor activities. This technology helps us to improve our website and the content offered on it. Google Tag Manager itself does not create user profiles, does not store cookies containing user profiles and does not carry out any independent analyses. Its function is limited to simplifying the integration and management of the tools and services we use on our website and making them more efficient. Nevertheless, when Google Tag Manager is used, users' IP addresses are transmitted to Google, which is necessary for technical reasons in order to implement the services we use. Cookies may also be set in this process. However, this data processing only takes place if services are integrated via Tag Manager. For more detailed information on these services and their data processing, please refer to the further sections of this Privacy Policy; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement:
  https://business.safety.google/adsprocessorterms. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms).
• Hotjar Observe: Software for the analysis and optimization of online offerings on the basis of pseudonymously conducted measurements and analyses of user behavior, which may include, in particular, A/B tests (measurement of the popularity and user-friendliness of different content and functions), measurement of click paths and of interaction with content and functions of the online offering (so-called heatmaps and recordings); Service provider: Hotjar Ltd., 3 Lyons Range, 20 Bisazza Street, Sliema SLM 1640, Malta; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.hotjar.com; Privacy Policy: https://www.hotjar.com/legal/policies/privacy; Deletion of data: The cookies used by Hotjar have different "lifespans"; some remain valid for up to 365 days, others only for the duration of the current visit; Cookie Policy: https://www.hotjar.com/legal/policies/cookie-information. Option to object (opt-out): https://www.hotjar.com/legal/compliance/opt-out.

Online Marketing

We process personal data for the purposes of online marketing, which may include, in particular, the marketing of advertising space or the display of promotional and other content (collectively referred to as "Content") based on the potential interests of users, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called "cookie"), or similar procedures are used by means of which the information about the user that is relevant for the display of the aforementioned Content is stored. This may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used, as well as information on usage times and functions used. If users have consented to the collection of their location data, this data may also be processed.

In addition, the IP addresses of users are stored. However, we use available IP masking procedures (i.e. pseudonymization by truncating the IP address) to protect users. In general, no directly identifying data of users (e.g. email addresses or names) is stored within the scope of the online marketing procedure, but rather pseudonyms. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is generally stored in the cookies or by means of similar procedures. These cookies can generally also be read later on other websites that use the same online marketing procedure, analyzed for the purpose of displaying content, supplemented with further data and stored on the server of the online marketing procedure provider.

In exceptional cases, it is possible to assign directly identifying data to the profiles, primarily when, for example, the users are members of a social network whose online marketing procedure we use and the network links the user profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, for example by giving consent as part of the registration process.

As a rule, we only receive access to aggregated information about the success of our advertisements. However, within the scope of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, please assume that the cookies used are stored for a period of two years.

Notes on legal bases: Where we request users' consent to the use of third-party providers, the legal basis for the processing of data is that consent. Otherwise, users' data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this Privacy Policy.

Notes on withdrawal and objection:

We refer to the privacy notices of the respective providers and the options for objection specified for each provider (so-called "opt-out"). If no explicit opt-out option has been specified, you have, on the one hand, the option of deactivating cookies in the settings of your browser. However, this may restrict functions of our online offering. We therefore additionally recommend the following opt-out options, which are offered collectively for the respective regions:

a) Europe: https://www.youronlinechoices.eu.

b) Canada: https://youradchoices.ca/.

c) USA: https://optout.aboutads.info/.

d) Cross-regional: https://optout.aboutads.info.

• Categories of processed data: Content data (e.g. textual or visual messages and contributions, as well as related information such as authorship or time of creation); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons); event data (Facebook) ("Event data" is information that is sent to the provider Meta, for example via the Meta Pixel (whether via apps or other channels), and relates to individuals or their actions. Such data includes, for example, details of website visits, interactions with content and functions, app installations and product purchases. Event data is processed for the purpose of creating audiences for content and advertising messages (Custom Audiences). It is important to note that event data does not include any actual content such as written comments, any login information or any contact information such as names, email addresses or telephone numbers. "Event data" is deleted by Meta after a maximum of two years, and the audiences created from it cease to exist upon deletion of our Meta user accounts.); contact information (Facebook) ("Contact information" is data that (clearly) identifies data subjects, such as names, email addresses and telephone numbers, which may be transmitted to Facebook, e.g. via the Facebook Pixel or by upload for matching purposes in order to create Custom Audiences. After matching for the purpose of creating audiences, the contact information is deleted).
• Data subjects: Users (e.g. website visitors and users of online services).
• Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); tracking (e.g. interest/behavior-based profiling, use of cookies); conversion measurement (measurement of the effectiveness of marketing measures); audience building; marketing; profiles with user-related information (creation of user profiles); provision of our online offering and user-friendliness. Remarketing.
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Meta Pixel and audience building (Custom Audiences): With the help of the Meta Pixel (or comparable functions for transmitting event data or contact information via interfaces in apps), Meta is able, firstly, to determine the visitors to our online offering as a target audience for the display of advertisements (so-called "Meta Ads"). Accordingly, we use the Meta Pixel to display the Meta Ads placed by us only to those users on Meta platforms and within the services of partners cooperating with Meta (so-called "Audience Network" https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products, as evident from the websites visited) that we transmit to Meta (so-called "Custom Audiences"). With the help of the Meta Pixel, we also want to ensure that our Meta Ads correspond to the potential interest of users and are not perceived as intrusive. With the help of the Meta Pixel, we can furthermore track the effectiveness of the Meta Ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Meta Ad (so-called "conversion measurement"); Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Further information: Users' event data, i.e. information on behavior and interests, is processed for the purposes of targeted advertising and audience building on the basis of the agreement on joint controllership ("Controller Addendum", https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection by and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (on the basis of the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
• Advanced Matching for the Meta Pixel: In addition to the processing of event data in the context of using the Meta Pixel (or comparable functions, e.g. in apps), contact information (data identifying individual persons, such as names, email addresses and telephone numbers) is also collected by Meta within our online offering or transmitted to Meta. The processing of the contact information serves to create audiences (so-called "Custom Audiences") for a display of content and advertising information based on the presumed interests of users. The collection or transmission and the matching with data already held by Meta do not take place in plain text, but in the form of so-called "hash values", i.e. mathematical representations of the data (this method is used, e.g., for storing passwords). After matching for the purpose of creating audiences, the contact information is deleted; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Privacy Policy: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: https://www.facebook.com/legal/terms/data_security_terms.
• Meta - audience building via data upload: Creation of audiences for marketing purposes - we transmit contact information (names, email addresses and telephone numbers) in list form to Meta for the purpose of creating audiences (so-called "Custom Audiences") for a display of content and advertising information based on the presumed interests of users. The transmission and the matching with data already held by Meta do not take place in plain text, but in the form of so-called "hash values", i.e. mathematical representations of the data (this method is used, e.g., for storing passwords). After matching for the purpose of creating audiences, the contact information is deleted; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
• Google Ad Manager: We use the "Google Ad Manager" service to place advertisements in the Google advertising network (e.g. in search results, in videos, on websites, etc.). Google Ad Manager is characterized by the fact that advertisements are displayed in real time based on the presumed interests of users. This allows us to display advertisements for our online offering to users who may have a potential interest in our offering or who have previously shown an interest in it, and to measure the success of the advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/; Data processing terms for Google advertising products: information on the services, data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms. Where Google acts as a processor, data processing terms for Google advertising products and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adsprocessorterms.
• Google Ads and conversion measurement: Online marketing procedure for the purpose of placing content and advertisements within the service provider's advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the advertisements. In addition, we measure the conversion of the advertisements, i.e. whether users have taken them as an occasion to interact with the advertisements and to make use of the advertised offerings (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• Google Ads Remarketing: Google Remarketing, also referred to as retargeting, is a technology by which users of an online service are added to a pseudonymous remarketing list so that, based on their visit to the online service, advertisements can be displayed to these users on other online offerings; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• Enhanced conversions for Google Ads: When users click on our Google ads and subsequently make use of the advertised service (so-called "conversion"), the data entered by the user, such as the email address, name, residential address or telephone number, may be transmitted to Google. The hash values are then matched against users' existing Google accounts in order to better evaluate and improve users' interaction with the advertisements (e.g. clicks or views) and thus their performance; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR). Website: https://support.google.com/google-ads/answer/9888656.
• Google Adsense with personalized ads: We integrate the Google Adsense service, which enables personalized advertisements to be placed within our online offering. Google Adsense analyzes user behavior and uses this data to serve targeted advertising tailored to the interests of our visitors. We receive financial remuneration for each ad impression or other forms of use of these advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms for Google advertising products: information on the services, data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• Google Adsense with non-personalized ads: We use the Google Adsense service to serve non-personalized advertisements within our online offering. These advertisements are not based on individual user behavior but are selected on the basis of general characteristics such as the content of the page or your approximate geographic location. We receive remuneration for the display or other use of these advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms for Google advertising products: information on the services, data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• LinkedIn Insight Tag: Code that is loaded when a user visits our online offering and that tracks the user's behavior and conversions and stores them in a profile (possible uses: measuring campaign performance, optimizing ad delivery, building custom and lookalike audiences); Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy, Cookie Policy: https://www.linkedin.com/legal/cookie_policy; Data Processing Agreement: https://www.linkedin.com/legal/l/dpa; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa), Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa). Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Microsoft Advertising: Online marketing procedure for the purpose of placing content and advertisements within the service provider's advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the advertisements. In addition, we measure the conversion of the advertisements, i.e. whether users have taken them as an occasion to interact with the advertisements and to make use of the advertised offerings (so-called conversion). However, we only receive anonymous information and no personal information about individual users; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://about.ads.microsoft.com/; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF). Opt-out option: https://account.microsoft.com/privacy/ad-settings/.

Customer Reviews and Rating Procedures

We participate in review and rating procedures in order to evaluate, optimize and promote our services. When users rate us via the participating rating platforms or procedures or otherwise provide feedback, the general terms and conditions or terms of use and the privacy notices of the providers additionally apply. As a rule, submitting a rating also requires registration with the respective providers.

In order to ensure that the persons submitting ratings have actually used our services, we transmit, with the customers' consent, the data required for this purpose relating to the customer and the service used to the respective rating platform (including name, email address and order number or item number). This data is used solely to verify the authenticity of the user.

• Categories of processed data: Contract data (e.g. contract subject matter, term, customer category); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Service recipients and clients; users (e.g. website visitors and users of online services).
• Purposes of processing: Feedback (e.g. collecting feedback via online form); marketing.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Rating widget: We embed so-called "rating widgets" in our online offering. A widget is a functional and content element embedded in our online offering that displays variable information. It may, for example, be displayed in the form of a seal or a comparable element, sometimes also referred to as a "badge". Although the corresponding content of the widget is displayed within our online offering, it is retrieved at that moment from the servers of the respective widget provider. This is the only way to ensure that the current content is always displayed, in particular the current rating. For this purpose, a data connection must be established from the web page accessed within our online offering to the server of the widget provider, and the widget provider receives certain technical data (access data, including the IP address) that is necessary for the content of the widget to be delivered to the user's browser. Furthermore, the widget provider receives information that users have visited our online offering. This information may be stored in a cookie and used by the widget provider to identify which online offerings participating in the rating procedure have been visited by the user. The information may be stored in a user profile and used for advertising or market research purposes; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Google Customer Reviews: Service for obtaining and/or displaying customer satisfaction and customer opinions; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF); Further information: In the context of obtaining customer reviews, an identification number and the time of the business transaction to be rated, in the case of review requests sent directly to customers the customer's email address and their information on their country of residence, as well as the review details themselves, are processed; further information on the types of processing and the data processed: https://business.safety.google/adsservices/. Data processing terms for Google advertising products: information on the services, data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.

Social Media Presences

We maintain online presences within social networks and, in this context, process user data in order to communicate with the users active there or to provide information about us.

We would like to point out that user data may be processed outside the area of the European Union. This may result in risks for users because, for example, it could make the enforcement of users' rights more difficult.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created on the basis of user behavior and the resulting interests of the users. These usage profiles may in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For this reason, cookies are generally stored on users' computers, in which the usage behavior and interests of the users are stored. In addition, data may also be stored in the usage profiles independently of the devices used by the users (in particular if they are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and the options to object (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for access and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to the user data and can directly take appropriate measures and provide information. Should you nevertheless require assistance, you may contact us.

• Categories of processed data: Contact data (e.g. postal addresses, email addresses and telephone numbers); content data (e.g. textual or visual messages and contributions, as well as related information such as authorship or time of creation); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons); inventory data (e.g. full name, residential address, contact information, customer number, etc.).
• Data subjects: Users (e.g. website visitors and users of online services).
• Purposes of processing: Communication; feedback (e.g. collecting feedback via online form); public relations; marketing; provision of our online offering and user-friendliness.
• Retention and deletion: In accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

Further information on processing activities, procedures and services:

• Instagram: Social network that enables the sharing of photos and videos, commenting on and favoriting posts, sending messages, and subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF).
• Facebook Pages: Profiles within the social network Facebook. The controller is jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data of visitors to our Facebook page ("fan page"). This includes, in particular, information about user behavior (e.g. content viewed or interacted with, actions taken) as well as device information (e.g. IP address, operating system, browser type, language settings, cookie data). Further details can be found in the Facebook Data Policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us, via the "Page Insights" service, with statistical analyses that provide information on how people interact with our page and its content. The basis for this is an agreement with Facebook ("Information about Page Insights": https://www.facebook.com/legal/terms/page_controller_addendum), which governs, among other things, security measures and the exercise of data subject rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users can therefore direct requests for access or deletion directly to Facebook. The rights of users (in particular access, deletion, objection, complaint to a supervisory authority) remain unaffected. The joint responsibility is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for any further processing, including a possible transfer to Meta Platforms Inc. in the USA; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
• Facebook Groups: We use the "Groups" function of the Facebook platform to create interest groups within which Facebook users can get in contact with each other or with us and exchange information. In doing so, we process personal data of the users of our groups to the extent necessary for the purpose of using the groups and moderating them. Our guidelines within the groups may contain further requirements and information on the use of the respective group. This data includes information on first and last names, as well as published or privately communicated content, and values relating to the status of group membership or group-related activities, such as joining or leaving, as well as the time details relating to the aforementioned data. Furthermore, we refer to the processing of user data by Facebook itself. This data includes information about the types of content users view or interact with, or the actions they take (see under "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/privacy/policy/), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see under "Device information" in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, so-called "Insights", to group operators so that they can gain insights into how people interact with their groups and with the content associated with them; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF).
• Facebook Events: Event profiles within the social network Facebook. We use the "Events" function of the Facebook platform to draw attention to events and dates, to get in contact with users (participants and interested parties) and to exchange information. In doing so, we process personal data of the users of our event pages to the extent necessary for the purpose of the event page and its moderation. This data includes information on first and last names, as well as published or privately communicated content, and values relating to the status of participation, as well as the time details relating to the aforementioned data. Furthermore, we refer to the processing of user data by Facebook itself. This data includes information about the types of content users view or interact with, or the actions they take (see under "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/privacy/policy/), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see under "Device information" in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, so-called "Insights", to event providers so that they can gain insights into how people interact with their event pages and with the content associated with them; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF).
• LinkedIn: Social network. We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of data of visitors that is used to create the "Page Insights" (statistics) of our LinkedIn profiles. This data includes information about the types of content users view or interact with, as well as the actions they take. In addition, details about the devices used are recorded, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles, such as job function, country, industry, seniority level, company size and employment status. Privacy information on the processing of user data by LinkedIn can be found in LinkedIn's privacy notices: https://www.linkedin.com/legal/privacy-policy.
  We have concluded a special agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum", https://legal.linkedin.com/pages-joint-controller-addendum), which governs in particular the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of data subjects (i.e. users can, for example, direct requests for access or deletion directly to LinkedIn). The rights of users (in particular the right of access, deletion, objection and lodging a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. The joint responsibility is limited to the collection of the data and its transmission to LinkedIn Ireland Unlimited Company, a company based in the EU. The further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular with regard to the transfer of the data to the parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa), Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa). Option to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• TikTok: Social network that enables the sharing of photos and videos, commenting on and favoriting posts, sending messages, and subscribing to accounts; Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.tiktok.com; Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de. Data Processing Agreement: Provided by the service provider.
• TikTok Business: Social network that enables the sharing of photos and videos, commenting on and favoriting posts, sending messages, and subscribing to accounts. We and TikTok are jointly responsible for the collection and transmission of event data as well as for the measurement and creation of Insights reports (statistics) for profile owners. This event data includes information about the types of content users view or interact with, or the actions they take, as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data) and information from the users' profiles, such as country or location. Privacy information on the processing of user data by TikTok can be found in TikTok's privacy notices: https://www.tiktok.com/legal/page/eea/privacy-policy/de. We have concluded a special joint controllership agreement with TikTok, which governs in particular the security measures TikTok must observe and in which TikTok has agreed to fulfill the data subject rights (i.e. users can, for example, direct requests for access or deletion directly to TikTok). The rights of users (in particular to access, deletion, objection and lodging a complaint with the competent supervisory authority) are not restricted by the agreements with TikTok. The joint controllership agreement can be found in TikTok's "Jurisdiction Specific Terms": https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms.; Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.tiktok.com; Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de. Basis for third-country transfers: Standard Contractual Clauses (https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms), Standard Contractual Clauses (https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms).
• YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF). Option to object (opt-out): https://myadcenter.google.com/personalizationoff.

Plugins, Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may be, for example, graphics, videos or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the users' IP address, since without the IP address they would not be able to send the content to the users' browsers. The IP address is therefore required for the display of this content or these functions. We endeavor to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the users' devices and may contain, among other things, technical information about the browser and operating system, referring websites, the time of the visit and other information about the use of our online offering, and may also be linked to such information from other sources.

Notes on legal bases: Where we ask users for their consent to the use of the third-party providers, the legal basis for the processing of data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this Privacy Policy.

• Categories of processed data: Usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons); location data (information on the geographical position of a device or a person).
• Data subjects: Users (e.g. website visitors and users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; reach measurement (e.g. access statistics, recognition of returning visitors); tracking (e.g. interest-/behavior-based profiling, use of cookies); audience building; marketing.
• Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Storage and Deletion". Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Google Fonts (provision on our own server): Provision of font files for the purpose of a user-friendly presentation of our online offering; Service provider: Google Fonts are hosted on our own server; no data is transmitted to Google; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Google Fonts (retrieval from the Google server): Retrieval of fonts (and icons) for the purpose of a technically secure, maintenance-free and efficient use of fonts and icons with regard to currency and loading times, their uniform presentation and the consideration of possible licensing restrictions. The user's IP address is communicated to the font provider so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted that is necessary for providing the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA. When users visit our online offering, their browsers send HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving the fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) of Google Fonts and subsequently with the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the internet, (2) the requested URL on the Google server and (3) the HTTP headers, including the user agent, which describes the browser and operating system versions of the website visitors, as well as the referrer URL (i.e. the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wishes to load fonts. This data is logged so that Google can determine how often a particular font family is requested. With the Google Fonts Web API, the user agent must adapt the font that is generated for the respective browser type. The user agent is logged primarily for debugging purposes and is used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the "Analytics" page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and an aggregated report on the top integrations can be generated based on the number of font requests. According to its own statements, Google does not use any of the information collected by Google Fonts to create profiles of end users or to serve targeted advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
• Google Maps: We embed the maps of the "Google Maps" service provided by Google. The data processed may include, in particular, users' IP addresses and location data; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy. Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF).
• YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF). Option to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff.
• Adobe Fonts: Provision of fonts for integration into web and print designs, synchronization of fonts across devices, access to a library of licensed fonts for creative projects, management and organization of fonts in projects; Service provider: Adobe Systems Software Ireland, 4-6, Riverwalk Drive, Citywest Business Campus, Brownsbarn, Dublin 24, D24 DCW0, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.adobe.com/de/; Privacy Policy: https://www.adobe.com/de/privacy.html; Basis for third-country transfers: Data Privacy Framework (DPF), Data Privacy Framework (DPF). Further information: https://www.adobe.com/de/privacy/policies/adobe-fonts.html.

Management, Organization and Utility Tools

We use services, platforms and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organizing, administering, planning and providing our services. When selecting third-party providers and their services, we comply with the legal requirements.

Within this framework, personal data may be processed and stored on the servers of the third-party providers. This may concern various data that we process in accordance with this Privacy Policy. Such data may include, in particular, master data and contact details of users, data relating to transactions, contracts, other processes and their contents.

If users are referred to the third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, for service optimization or for marketing purposes. We therefore ask you to observe the privacy notices of the respective third-party providers.

• Categories of processed data: Content data (e.g. textual or visual messages and contributions, as well as related information such as authorship or time of creation); usage data (e.g. page views, duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons); inventory data (e.g. full name, residential address, contact information, customer number); contact data (e.g. postal addresses, email addresses and telephone numbers).
• Data subjects: Communication partners; users (e.g. website visitors and users of online services).
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures.
• Retention and deletion: In accordance with the information provided in the section "General Information on Data Storage and Deletion".
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further information on processing activities, procedures and services:

• Asana: Project management, i.e. organization and management of teams, groups, workflows, projects and processes; Service provider: Asana, Inc, 1550 Bryant Street, Suite 200, San Francisco, CA 94103, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://asana.com; Privacy Policy: https://asana.com/de/terms#privacy-policy; Data Processing Agreement: https://asana.com/de/terms#data-processing. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://asana.com/de/terms#data-processing), Data Privacy Framework (DPF), Standard Contractual Clauses (https://asana.com/de/terms#data-processing).
• Miro: Online whiteboard and collaboration platform; Service provider: Realtimeboard Inc. dba Miro, 201 Spear Street Suite 1100, San Francisco, California 94105, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://miro.com/; Privacy Policy: https://miro.com/legal/privacy-policy/; Data Processing Agreement: https://miro.com/legal/vendor-data-processing-addendum/. Basis for third-country transfers: Standard Contractual Clauses (https://miro.com/legal/vendor-data-processing-addendum/), Standard Contractual Clauses (https://miro.com/legal/vendor-data-processing-addendum/).

Changes and Updates

We ask you to inform yourself regularly about the content of our Privacy Policy. We adapt the Privacy Policy as soon as changes in the data processing activities we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organizations in this Privacy Policy, please note that these addresses may change over time, and we ask you to verify the information before contacting them.