This Privacy Statement is effective as of May 2018.
Phone: +49 (0)40 180 377 47
CEO: Alexander Buchmann
Data Protection Official: Mr. Sven Herma
General categories of personal data that we may process:
- Inventory data (e.g. name, address).
- Contact details (e.g. telephone number, email address).
- Content data (e.g. text input, photographs, videos).
- Usage data (e.g. page views, website navigation paths, length of visit).
- Meta/communication data (e.g. operating system, IP address).
The data may be processed for the purposes of
- Operating our website and providing our services
- Communicating with you
- Ensuring the security of our website and services
- Analyzing the use of the website and services/marketing
“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” is any operation or set of operations that is performed on personal data or on sets of personal data, whether or not by automated means. The term is extensive and contains any possible dealing with personal data.
“Controller” is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
Collaboration with processors and third parties
If, in the context of our processing, we disclose data to other persons and companies (contract processors or third parties), transmit them to them or otherwise grant access to the data, this will only be done on the basis of a legal permission (eg. if a transmission of the data to third parties like payment service providers is required, pursuant to Art. 6 (1) (b) GDPR to fulfill the contract), you have consented to a legal obligation or based on our legitimate interests (e.g. the use of agents, webhosters, etc.).
If we commission third parties to process data on the basis of a so-called "contract processing contract", this is done on the basis of Art. 28 GDPR.
International transfers of your personal data
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. GDPR. That is the processing is e.g. on the basis of specific guarantees, such as the officially recognized level of data protection (e.g. for the US through the Privacy Shield) or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").
You have the right to ask for confirmation as to whether the data in question is being processed and for information about this data as well as for further information and a copy of the data in accordance with Art. 15 GDPR.
In accordance with Art. 16 GDPR you have the right to demand the completion of the data concerning you or the correction of the incorrect data concerning you.
In accordance with Art. 17 GDPR you have the right to demand the immediate deletion of the relevant data or, alternatively, to require a restriction of the processing of data in accordance with Art. 18 GDPR.
You have the right to demand that you receive the data concerning you, which you have provided to us, in accordance with Art. 20 GDPR and demand that it be transmitted to other persons responsible.
You have the right to demand the data relating to you, which you have provided to us, to be obtained in accordance with Art. 20 GDPR and request their transmission to other persons responsible.
In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with the competent supervisory authority.
Right of withdrawal
You have the right to withdraw granted consent with effect for the future in accordance with Art. 7 (3) GDPR.
Right of objection
You can object to the future processing of your data in accordance with Art. 21 GDPR at any time. The objection may in particular be made against processing for direct marketing purposes.
"Cookies" are small files that are stored on users' computers. Different information can be stored within cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after his visit to an online service. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online service and closes his browser. In such a cookie, e.g. the contents of a shopping cart in an online shop or a login status can be stored.
The term "permanent" or "persistent" refers to cookies that remain stored even after the browser has been closed. Thus, e.g. the login status will be saved even if users visit after several days. Likewise, in such a cookie the interests of the users can be stored, which are used for range measurement or marketing purposes.
A "third-party cookie" refers to cookies that are offered by providers other than the controller of the online service (otherwise they’re called "first-party cookies").
If users do not want cookies stored on their computer, we ask them to disable the option in their browser's system settings. Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online service.
Deleting Personal Data
In accordance with legal requirements in Germany, the data will be stored for 10 years pursuant to §§ 147 (1) AO, 257 (1) Nr 1 and 4 (4) HGB (books, records, management reports, accounting documents, trading books for taxation of relevant documents, etc.) and 6 years pursuant to § 257 (1) Nr. 2 and 3 (4) HGB (commercial letters).
The hosting services we use serve the providing of: infrastructure and platform services, computing capacity, maintaining back-ups of our databases, ensuring the security of our website and maintenance services for the purpose of operating our website and providing our services.
Here we or our hosting providers process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online service on the basis of our legitimate interests in an efficient and secure provision of this online service pursuant to Art. 6 (1) lit. f GDPR and Art. 28 GDPR (job processing contract closing).
Collection of access data and log files
Based on our legitimate interests within the meaning of Art. 6 (1) lit. f GDPR we or our hosting provider collect data on every access to the server on which this service is located (so-called server log files).
Access data includes:
- Name of the visited website
- Date and time of access
- Transferred amount of data
- Report of successful access
- Browser type and version
- Host name of the accessing computer
- Operating system of the user
- Referrer URL (the previously visited page)
- IP address
- requesting providers
Logfile information is stored for security purposes (for example, to investigate abusive or fraudulent activities) for a maximum of 7 days and then deleted. Data required for evidential purposes shall be exempted from the deletion until final clarification of the incident.
A merge of this data with other data sources will not be made.
SSL or TLS encryption
This site uses SSL or TLS encryption for security reasons and for the protection of the transmission of confidential content, such as the inquiries you send to us as the site operator. You can recognize an encrypted connection in your browser’s address line when it changes from “http://” to “https://” and the lock icon is displayed in your browser’s address bar.
If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties.
Should you send us questions via the contact form, email, telephone or social media, we will collect the data you provide, to answer your question and any follow-up questions as per Art. 6 (1) lit. a GDPR. The data may be stored in a Customer-Relation-Management System (“CRM System”) or similar systems.
We delete the requests, if they are no longer required. We check the necessity every two years. Furthermore, the legal archiving obligations apply.
We are providing you with the following information to explain the content of our newsletter as well as the registration, dispatch and statistical evaluation processes and your right of objection. By subscribing to our newsletter you agree with the described processes. Content of our newsletter: We send newsletter, emails and other electronic notifications with advertising material (referred to hereinafter as the “newsletter”) with the consent of the recipients or legal permission. If specific content of the newsletter is altered during the registration process, this content is essential for the consent of the users. Our newsletters contain information on our services and us.
Double-opt-in and recording process
Registration for our newsletter is completed as part of a so called double-opt-in process. This means you will receive an email after registration in which you will be asked to confirm your registration. This confirmation is required so that nobody can register with email addresses that do not belong to them. The newsletter registrations are recorded in order to be able to verify the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation and the IP address. The changes to your data that is held by your email service provider are also recorded.
You only need to provide your email address to register for the newsletter. If you also provide us with your and your company’s names this enables us to personalise our newsletter.
The dispatch of our newsletter and the related performance measurement is based on the consent of the recipient in accordance to Art. 6 (1) lit. f GDPR, § 7 (2) Nr. 3 UWG and on the basis of the legal permission according to § 7 (3) UWG.
The protocolling of the registration process is based on our legitimate interests in accordance with Art. 6 (1) lit. f GDPR. Our interest is a user-friendly and secure newsletter system, which serves both our business interests and the expectations of the users and also allows us to prove consent.
You may opt-out of receiving our newsletter at any time, i.e. withdraw your consent. You can find a link to unsubscribe to the newsletter at the end of each newsletter. We may store the withdrawn email addresses based on our legitimate interests for up to three years before we delete them to prove prior consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that at the same time the former existence of a consent is confirmed.
Email service provider
MailChimp can by its own admission also use this data in a pseudonymous form to enhance or improve its own services, e.g. to technically enhance the dispatch procedure and display of the newsletter or for commercial purposes to be able to determine which countries the recipients are from. However, MailChimp will not use the data of our newsletter recipients to contact them itself or forward it to third parties.
Our emails contain a “web beacon”, i.e. a pixel-size file that is retrieved from our or the MailChimp server when opening emails. This initially involves technical information being retrieved such as information on the browser and your system as well as your IP address and the time of retrieval.
This information is used to make technical improvements to services based on technical data or the target groups and their reading behaviour based on their retrieval locations (that can be determined with the IP address) or access times. The statistical surveys also involve determining whether the newsletters are opened, when they are opened and which links are clicked on. This information may be assigned to individual newsletter recipients for technical reasons but it is neither our intention nor that of MailChimp to monitor individual users. The evaluations instead help us to recognise the reading habits of our users and to adapt our content to them or to send different content based on our users’ interests.
Google is certified under the data privacy agreement Privacy-Shield and agrees to comply with the EU data privacy guidelines (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use this information on our behalf to evaluate the use of our online service by users, to compile reports on the activities within this online offer and to provide us with further services related to the use of this online offer and the internet usage. Thereby pseudonymous usage profiles of the users may be created from the processed data.
We have activated the IP anonymization feature on this website. Your IP address will be shortened by Google within the European Union or other parties to the Agreement on the European Economic Area prior to transmission to the United States. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there.
The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data held by Google.
Objecting to the collection of data
You can prevent the collection of your data by Google Analytics by clicking on the following link and downloading and installing the plugin: http://tools.google.com/dlpage/gaoptout?hl=de.
Alternatively, when using a smartphone or tablet you can click on the following link. An opt-out cookie will be set to prevent your data from being collected on future visits to this site: Deactivate Google Analytics.
When deleting the cookies in this browser you need to click this link again.
Outsourced data processing
We have closed a contract with Google for the outsourcing of our data processing and have fully implemented the strict requirements of the German data protection authorities when using Google Analytics.
Demographic data collection by Google Analytics
This website uses Google Analytics’ demographic features. This allows reports to be generated containing statements about the age, gender, and interests of site visitors. This data comes from interest-based advertising from Google and third-party visitor data. This collected data cannot be attributed to any specific individual person. You can disable this feature at any time by adjusting the ads settings in your Google account or you can forbid the collection of your data by Google Analytics as described in the section “Objecting to the collection of data”.
The personal data of users will be deleted or anonymised after 14 months.
Google AdWords and Google Conversion-Tracking
Based on our legitimate interests (analysis, optimization and economical operation of our online services) in accordance to Art. 6 (1) lit. f GDPR we use Google-Marketing-Services operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, („Google“).
Google is certified under the data privacy agreement Privacy-Shield and agrees to comply with the EU data privacy guidelines (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google Marketing Services allows us to better target advertisements for and on our website so that we only present ads to users that potentially match their interests. For example showing a user ads for products he's been interested in on other websites is called remarketing. Therefore, when our and other websites using Google Marketing Services are accessed, a code by Google will be executed and so called (re)marketing tags (invisible graphics or code, also called "Web Beacons") are incorporated into the website. This way an individual cookie (instead of cookies, comparable technologies may be used) is stored on the user’s device. These cookies can be set by different domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com or googleadservices.com. In such a cookie details like websites the user visited, what content he is interested in and what offers he has clicked as well as technical information about the browser and operating system, referring web pages, visit time and other information about the use of the online offer can be stored. The user’s IP address will be stored as well. It will, however, be shortened by Google within the European Union or other parties to the Agreement on the European Economic Area prior to transmission to the United States. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data held by Google. The information mentioned above may be linked by Google with similar information from other sources. If the user then visits other websites, ads can be displayed matching his interests.
The user’s data is processed pseudonymously by the Google marketing services. That is Google stores and processes e.g. not the user’s name or e-mail address but the relevant cookie-related data from pseudonymous user profiles. From Google’s perspective ads are not managed for and displayed to an identifiable person, but the cookie owner, regardless of who that cookie owner is. This doesn’t apply if a user has explicitly allowed Google to process the data without its pseudonymization. The information about users collected by Google Marketing Services is transmitted to Google and stored on Google's servers in the United States.
As part of Google AdWords, we use so-called conversion tracking. Each Google AdWords advertiser has a different cookie. Thus, cookies cannot be tracked using the website of an AdWords advertiser. The information obtained using the conversion cookie is used to create conversion statistics for the AdWords advertisers who have opted for conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a conversion tracking tag page. However, advertisers do not obtain any information that can be used to personally identify users.
In addition, we may use the "Google Tag Manager" to integrate and manage the Google Analytics and Marketing Services on our website.
If you wish to opt-out of interest-based advertising through Google Marketing Services, you can make use of Google's recruitment and opt-out options: http://www.google.com/ads/preferences.
Plugins and Tool
Based on our legitimate interests (ie. interest in the analysis, optimization and economic operation of our online services in accordance to Art. 6 (1) lit. GDPR), we make use of contents and services offered by third-party providers in order to provide their content and services, such as including videos or fonts (collectively referred to as "content").
This always presupposes that the third-party providers of this content perceive the IP address of the users, since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as traffic of visitors on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include, but is not limited to, technical information about the browser and operating system, referring web pages, visit time, and other information regarding the use of our online offer.
Our website uses plugins from Hotjar. This is provided by Hotjar Ltd, Level 2, St Julians Business Center, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe. We use Hotjar in order to better understand our users' needs and to optimize our service and users' experience.
If you do not want to be recorded by Hotjar, you can disable it by setting the DoNotTrack header in your browser. For more information and more about Hotjar's data processing, please visit: www.hotjar.com/legal/compliance/opt-out.
Our website uses plugins from YouTube, which is operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.
If you visit one of our pages featuring a YouTube plugin, a connection to the YouTube servers is established. Here the YouTube server is informed about which of our pages you have visited. If you’re logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.
YouTube is used to help make our website appealing. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.
This site uses the Google Maps map service via an API. It is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
To use Google Maps, it is necessary to save your IP address. This information is generally transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. The use of Google Maps is in the interest of making our website appealing and to facilitate the location of places specified by us on the website. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.
Google Web Fonts
For uniform representation of fonts, this page uses web fonts provided by Google. When you open a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.
For this purpose, your browser has to establish a direct connection to Google servers. Google thus becomes aware that our web page was accessed via your IP address.
The use of Google Web fonts is based on our legitimate interest of a uniform and attractive presentation of our website. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.
If your browser does not support web fonts, a standard font is used by your computer.
This site, especially the blog, uses the external Avatar-Service Gravatar for the display of pictures and avatars of users posting on this website. Gravatar is operated by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.
Gravatar is used to save user’s email addresses together with their profile pictures. That way when writing or commenting on websites (mostly blogs) the user’s profile picture can be displayed beside the post. For this purpose, the user’s encoded email address is transferred to Gravatar for them to check if a profile exists. We transmit exclusively the e-mail addresses of the authors of posts on our blog, thus mostly our own employees’. By displaying these pictures Gravatar can store your IP-address.
The use of Gravatar is in the interest of making our website appealing and to provide the opportunity for users to personalize their posts. This constitutes a justified interest pursuant to Art. 6 (1) lit. f GDPR.
Further information: https://automattic.com/privacy/
This site uses plugins from Wistia a service for hosting and playing videos. It is operated by Wistia Inc., 17 Tudor Street, Cambridge, Massachusetts, United States, USA.
The Wistia server is informed about which of our pages you have visited. If you’re logged in to your Wistia account, Wistia allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your Wistia account.
Further information: https://wistia.com/privacy
Online presence in social media
We maintain online presences within social networks and platforms in order to communicate with customers, prospects and users to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing guidelines apply to their respective operators.