+49 69 505004922hello@hxa.io
BlogAbout usContactCommunityLogin
Request demo

HXA.IO / LEGAL

Privacy Policy

NT Technologies GmbH · HXA.io portfolio
English translation of the German privacy policy.

Contents · 34 sections

We are pleased about your interest in our company. Data protection is a particularly high priority for the management of NT Technologies GmbH. As a rule, the websites of NT Technologies GmbH can be used without providing any personal data. However, processing personal data may become necessary if a data subject wishes to use particular services offered by our company through our website. If processing personal data is necessary and there is no statutory basis for that processing, we generally obtain the data subject's consent.

Personal data, such as a data subject's name, address, email address or telephone number, are always processed in accordance with the General Data Protection Regulation and the country-specific data protection provisions applicable to NT Technologies GmbH. Through this privacy policy, our company seeks to inform the public about the nature, scope and purposes of the personal data we collect, use and process. This privacy policy also informs data subjects of their rights.

As controller, NT Technologies GmbH has implemented numerous technical and organisational measures to ensure the most comprehensive protection possible for personal data processed through this website. Nevertheless, internet-based data transmissions may in principle contain security vulnerabilities, so absolute protection cannot be guaranteed. For that reason, every data subject may also transmit personal data to us by alternative means, for example by telephone.

1. Definitions

The privacy policy of NT Technologies GmbH is based on the terminology used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for the public as well as for our customers and business partners. To achieve this, we first explain the terms used.

In this privacy policy, we use, among others, the following terms:

  • a) Personal data

    Personal data are any information relating to an identified or identifiable natural person (hereinafter “data subject”). A natural person is considered identifiable if they can be identified directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier or one or more specific characteristics expressing that person's physical, physiological, genetic, mental, economic, cultural or social identity.

  • b) Data subject

    A data subject is any identified or identifiable natural person whose personal data are processed by the controller.

  • c) Processing

    Processing is any operation or series of operations involving personal data, whether or not carried out by automated means, such as collecting, recording, organising, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying data.

  • d) Restriction of processing

    Restriction of processing means marking stored personal data with the aim of limiting their future processing.

  • e) Profiling

    Profiling is any form of automated processing of personal data that uses those data to evaluate personal aspects relating to a natural person, particularly to analyse or predict aspects of that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

  • f) Pseudonymisation

    Pseudonymisation means processing personal data so that they can no longer be attributed to a specific data subject without additional information, provided that this additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data are not attributed to an identified or identifiable natural person.

  • g) Controller

    The controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where Union or Member State law determines the purposes and means of that processing, that law may provide for the controller or the specific criteria for the controller's designation.

  • h) Processor

    A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

  • i) Recipient

    A recipient is a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the context of a particular inquiry under Union or Member State law are not regarded as recipients.

  • j) Third party

    A third party is a natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons authorised to process personal data under the direct authority of the controller or processor.

  • k) Consent

    Consent means a freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or other clear affirmative action, showing agreement to the processing of personal data relating to them.

2. Name and Address of the Controller

The controller for the purposes of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions relating to data protection is:

NT Technologies GmbH

Zillplatz 9-10

09337 Hohenstein-Ernstthal

Germany

Tel.: +49 3723 769320-0

Email: info@nt-technologies.de

Website: www.nt-technologies.de

3. Name and Address of the Data Protection Officer

The controller's data protection officer is:

Nancy Großmann

NT Technologies GmbH

Zillplatz 9-10

09337 Hohenstein-Ernstthal

Germany

Tel.: +49 3723 769320-770

Email: datenschutz@nt-technologies.de

Website: www.nt-technologies.de

Every data subject may contact our data protection officer directly at any time with questions or suggestions concerning data protection.

4. Cookies

The websites of NT Technologies GmbH use cookies. Cookies are text files placed and stored on a computer system through an internet browser.

Many websites and servers use cookies. Many cookies contain a cookie ID. A cookie ID is a unique identifier for a cookie. It consists of a string of characters through which websites and servers can be associated with the particular internet browser in which the cookie was stored. This enables visited websites and servers to distinguish the data subject's individual browser from other internet browsers containing different cookies. A particular internet browser can be recognised and identified through its unique cookie ID.

Using cookies enables NT Technologies GmbH to provide users of this website with more user-friendly services that would not be possible without setting cookies.

A cookie can be used to optimise the information and offers on our website for the user. As mentioned above, cookies enable us to recognise users of our website. The purpose of this recognition is to make our website easier to use. For example, a user of a website that uses cookies does not have to enter their access credentials again on every visit because the website and the cookie stored on the user's computer system handle this. Another example is a shopping-cart cookie in an online shop. Through a cookie, the online shop remembers the items a customer has placed in the virtual shopping cart.

A data subject may prevent our website from setting cookies at any time by changing the relevant settings in the internet browser they use, thereby objecting permanently to cookies being set. Cookies already set can also be deleted at any time through an internet browser or other software. This is possible in all common internet browsers. If the data subject disables cookies in the internet browser they use, some functions of our website may not be fully available.

5. Collection of General Data and Information

Whenever a data subject or an automated system accesses the website of NT Technologies GmbH, the website collects a range of general data and information. These general data and information are stored in the server's log files. The following may be recorded: (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (the referrer), (4) the subpages accessed on our website through an accessing system, (5) the date and time of access to the website, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system, and (8) other similar data and information used to avert threats in the event of attacks on our information technology systems.

We use these logs to provide the website technically, analyse errors, and prevent and investigate attacks. Processing serves our legitimate interest in secure and reliable operation under Article 6(1)(f) GDPR. Server logs may contain personal data; storing them separately from information submitted through forms does not automatically make them anonymous.

Retention of Access Logs

Automatic rotation of access logs currently depends on file size and the number of archived files. Rotation is configured at 10,240 KB; a maximum of ten compressed archive files is retained for each log. The resulting retention period depends on the volume of access events recorded. This rotation is not configured to delete logs automatically after a fixed number of days.

6. Registration on Our Website

A data subject may register on the controller's website by providing personal data. The particular input form used for registration indicates which personal data are transmitted to the controller. Personal data entered by the data subject are collected and stored exclusively for internal use by the controller and for the controller's own purposes. The controller may arrange for disclosure to one or more processors, for example a parcel delivery service, which likewise uses the personal data exclusively for internal use attributable to the controller.

Registration on the controller's website also results in storage of the IP address assigned by the data subject's internet service provider (ISP), and the date and time of registration. These data are stored because this is the only way to prevent misuse of our services and because they enable offences to be investigated where necessary. Storage of these data is therefore necessary to protect the controller. As a rule, these data are not disclosed to third parties unless there is a statutory duty to disclose them or disclosure serves law enforcement purposes.

Registration by the data subject, with personal data provided voluntarily, enables the controller to offer the data subject content or services that, by their nature, can be offered only to registered users. Registered persons may change the personal data provided during registration at any time or have them completely deleted from the controller's records.

On request, the controller informs every data subject at any time of the personal data stored about them. The controller also rectifies or erases personal data at the data subject's request or notification, provided that no statutory retention obligations prevent this. A data protection officer named in this privacy policy and all the controller's employees are available as contacts for the data subject in this connection.

7. Subscription to Our Newsletter

Users of the website of NT Technologies GmbH are given the opportunity to subscribe to our company's newsletter. The input form used for that purpose indicates which personal data are transmitted to the controller when the newsletter is requested.

NT Technologies GmbH regularly informs its customers and business partners about the company's offers by newsletter. As a rule, a data subject can receive our company's newsletter only if (1) they have a valid email address and (2) they register to receive the newsletter. For legal reasons, a confirmation email using the double opt-in procedure is sent to an email address first entered by a data subject to receive the newsletter. This confirmation email verifies whether the email address holder, as data subject, has authorised receipt of the newsletter.

When a person subscribes to the newsletter, we also store the IP address assigned by the ISP to the computer system used by the data subject at the time of subscription, and the date and time of subscription. Collecting these data is necessary to enable any possible misuse of a data subject's email address to be traced later and therefore serves to protect the controller legally.

Personal data collected when subscribing to the newsletter are used exclusively to send our newsletter. Newsletter subscribers may also be informed by email where necessary for operation of the newsletter service or the associated registration, for example if the newsletter offering or technical circumstances change. Personal data collected as part of the newsletter service are not disclosed to third parties. The data subject may unsubscribe from our newsletter at any time. Consent given by the data subject to storage of personal data for sending the newsletter may be withdrawn at any time. Each newsletter contains a corresponding link for withdrawing consent. It is also possible to unsubscribe at any time directly on the controller's website or to notify the controller by other means.

8. Newsletter Tracking

The newsletters of NT Technologies GmbH contain tracking pixels. A tracking pixel is a miniature graphic embedded in emails sent in HTML format to enable log-file recording and analysis. This enables statistical evaluation of the success or failure of online marketing campaigns. Through the embedded tracking pixel, NT Technologies GmbH can identify whether and when a data subject opened an email and which links in that email they accessed.

The controller stores and analyses personal data collected through newsletter tracking pixels to optimise newsletter delivery and adapt the content of future newsletters more closely to the data subject's interests. These personal data are not disclosed to third parties. Data subjects may withdraw the separate consent given for this purpose through the double opt-in procedure at any time. After withdrawal, the controller erases these personal data. NT Technologies GmbH automatically treats unsubscribing from the newsletter as withdrawal of consent.

9. Contacting Us Through the Website

In accordance with statutory requirements, the website of NT Technologies GmbH contains information enabling rapid electronic contact with our company and direct communication with us, including a general electronic mail address (email address). If a data subject contacts the controller by email or through a contact form, the personal data transmitted by the data subject are automatically stored. Personal data voluntarily transmitted to the controller in this way are stored for the purpose of handling the enquiry or contacting the data subject. These personal data are not disclosed to third parties.

10. Subscribing to Blog Comments on the Website

As a rule, third parties can subscribe to comments posted on the blog of NT Technologies GmbH. In particular, a commenter may subscribe to comments following their comment on a particular blog post.

If a data subject chooses to subscribe to comments, the controller sends an automatic confirmation email to verify, through the double opt-in procedure, that the holder of the specified email address actually selected this option. A subscription to comments can be ended at any time.

11. Routine Erasure and Blocking of Personal Data

The controller processes and stores a data subject's personal data only for the period necessary to achieve the purpose of storage or where provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage ceases to apply or a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with statutory provisions.

12. Rights of the Data Subject

  • a) Right to confirmation

    Every data subject has the right granted by the European legislator to obtain confirmation from the controller as to whether personal data concerning them are being processed. A data subject wishing to exercise this right may contact our data protection officer or another employee of the controller at any time.

  • b) Right of access

    Every person whose personal data are processed has the right granted by the European legislator to obtain, at any time and free of charge, information from the controller about the personal data stored concerning them and a copy of that information. The European legislator has also granted the data subject access to the following information:

    • The purposes of processing
    • The categories of personal data processed
    • The recipients or categories of recipients to whom personal data have been or will be disclosed, particularly recipients in third countries or international organisations
    • Where possible, the planned period for which personal data will be stored or, if that is not possible, the criteria used to determine that period
    • The existence of a right to rectification or erasure of personal data concerning them, restriction of processing by the controller, or objection to that processing
    • The existence of a right to lodge a complaint with a supervisory authority
    • Where personal data are not collected from the data subject: all available information about their source
    • The existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and intended consequences of that processing for the data subject

    The data subject also has a right to information about whether personal data have been transferred to a third country or an international organisation. If so, the data subject additionally has a right to information about appropriate safeguards relating to the transfer.

    A data subject wishing to exercise this right of access may contact our data protection officer or another employee of the controller at any time.

  • c) Right to rectification

    Every person whose personal data are processed has the right granted by the European legislator to require inaccurate personal data concerning them to be rectified without undue delay. The data subject also has the right, taking account of the purposes of processing, to require incomplete personal data to be completed, including by providing a supplementary statement.

    A data subject wishing to exercise this right may contact our data protection officer or another employee of the controller at any time.

  • d) Right to erasure (right to be forgotten)

    Every person whose personal data are processed has the right granted by the European legislator to require the controller to erase personal data concerning them without undue delay where one of the following grounds applies and processing is not necessary:

    • The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
    • The data subject withdraws the consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
    • The data subject objects to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or the data subject objects under Article 21(2) GDPR.
    • The personal data were unlawfully processed.
    • Erasure of personal data is necessary to comply with a legal obligation under Union or Member State law to which the controller is subject.
    • The personal data were collected in relation to the offering of information society services under Article 8(1) GDPR.

    Where one of these grounds applies and a data subject wishes to arrange erasure of personal data stored by NT Technologies GmbH, they may contact our data protection officer or another employee of the controller at any time. The data protection officer of NT Technologies GmbH or another employee will arrange for the erasure request to be complied with without undue delay.

    If NT Technologies GmbH has made personal data public and, as controller, is obliged to erase them under Article 17(1) GDPR, NT Technologies GmbH takes reasonable steps, including technical measures, taking account of available technology and implementation costs, to inform other controllers processing the published personal data that the data subject has requested erasure by those controllers of all links to, copies or replications of those personal data, insofar as processing is not necessary. The data protection officer of NT Technologies GmbH or another employee will arrange what is necessary in the individual case.

  • e) Right to restriction of processing

    Every person whose personal data are processed has the right granted by the European legislator to require restriction of processing by the controller where one of the following conditions applies:

    • The data subject contests the accuracy of the personal data, for a period enabling the controller to verify their accuracy.
    • Processing is unlawful, the data subject opposes erasure of the personal data and requests restriction of their use instead.
    • The controller no longer needs the personal data for processing purposes, but the data subject needs them to establish, exercise or defend legal claims.
    • The data subject has objected under Article 21(1) GDPR and it has not yet been established whether the controller's legitimate grounds override those of the data subject.

    Where one of these conditions applies and a data subject wishes to request restriction of personal data stored by NT Technologies GmbH, they may contact our data protection officer or another employee of the controller at any time. The data protection officer of NT Technologies GmbH or another employee will arrange restriction of processing.

  • f) Right to data portability

    Every person whose personal data are processed has the right granted by the European legislator to receive personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another controller without obstruction by the controller to whom they were provided, where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or on a contract under Article 6(1)(b) GDPR, and is carried out by automated means, provided that processing is not necessary for a task performed in the public interest or in the exercise of official authority vested in the controller.

    When exercising the right to data portability under Article 20(1) GDPR, the data subject also has the right to have personal data transmitted directly from one controller to another where technically feasible and provided that the rights and freedoms of others are not adversely affected.

    To exercise the right to data portability, the data subject may contact the data protection officer appointed by NT Technologies GmbH or another employee at any time.

  • g) Right to object

    Every person whose personal data are processed has the right granted by the European legislator to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

    If an objection is made, NT Technologies GmbH no longer processes the personal data unless we can demonstrate compelling legitimate grounds for processing that override the data subject's interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.

    If NT Technologies GmbH processes personal data for direct marketing, the data subject has the right to object at any time to processing for that marketing. This also applies to profiling insofar as it is related to such direct marketing. If the data subject objects to NT Technologies GmbH processing personal data for direct marketing, NT Technologies GmbH no longer processes them for those purposes.

    The data subject also has the right to object, on grounds relating to their particular situation, to processing of personal data concerning them by NT Technologies GmbH for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless processing is necessary to perform a task in the public interest.

    To exercise the right to object, the data subject may contact the data protection officer of NT Technologies GmbH or another employee directly. In connection with the use of information society services, the data subject may also exercise the right to object by automated means using technical specifications, notwithstanding Directive 2002/58/EC.

  • h) Automated individual decision-making, including profiling

    Every person whose personal data are processed has the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary to enter into or perform a contract between the data subject and the controller, (2) is authorised by Union or Member State law to which the controller is subject and that law provides appropriate measures to safeguard the data subject's rights, freedoms and legitimate interests, or (3) is based on the data subject's explicit consent.

    If the decision (1) is necessary to enter into or perform a contract between the data subject and the controller or (2) is based on the data subject's explicit consent, NT Technologies GmbH takes appropriate measures to safeguard the data subject's rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the controller's part, express their point of view and contest the decision.

    A data subject wishing to exercise rights relating to automated decisions may contact our data protection officer or another employee of the controller at any time.

  • i) Right to withdraw consent under data protection law

    Every person whose personal data are processed has the right granted by the European legislator to withdraw consent to the processing of personal data at any time.

    A data subject wishing to exercise this right may contact our data protection officer or another employee of the controller at any time.

13. Data Protection in Applications and the Recruitment Process

The controller collects and processes applicants' personal data for the purpose of managing the recruitment process. Processing may also take place electronically, particularly where an applicant submits application documents electronically to the controller, for example by email or through a web form on the website. If the controller concludes an employment contract with an applicant, the transmitted data are stored to manage the employment relationship in accordance with statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents are automatically erased two months after the rejection decision is announced, unless other legitimate interests of the controller prevent erasure. Another legitimate interest in this sense is, for example, a need to provide evidence in proceedings under the German General Act on Equal Treatment (AGG).

14. Data Protection Provisions on the Use of Facebook

The controller has integrated components of the company Facebook into this website. Facebook is a social network.

A social network is an online meeting place and community that generally enables users to communicate with one another and interact in a virtual space. It may serve as a platform for exchanging opinions and experiences or enable the internet community to provide personal or business-related information. Among other things, Facebook enables users to create private profiles, upload photographs and connect through friend requests.

Facebook is operated by Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside the USA or Canada, the controller for processing personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Whenever a page of this website operated by the controller and containing a Facebook component (Facebook plug-in) is accessed, the relevant component automatically causes the internet browser on the data subject's information technology system to download a representation of the corresponding component from Facebook. An overview of all Facebook plug-ins is available at https://developers.facebook.com/docs/plugins/?locale=de_DE. Through this technical process, Facebook learns which particular subpage of our website the data subject visits.

If the data subject is logged into Facebook at the same time, Facebook identifies the particular subpage visited whenever the data subject accesses our website and throughout their stay on it. The Facebook component collects this information and Facebook associates it with the data subject's Facebook account. If the data subject activates a Facebook button integrated into our website, for example the “Like” button, or posts a comment, Facebook associates that information with their personal Facebook account and stores those personal data.

Facebook receives information through the component that the data subject has visited our website whenever they are also logged into Facebook at the time of access; this occurs whether or not they click the component. If the data subject does not want this information transmitted to Facebook, they can prevent transmission by logging out of their Facebook account before accessing our website.

Facebook's published data policy, available at https://de-de.facebook.com/about/privacy/, explains Facebook's collection, processing and use of personal data. It also explains the settings Facebook offers to protect data subjects' privacy. Various applications are also available to prevent data transmission to Facebook, for example the Facebook Blocker from Webgraph, available at http://webgraph.com/resources/facebookblocker/. Data subjects may use such applications to prevent data transmission to Facebook.

15. Data Protection Provisions on the Use of Google AdSense

The controller has integrated Google AdSense into this website. Google AdSense is an online service that enables advertisements to be placed on third-party websites. It uses an algorithm that selects advertisements displayed on third-party websites to match the content of those websites. Google AdSense permits interest-based targeting of internet users through the creation of individual user profiles.

The Google AdSense component is operated by Alphabet Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The purpose of the Google AdSense component is to display advertisements on our website. Google AdSense places a cookie on the data subject's information technology system. Cookies have been explained above. By setting the cookie, Alphabet Inc. can analyse use of our website. Whenever a page of this website operated by the controller and containing a Google AdSense component is accessed, the relevant component automatically causes the internet browser on the data subject's information technology system to transmit data to Alphabet Inc. for online advertising and commission accounting. Through this technical process, Alphabet Inc. obtains personal data such as the data subject's IP address, which it uses, among other things, to trace the origin of visitors and clicks and subsequently enable commission accounting.

As explained above, the data subject may prevent cookies being set by our website at any time through appropriate browser settings, thereby objecting permanently to cookies being set. Such a browser setting would also prevent Alphabet Inc. from setting a cookie on the data subject's information technology system. A cookie already set by Alphabet Inc. can also be deleted at any time through the internet browser or other software.

Google AdSense also uses tracking pixels. A tracking pixel is a miniature graphic embedded in websites to enable log-file recording and analysis, allowing statistical evaluation. Through the embedded pixel, Alphabet Inc. can identify whether and when a data subject opened a website and which links they clicked. Among other things, tracking pixels are used to analyse visitor traffic on a website.

Through Google AdSense, personal data and information, including the IP address and information necessary to record and account for displayed advertisements, are transferred to Alphabet Inc. in the United States of America. These personal data are stored and processed in the United States of America. Alphabet Inc. may disclose personal data collected through this technical process to third parties.

Google AdSense is explained in more detail at https://www.google.de/intl/de/adsense/start/.

16. Data Protection Provisions on the Use of Google Remarketing

The controller has integrated Google Remarketing services into this website. Google Remarketing is a Google AdWords function that enables a company to display advertisements to internet users who have previously visited the company's website. Integrating Google Remarketing therefore enables a company to create user-related advertising and display advertisements relevant to the internet user's interests.

Google Remarketing services are operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The purpose of Google Remarketing is to display advertising relevant to users' interests. It enables us to display advertisements through Google's advertising network, or have them displayed on other websites, tailored to internet users' individual needs and interests.

Google Remarketing places a cookie on the data subject's information technology system. Cookies have been explained above. The cookie enables Google to recognise a visitor to our website when they subsequently visit websites that are also members of Google's advertising network. Whenever a website containing Google Remarketing is accessed, the data subject's browser automatically identifies itself to Google. Through this technical process, Google obtains personal data such as the user's IP address or browsing behaviour, which Google uses, among other things, to display advertising relevant to their interests.

The cookie stores personal information, for example the websites visited by the data subject. Consequently, whenever our websites are visited, personal data, including the IP address of the internet connection used by the data subject, are transmitted to Google in the United States of America. Google stores these personal data in the United States of America. Google may disclose personal data collected through this technical process to third parties.

As explained above, the data subject may prevent our website from setting cookies at any time through appropriate browser settings, thereby objecting permanently to cookies being set. Such a setting would also prevent Google from setting a cookie on the data subject's information technology system. A cookie already set by Google Analytics can also be deleted at any time through the browser or other software.

The data subject may also object to interest-based advertising by Google. To do so, they must visit www.google.de/settings/ads in each browser they use and select the desired settings.

Further information and Google's applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/.

17. Data Protection Provisions on the Use of Google+

The controller has integrated the Google+ button as a component into this website. Google+ is a social network. A social network is an online meeting place and community that generally enables users to communicate with one another and interact in a virtual space. It may serve as a platform for exchanging opinions and experiences or enable the internet community to provide personal or business-related information. Among other things, Google+ enables users to create private profiles, upload photographs and connect through friend requests.

Google+ is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Whenever a page of this website operated by the controller and containing a Google+ button is accessed, the button automatically causes the internet browser on the data subject's information technology system to download a representation of the corresponding button from Google. Through this technical process, Google learns which particular subpage of our website the data subject visits. More detailed information about Google+ is available at https://developers.google.com/+/.

If the data subject is logged into Google+ at the same time, Google identifies the particular subpage visited whenever the data subject accesses our website and throughout their stay on it. The Google+ button collects this information and Google associates it with the data subject's Google+ account.

If the data subject activates a Google+ button integrated into our website, thereby making a Google+1 recommendation, Google associates that information with their personal Google+ account and stores those personal data. Google stores the recommendation and makes it publicly accessible in accordance with the terms accepted by the data subject for that purpose. A recommendation made on this website is subsequently stored and processed together with other personal data, such as the name of the data subject's Google+1 account and its photograph, in other Google services, for example Google search results, the data subject's Google account or elsewhere, for example on websites or in connection with advertisements. Google can also link the visit to this website with other personal data stored by Google. Google additionally records this personal information to improve or optimise its various services.

Google receives information through the Google+ button that the data subject has visited our website whenever they are also logged into Google+ at the time of access; this occurs whether or not they click the button.

If the data subject does not want personal data transmitted to Google, they can prevent such transmission by logging out of their Google+ account before accessing our website.

Further information and Google's applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/. Further information from Google about the Google+1 button is available at https://developers.google.com/+/web/buttons-policy.

18. Data Protection Provisions on the Use of Google AdWords

The controller has integrated Google AdWords into this website. Google AdWords is an internet advertising service enabling advertisers to place advertisements in Google's search results and advertising network. Advertisers can specify keywords in advance so that an advertisement appears in Google's search results only when the user retrieves a search result relevant to those keywords. In Google's advertising network, advertisements are distributed to thematically relevant websites by an automated algorithm taking account of the previously specified keywords.

Google AdWords services are operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The purpose of Google AdWords is to promote our website by displaying interest-relevant advertisements on third-party companies' websites and in Google search results, and to display third-party advertising on our website.

If a data subject reaches our website through a Google advertisement, Google places a conversion cookie on their information technology system. Cookies have been explained above. A conversion cookie expires after thirty days and is not used to identify the data subject. While it remains valid, it records whether particular subpages, for example the shopping cart of an online shop, have been accessed on our website. The cookie enables both us and Google to determine whether a data subject who reached our website through an AdWords advertisement generated revenue, that is, completed or abandoned a purchase of goods.

Google uses data and information collected through the conversion cookie to compile visitor statistics for our website. We use those statistics to determine the total number of users referred to us through AdWords advertisements, assess the success or failure of each advertisement and optimise our future AdWords advertisements. Neither our company nor other Google AdWords advertising customers receive information from Google that could identify the data subject.

The conversion cookie stores personal information, for example the websites visited by the data subject. Consequently, whenever our websites are visited, personal data, including the IP address of the internet connection used by the data subject, are transmitted to Google in the United States of America. Google stores these personal data in the United States of America. Google may disclose personal data collected through this technical process to third parties.

As explained above, the data subject may prevent our website from setting cookies at any time through appropriate browser settings, thereby objecting permanently to cookies being set. Such a setting would also prevent Google from setting a conversion cookie on the data subject's information technology system. A cookie already set by Google AdWords can also be deleted at any time through the browser or other software.

The data subject may also object to interest-based advertising by Google. To do so, they must visit www.google.de/settings/ads in each browser they use and select the desired settings.

Further information and Google's applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/.

19. Data Protection Provisions on the Use of Instagram

The controller has integrated components of the Instagram service into this website. Instagram is an audiovisual platform enabling users to share photographs and videos and distribute such data further through other social networks.

Instagram services are operated by Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA.

Whenever a page of this website operated by the controller and containing an Instagram component (Insta button) is accessed, the relevant component automatically causes the internet browser on the data subject's information technology system to download a representation of the corresponding component from Instagram. Through this technical process, Instagram learns which particular subpage of our website the data subject visits.

If the data subject is logged into Instagram at the same time, Instagram identifies the particular subpage visited whenever the data subject accesses our website and throughout their stay on it. The Instagram component collects this information and Instagram associates it with the data subject's Instagram account. If the data subject activates an Instagram button integrated into our website, the transmitted data and information are associated with their personal Instagram account and stored and processed by Instagram.

Instagram receives information through the component that the data subject has visited our website whenever they are also logged into Instagram at the time of access; this occurs whether or not they click the component. If the data subject does not want this information transmitted to Instagram, they can prevent transmission by logging out of their Instagram account before accessing our website.

Further information and Instagram's applicable privacy provisions are available at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

20. Data Protection Provisions on the Use of LinkedIn

The controller has integrated components of LinkedIn Corporation into this website. LinkedIn is an internet-based social network enabling users to connect with existing business contacts and establish new ones. Over 400 million registered people use LinkedIn in more than 200 countries. It is therefore currently the largest platform for business contacts and one of the world's most visited websites.

LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA. LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible for privacy matters outside the USA.

Whenever our website containing a LinkedIn component (LinkedIn plug-in) is accessed, that component causes the data subject's browser to download a corresponding representation of the component from LinkedIn. Further information about LinkedIn plug-ins is available at https://developer.linkedin.com/plugins. Through this technical process, LinkedIn learns which particular subpage of our website the data subject visits.

If the data subject is logged into LinkedIn at the same time, LinkedIn identifies the particular subpage visited whenever the data subject accesses our website and throughout their stay on it. The LinkedIn component collects this information and LinkedIn associates it with the data subject's LinkedIn account. If the data subject activates a LinkedIn button integrated into our website, LinkedIn associates that information with their personal LinkedIn account and stores those personal data.

LinkedIn receives information through the component that the data subject has visited our website whenever they are also logged into LinkedIn at the time of access; this occurs whether or not they click the component. If the data subject does not want this information transmitted to LinkedIn, they can prevent transmission by logging out of their LinkedIn account before accessing our website.

At https://www.linkedin.com/psettings/guest-controls, LinkedIn offers options to unsubscribe from email messages, SMS messages and targeted advertisements and manage advertising settings. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may set cookies. Such cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. LinkedIn's applicable privacy provisions are available at https://www.linkedin.com/legal/privacy-policy. Its cookie policy is available at https://www.linkedin.com/legal/cookie-policy.

21. Data Protection Provisions on the Use of Myspace

The controller has integrated components of Myspace LLC into this website. Myspace is a social network. A social network is an online meeting place and community that generally enables users to communicate with one another and interact in a virtual space. It may serve as a platform for exchanging opinions and experiences or enable the internet community to provide personal or business-related information. Among other things, Myspace enables users to create, free of charge, profiles containing photographs and videos, blogs or groups.

Myspace is operated by Myspace LLC, 8391 Beverly Blvd., #349, Los Angeles, California 90048, USA.

Whenever a page of this website operated by the controller and containing a Myspace component (Myspace plug-in) is accessed, the relevant component automatically causes the internet browser on the data subject's information technology system to download a representation of the corresponding component from Myspace. Further information about Myspace is available at https://myspace.com. Through this technical process, Myspace learns which particular subpage of our website the data subject visits.

If the data subject is logged into Myspace at the same time, Myspace identifies the particular subpage visited whenever the data subject accesses our website and throughout their stay on it. The Myspace component collects this information and Myspace associates it with the data subject's Myspace account. If the data subject activates a Myspace button integrated into our website, Myspace associates that information with their personal Myspace account and stores those personal data.

Myspace receives information through the component that the data subject has visited our website whenever they are also logged into Myspace at the time of access; this occurs whether or not they click the component. If the data subject does not want this information transmitted to Myspace, they can prevent transmission by logging out of their Myspace account before accessing our website.

Myspace's published privacy policy, available at https://myspace.com/pages/privacy, explains its collection, processing and use of personal data.

22. Data Protection Provisions on the Use of Pinterest

The controller has integrated components of Pinterest Inc. into this website. Pinterest is a social network. A social network is an online meeting place and community that generally enables users to communicate with one another and interact in a virtual space. It may serve as a platform for exchanging opinions and experiences or enable the internet community to provide personal or business-related information. Among other things, Pinterest enables users to publish image collections, individual images and descriptions on virtual pinboards (“pinning”), which other users can then share (“repinning”) or comment on.

Pinterest is operated by Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA.

Whenever a page of this website operated by the controller and containing a Pinterest component (Pinterest plug-in) is accessed, the relevant component automatically causes the internet browser on the data subject's information technology system to download a representation of the corresponding component from Pinterest. Further information about Pinterest is available at https://pinterest.com/. Through this technical process, Pinterest learns which particular subpage of our website the data subject visits.

If the data subject is logged into Pinterest at the same time, Pinterest identifies the particular subpage visited whenever the data subject accesses our website and throughout their stay on it. The Pinterest component collects this information and Pinterest associates it with the data subject's Pinterest account. If the data subject activates a Pinterest button integrated into our website, Pinterest associates that information with their personal Pinterest account and stores those personal data.

Pinterest receives information through the component that the data subject has visited our website whenever they are also logged into Pinterest at the time of access; this occurs whether or not they click the component. If the data subject does not want this information transmitted to Pinterest, they can prevent transmission by logging out of their Pinterest account before accessing our website.

Pinterest's published privacy policy, available at https://about.pinterest.com/privacy-policy, explains its collection, processing and use of personal data.

23. Web Analytics with Matomo and Microsoft Clarity

Matomo

We use Matomo to evaluate use of this website and improve its content and usability. Matomo is activated only after you consent to the “Statistics” category. Data collected include pages accessed, access times, and technical browser and device information. Our integration sends page addresses without query parameters or URL fragments and does not send a referring page address. It does not send form contents to Matomo.

Analysis is performed through the Matomo installation at stats.dehosted.net, operated by NetTask GmbH. In the configuration currently verified, the last byte of the IP address is masked; visit enrichment also uses the shortened IP address. This does not mean that all data collected are completely anonymous. Matomo may set cookies to recognise visits.

A retention period of four weeks is intended for all Matomo data. This period has not yet been implemented technically: the most recently checked settings provide for automatic deletion of raw visitor data after 180 days and reports after twelve months. Certain aggregated reports are exempt from automatic deletion and may be retained for longer.

Microsoft Clarity

We use Microsoft Clarity to analyse how this website is used, particularly through heatmaps and reconstructed visitor sessions. Data processed include clicks, scrolling, technical information and the displayed page structure. Data are transmitted to Microsoft. Microsoft may also process usage data for its own purposes under its privacy statement.

Our integration loads Clarity only after you consent to both the “Statistics” and “Marketing” categories. Form areas are explicitly masked before Clarity loads. Clarity may use first-party and third-party cookies. Our integration does not start a cookieless tracking mode if you decline.

Microsoft processes data as an independent controller. For people in the European Economic Area, Microsoft identifies Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, alongside Microsoft Corporation (USA). Processing outside the EEA is possible. Microsoft describes safeguards including the EU-US Data Privacy Framework and standard contractual clauses; details and contacts for exercising your rights are provided in its linked privacy statement.

Microsoft may also use personal usage data to improve its products and services and create advertising profiles. Under the Clarity terms, non-personal data may be used for research and development, including training, fine-tuning and evaluating AI models.

According to the current Clarity documentation, session playback data are retained for 30 days. Heatmaps, click data and sessions explicitly labeled or saved as favourites are retained for nine months. These periods concern data held by Clarity and are distinct from the lifetime of individual cookies.

Consent and Withdrawal

Processing for these analytics purposes relies on your consent under Article 6(1)(a) GDPR; where information is stored on or accessed from your device, section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies. You may change or withdraw your choice at any time in the Cookies section. Withdrawal takes effect for the future and does not affect the lawfulness of earlier processing. After withdrawal, an already loaded Clarity instance is stopped and the page reloads. You can use the website and its contact forms without consenting to analytics.

Further information: Matomo privacy information and the Microsoft Privacy Statement.

24. Data protection provisions concerning the use of SlideShare

The controller has integrated SlideShare components into this website. As a file hosting service, LinkedIn SlideShare enables presentations and other documents, such as PDF files, videos and webinars, to be exchanged and archived. The file hosting service allows users to upload media content in all common formats; documents can either be made publicly accessible or marked as private.

SlideShare is operated by LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA. LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible for data protection matters outside the USA.

LinkedIn SlideShare provides embed codes for media content stored there (presentations, PDF files, videos, photos, etc.). Embed codes are program code embedded in websites to display external content on the website itself. Embed codes allow content to be displayed on a website without storing it on that website’s own server and potentially infringing the reproduction rights of the respective content’s author. A further advantage of using embed codes is that the respective website operator does not use its own storage space, reducing the load on its own server. An embed code can be integrated anywhere on another website, allowing external content to be inserted within its own text. We use LinkedIn SlideShare to reduce the load on our server and avoid copyright infringements while using third-party content.

Whenever our website, which contains a SlideShare component (embed codes), is accessed, that component causes the browser used to download the corresponding embedded data from SlideShare. In this technical process, LinkedIn learns which specific subpage of our website the data subject visits.

If the data subject is logged into SlideShare at the same time, SlideShare recognises which specific subpage the data subject visits whenever our website is accessed and throughout the respective visit. SlideShare collects this information, and LinkedIn associates it with the data subject’s respective SlideShare account.

Through the SlideShare component, LinkedIn receives information that the data subject has visited our website whenever the data subject is also logged into SlideShare at the time of accessing our website, regardless of whether the data subject clicks on the embedded media. If the data subject does not wish this information to be transmitted to LinkedIn, they can prevent transmission by logging out of their SlideShare account before accessing our website.

LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may place cookies. Such cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. LinkedIn’s applicable data protection provisions are available at https://www.linkedin.com/legal/privacy-policy.

25. Data protection provisions concerning the use of Tumblr

The controller has integrated Tumblr components into this website. Tumblr is a platform that enables users to create and operate a blog. A blog is a portal hosted on a website and usually publicly accessible, where one or more people, known as bloggers or webloggers, can post articles or write down their thoughts in blog posts. In a Tumblr blog, users can publish text, images, links and videos, for example, and distribute them digitally. Tumblr users can also incorporate content from other websites into their own blogs.

Tumblr is operated by Tumblr, Inc., 35 East 21st St, Ground Floor, New York, NY 10010, USA.

Whenever an individual page of this website, which is operated by the controller and contains a Tumblr component (Tumblr button), is accessed, the respective Tumblr component automatically causes the browser on the data subject’s information technology system to download a representation of the corresponding Tumblr component from Tumblr. Further information on Tumblr buttons is available at https://www.tumblr.com/buttons. In this technical process, Tumblr learns which specific subpage of our website the data subject visits. The purpose of integrating the Tumblr component is to enable our users to redistribute this website’s content, promote this website in the digital world and increase our visitor numbers.

If the data subject is logged into Tumblr at the same time, Tumblr recognises which specific subpage of our website the data subject visits whenever our website is accessed and throughout the respective visit. The Tumblr component collects this information, and Tumblr associates it with the data subject’s respective Tumblr account. If the data subject activates one of the Tumblr buttons integrated into our website, the data and information transmitted are associated with the data subject’s personal Tumblr account and stored and processed by Tumblr.

Through the Tumblr component, Tumblr receives information that the data subject has visited our website whenever the data subject is also logged into Tumblr at the time of accessing our website, regardless of whether the data subject clicks on the Tumblr component. If the data subject does not wish this information to be transmitted to Tumblr, they can prevent transmission by logging out of their Tumblr account before accessing our website.

Tumblr’s applicable data protection provisions are available at https://www.tumblr.com/policy/en/privacy.

26. Data protection provisions concerning the use of Twitter

The controller has integrated Twitter components into this website. Twitter is a multilingual, publicly accessible microblogging service on which users can publish and distribute tweets, meaning short messages limited to 140 characters. These short messages can be accessed by anyone, including people who are not registered with Twitter. Tweets are also displayed to the respective user’s followers. Followers are other Twitter users who follow a user’s tweets. Twitter also enables a broad audience to be reached through hashtags, links or retweets.

Twitter is operated by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

Whenever an individual page of this website, which is operated by the controller and contains a Twitter component (Twitter button), is accessed, the respective Twitter component automatically causes the browser on the data subject’s information technology system to download a representation of the corresponding Twitter component from Twitter. Further information on Twitter buttons is available at https://about.twitter.com/de/resources/buttons. In this technical process, Twitter learns which specific subpage of our website the data subject visits. The purpose of integrating the Twitter component is to enable our users to redistribute this website’s content, promote this website in the digital world and increase our visitor numbers.

If the data subject is logged into Twitter at the same time, Twitter recognises which specific subpage of our website the data subject visits whenever our website is accessed and throughout the respective visit. The Twitter component collects this information, and Twitter associates it with the data subject’s respective Twitter account. If the data subject activates one of the Twitter buttons integrated into our website, the data and information transmitted are associated with the data subject’s personal Twitter account and stored and processed by Twitter.

Through the Twitter component, Twitter receives information that the data subject has visited our website whenever the data subject is also logged into Twitter at the time of accessing our website, regardless of whether the data subject clicks on the Twitter component. If the data subject does not wish this information to be transmitted to Twitter, they can prevent transmission by logging out of their Twitter account before accessing our website.

Twitter’s applicable data protection provisions are available at https://twitter.com/privacy?lang=de.

27. Data protection provisions concerning the use of Xing

The controller has integrated Xing components into this website. Xing is an internet-based social network that enables users to connect with existing business contacts and establish new business contacts. Individual users can create personal profiles on Xing. Companies can, for example, create company profiles or publish job vacancies on Xing.

Xing is operated by XING AG, Dammtorstraße 30, 20354 Hamburg, Germany.

Whenever an individual page of this website, which is operated by the controller and contains a Xing component (Xing plug-in), is accessed, the respective Xing component automatically causes the browser on the data subject’s information technology system to download a representation of the corresponding Xing component from Xing. Further information on Xing plug-ins is available at https://dev.xing.com/plugins. In this technical process, Xing learns which specific subpage of our website the data subject visits.

If the data subject is logged into Xing at the same time, Xing recognises which specific subpage of our website the data subject visits whenever our website is accessed and throughout the respective visit. The Xing component collects this information, and Xing associates it with the data subject’s respective Xing account. If the data subject activates one of the Xing buttons integrated into our website, such as the “Share” button, Xing associates this information with the data subject’s personal Xing account and stores these personal data.

Through the Xing component, Xing receives information that the data subject has visited our website whenever the data subject is also logged into Xing at the time of accessing our website, regardless of whether the data subject clicks on the Xing component. If the data subject does not wish this information to be transmitted to Xing, they can prevent transmission by logging out of their Xing account before accessing our website.

Xing’s published data protection provisions, available at https://www.xing.com/privacy, explain how Xing collects, processes and uses personal data. Xing has also published data protection information for the XING Share button at https://www.xing.com/app/share?op=data_protection.

28. Data protection provisions concerning the use of YouTube

The Smart Desk page initially displays a locally hosted preview. The embedded YouTube player is loaded only when you activate the video area expressly labelled “Load and play the video from YouTube”. We use the youtube-nocookie.com embed address for this purpose. Privacy-enhanced mode does not prevent all data transfers to YouTube. Alternatively, a separate link lets you open the video directly on YouTube.

The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading the player involves processing, in particular, your IP address, browser and device information and the page accessed; playback also involves usage data. Additional resources from YouTube and Google, including preview images and fonts, are requested when the player loads, even if playback has not started. If you are signed into a Google account, Google may associate information with that account.

The external player is activated on the basis of your consent under Article 6(1)(a) GDPR and, where device information is stored or accessed, section 25(1) TDDDG. You can remove the player by reloading the page: the local preview is then displayed again and a new explicit activation is required. This does not recall data already transmitted or affect the lawfulness of prior processing.

Processing outside the European Economic Area, particularly in the USA, is possible. Information on processing, retention, transfer safeguards and your rights is provided in the Google Privacy Policy.

29. Payment method: data protection provisions concerning PayPal

The controller has integrated PayPal components into this website. PayPal is an online payment service provider. Payments are processed through PayPal accounts, which are virtual personal or business accounts. PayPal also allows virtual payments to be processed by credit card when a user does not have a PayPal account. A PayPal account is identified by an email address, so there is no conventional account number. PayPal enables users to initiate online payments to third parties or receive payments. PayPal also performs escrow functions and offers buyer protection services.

PayPal’s European operating company is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If the data subject selects “PayPal” as the payment option during the ordering process in our online shop, the data subject’s data are automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transmission of personal data required to process the payment.

The personal data transmitted to PayPal generally include the first name, surname, address, email address, IP address, telephone number, mobile telephone number or other data necessary to process the payment. Personal data relating to the respective order are also necessary to perform the purchase contract.

The data are transmitted for payment processing and fraud prevention. The controller will transmit personal data to PayPal in particular where there is a legitimate interest in the transmission. PayPal may transmit personal data exchanged between PayPal and the controller to credit reference agencies. Such transmission is for identity and creditworthiness checks.

PayPal may disclose personal data to affiliated companies and service providers or subcontractors where necessary to fulfil contractual obligations or where the data are to be processed on its behalf.

The data subject may withdraw consent to the handling of personal data at any time by contacting PayPal. Withdrawal does not affect personal data that must necessarily be processed, used or transmitted to process the payment in accordance with the contract.

PayPal’s applicable data protection provisions are available at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

30. Legal basis for processing

Article 6(1)(a) GDPR provides our company with the legal basis for processing operations for which we obtain consent for a specific processing purpose. Where processing personal data is necessary to perform a contract to which the data subject is a party, for example processing operations required to deliver goods or provide another service or consideration, processing is based on Article 6(1)(b) GDPR. The same applies to processing operations necessary to take steps prior to entering into a contract, for example enquiries about our products or services. Where our company is subject to a legal obligation requiring the processing of personal data, such as compliance with tax obligations, processing is based on Article 6(1)(c) GDPR. In rare cases, processing personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance details or other vital information then had to be disclosed to a doctor, hospital or other third parties. Processing would then be based on Article 6(1)(d) GDPR. Finally, processing operations may be based on Article 6(1)(f) GDPR. This legal basis applies to processing operations not covered by any of the legal bases above, where processing is necessary to pursue a legitimate interest of our company or a third party, provided that the data subject’s interests, fundamental rights and freedoms do not override it. Such processing operations are permitted in particular because the European legislator expressly referred to them. In this respect, the legislator took the view that a legitimate interest could exist where the data subject is a client of the controller (recital 47, sentence 2, GDPR).

31. Legitimate interests pursued by the controller or a third party in processing

Where the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is conducting our business for the benefit of the well-being of all our employees and our shareholders.

32. Period for which personal data are stored

The criterion determining the period for which personal data are stored is the respective statutory retention period. Once that period expires, the relevant data are routinely erased unless they are still needed to perform a contract or take steps towards entering into a contract.

33. Statutory or contractual requirements to provide personal data; necessity for entering into a contract; the data subject’s obligation to provide personal data; possible consequences of failing to provide them

We inform you that providing personal data may in part be required by law (for example, tax regulations) or may arise from contractual provisions (for example, information about the contracting party). In some cases, entering into a contract may require a data subject to provide us with personal data that we must subsequently process. For example, the data subject is obliged to provide us with personal data where our company enters into a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before providing personal data, the data subject must contact our data protection officer. Our data protection officer will explain, in the individual case, whether providing the personal data is required by law or contract or is necessary to enter into the contract, whether there is an obligation to provide the personal data, and what the consequences of failing to provide them would be.

34. Existence of automated decision-making

The website functions described do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. For analytics procedures and possible processing for providers’ own purposes, please refer to section 23.

Form Protection with ALTCHA

We use ALTCHA in our contact forms to make automated abusive submissions more difficult. The script used for this purpose is loaded from our website. Your browser performs a computational task and sends the corresponding proof to our server, which checks it when the form is submitted. ALTCHA does not replace the other security measures used on our website. Processing serves our legitimate interest in protecting our forms against abuse under Article 6(1)(f) GDPR.

For validation and to prevent reuse, the installed extension maintains technical verification records in our database. These include a challenge identifier, timestamp, expiry time and solved status. A proof is valid for five minutes. Expiry does not immediately delete the database record: the extension provides an hourly cleanup job for records whose timestamp is more than seven days old.

The original text underlying this privacy policy was created using the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, which acts as an external data protection officer, in cooperation with RC GmbH, which recycles used computers, and the law firm WILDE BEUGER SOLMECKE | Rechtsanwälte.