Privacy policy for the website https://planubo.com
This privacy policy explains what personal data is collected on our website and for what purposes it is used.
I. Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (“GDPR”) and other national data protection laws of the member states as well as other data protection regulations is:
Planubo GbR
Am Hirtengarten 2
77743 Neuried
Germany
Tel.: +49 7807 89089 76
Email: info@planubo.com
Website: https://planubo.com/
II. General information on data processing on our website
- Description and scope of the processing of personal data
The processing of our users’ personal data is generally only carried out to the extent necessary to provide our website and our content and services. Where required by law, processing in individual cases will only take place with the user’s consent. Exceptions apply in cases where the processing of personal data is already permitted by other legal provisions.
- Legal basis for the processing of personal data
If the consent of the data subject is obtained for the processing of personal data, we process the data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, if special categories of personal data are processed. In the event of express consent to the transfer of personal data to third countries outside the EU/EEA, data processing is also carried out on the basis of Art. 49 (1) (a) GDPR. Insofar as the processing of personal data is necessary for the performance of a contract or for the implementation of pre-contractual measures, Art. 6 (1) (b) GDPR serves as the legal basis. We also process personal data insofar as this is necessary to fulfill a legal obligation in accordance with Art. 6 (1) (c) GDPR. Insofar as processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights, and freedoms of the data subject do not outweigh this interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for processing. The legal basis relevant to the respective data processing can be found in the following sections of this privacy policy.
- Duration of storage and obligation to delete data
We only store personal data of the data subjects for as long as is legally permissible. Unless a specific storage period is specified for individual data processing operations, the personal data of the data subject will be deleted (or blocked) as soon as the respective purpose of storage no longer applies. Furthermore, storage may only take place if this has been provided for by European or national legislators in corresponding regulations, laws, or other provisions that are applicable to us as the controller. Personal data may also be deleted (or blocked) if a storage period or retention period prescribed by the aforementioned regulations expires, unless the storage of the personal data of the data subject is necessary for the conclusion or fulfillment of a contract or other legal reasons require further storage.
- Transfer of personal data outside the EU/EEA
When using services or applications from third-party providers, data processing may take place in third countries outside the member states of the European Union (EU) or signatory states to the Agreement on the European Economic Area (EEA). For this purpose, the EU Commission has issued an adequacy decision pursuant to Art. 45 (1) GDPR for some of these third countries, confirming under certain conditions that adequate protection for personal data exists in the respective country. The list of the currently valid adequacy decisions of the EU Commission can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. The respective adequacy decisions may differ in their scope from country to country. For example, the adequacy decision for the United States of America (USA) only applies if the respective data recipient in the USA can provide evidence of certification under the EU-US Data Privacy Framework with the US Department of Commerce. Information on this can be found below for the respective providers.
In cases where no adequacy decision has been made by the EU Commission, appropriate agreements are generally concluded with the respective service providers, such as the conclusion of standard contractual clauses, which are intended to ensure, among other things, a level of data protection that is sufficient according to European standards. In addition, further protective measures (e.g., encryption and additional contractual provisions on guarantees, etc.) are taken, as required by the applicable data protection laws, to ensure an adequate level of protection for your personal data.
In this privacy policy, we expressly point out the legal basis on which data is transferred to the respective third country.
III. Data processing when providing the website and creating log files
- Description and scope of the processing of personal data
Each time a user visits our website, the system automatically collects data and information from the respective computer system of the user’s accessing device. In particular, the following data is collected:
- User’s IP address
- Date and time of access
- Website visited
- Source/reference from which the user accessed our website
- Information about the browser type and version used
- The user’s operating system
The aforementioned data is also stored in our system’s log files. However, this data is not stored together with other personal data relating to the user.
We use a web host with whom we have concluded a data processing agreement to collect and store the data. The provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. Further information about the provider and data protection information can be found here: https://www.strato.de/datenschutz/
- Purpose of processing personal data
The purpose of the temporary storage of the IP address by our system is to be able to deliver our website to the user’s end device. For this purpose, it is essential that the user’s IP address remains stored for the duration of the session.
The purpose of storing the data in the log files is to ensure the functionality of our website. We also use this data for technical optimization and to check the stability of the website, as well as to ensure the security of our information technology systems.
- Legal basis for the processing of personal data
The legal basis for the temporary storage of data and the storage of data in log files is Art. 6 (1) (f) GDPR. The aforementioned purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) (f) GDPR. It is not apparent that the interests, fundamental rights, and freedoms of the data subject outweigh this interest.
- Duration of storage and data deletion
In principle, the data is deleted as soon as it is no longer necessary for the purpose for which it was collected . This is the case for data collected for the provision of the website when the respective session has ended. The data is not stored beyond this.
If data is stored in log files, this is the case after seven days at the latest. If storage beyond this period is necessary, the IP addresses of the users are deleted or shortened in such a way that it is no longer possible to assign them to the calling terminal device.
- Right to object and right to erasure
As can be seen from the purpose of data processing, the collection of the aforementioned data for the provision of our website and the storage of the data in log files is absolutely necessary for the operation of the website. For this reason, there is no possibility for the user to object.
IV. Use of a consent management service (cookie consent manager)
- Description and scope of the processing of personal data
We use the consent management service “Devowl Real Cookie Banner” from the provider devowl.io GmbH, based in Tannet 12, 94539 Grafling (hereinafter “Real Cookie Banner”). When our website is accessed, the system automatically collects data and information from the computer system of the user’s accessing device. In this case, the following data is collected by or through the use of the service:
- Opt-in and opt-out data
- Referrer URL
- User agent
- User settings
- Consent ID
- Time of consent
- Consent type
- Template version
- Banner language
Since the data is stored exclusively by us and the provider has no access to this data, the provider states that it is not necessary to conclude a data processing agreement. The provider’s privacy policy and further information can be found here: https://devowl.io/de/datenschutzerklaerung/.
- Purpose of processing personal data
The service is used by integration into our website to enable the collection of legally required consents. This serves to comply with legal obligations, according to which data processing requiring consent may only be carried out via the website if the user has given their consent. Both the storage and management of the consents obtained are carried out exclusively on our servers and not by the service. This also applies in the event of revocation of the consent given.
- Legal basis for the processing of personal data
The legal basis is Art. 6 (1) (c) GDPR due to the legal obligation to store the aforementioned data.
- Duration of storage and data deletion
In principle, the transmitted data is deleted as soon as it is no longer necessary for the purpose for which it was collected. The retention period is the period of time during which the collected data is stored for processing.
The consent data (consent given and withdrawal of consent) is stored for three years. The data is then deleted immediately.
- Right to object and right to erasure
The collection and storage of data is required by law for the operation of the website. Consequently, there is no possibility for the user to object.
V. Use of and data processing with cookies
- Description and scope of the processing of personal data
We use cookies in the context of providing our website. These are data records that are stored in the Internet browser or by the Internet browser on the user’s end device. As soon as a user visits a website, a cookie may be stored on the user’s end device. The respective cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again. Cookies are either stored temporarily for the duration of a session (so-called “session cookies”) or permanently (so-called “permanent cookies”) on your device.
We use technically necessary cookies to ensure that our website functions properly. In this respect, some elements of our website require that the browser calling up the website can be recognized even after a page change. The following information is stored and transmitted in the respective cookies:
- Language settings
- Login information
In addition, we use cookies on our website that enable, for example, an analysis of users’ surfing behavior or are used for advertising purposes. The data collected in this way is explained in section VI. of this privacy policy.
When users visit our website, they are informed about the use of cookies for analysis and advertising purposes with reference to this privacy policy, and their consent to the processing of personal data used in this context is obtained via the aforementioned cookie consent manager. In this case, you will also receive further information about the individual cookies, such as their name, purpose, and storage duration.
- Purpose of processing personal data
The purpose of using technically necessary cookies is to enable the use of websites for users in the first place. They can be used, for example, to maintain user sessions and prevent security threats. There are some functions on our website that cannot be offered without the use of cookies. In these cases, it is essential that, for example, the browser is recognized even after a page change. This applies, for example, to the following applications:
- Transfer of language settings
- Login information
The user data collected by technically necessary cookies is not used to create user profiles.
Analysis and advertising cookies are used for the purpose of optimizing the quality of our website and improving the display of content. Analysis and advertising cookies enable us to determine how the website is accepted by users and thus continuously optimize our offering and make it more interesting for users.
- Legal basis for the processing of personal data
The legal basis for the processing of personal data using cookies for analysis and advertising purposes is Art. 6 (1) (a) GDPR, provided that the user has given their consent.
The legal basis for the processing of personal data using technically necessary cookies within the meaning of Section 25 (2) TDDDG is Art. 6 (1) (f) GDPR. In this respect, we have a legitimate interest in using necessary cookies for the technically error-free and optimized provision of our services. It is not apparent that the interests, fundamental rights, and freedoms of the data subject outweigh this interest.
- Duration of storage and data deletion
The duration of storage and data deletion depends on the type of cookie and how the user selects their browser settings. This is because cookies are stored on the user’s device and transmitted from there to our website. In this respect, it is generally possible to completely deactivate or restrict the acceptance of cookies. Stored cookies can also be deleted by the user at any time, which can even be done automatically. Session cookies are automatically deleted at the end of the website visit. Permanent cookies remain stored on the user’s device until the user deletes them or they are automatically deleted by the browser.
For details on the cookies used and their storage duration, please refer to our Cookie Consent Manager. Please note that you may not be able to use all the features of our website to their full extent if you disable cookies for our website.
- Right to object and removal
As a user, you have the following options for objection and removal:
- You can revoke your consent to the use of analysis and advertising cookies at any time with future effect by notifying us or by changing your data protection or privacy settings in our Cookie Consent Manager.
- You can also prevent the collection of data generated by the respective cookie and related to your use of our website (including your IP address) and the processing of this data by downloading and installing the plugin available for your browser.
- You can also manage advertising cookies using tools developed in many countries as part of self-regulation programs, such as https://optout.aboutads.info/ (USA) or http://www.youronlinechoices.com/uk/your-ad-choices (EU).
- Transfer of personal data outside the EU/EEA
If you give your consent to the use of functional cookies and cookies for analysis and advertising purposes, you also consent to your data being processed in a third country outside the EU/EEA in accordance with Art. 49 (1) (a) GDPR. If you do not wish this to happen, you can refuse your consent. In addition, you can revoke your consent at any time with effect for the future. The legality of the data processing carried out until the revocation of your consent remains unaffected by this.
VI. Use of web analytics by the Google Analytics service
- Description and scope of the processing of personal data
We use “Google Analytics 4” on our website, a web analytics service provided by Google Ireland Limited, located at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This makes it possible to assign data, sessions, and interactions across multiple devices to a pseudonymous user ID and thus analyze a user’s activities across devices.
Google uses cookies, i.e., data records that are stored on the user’s device and enable an analysis of the use of the website. The information generated by the cookie about the use of this website is generally processed within the EU or the EEA. If IP anonymization is activated on this website, the IP address of users within the EU or the EEA is truncated by Google beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate the use of the website, to compile reports on website activity, and to provide other services related to website activity and internet usage to the website operator.
The following user data, among other things, will be processed:
- User’s IP address
- Date and time of access
- Requesting domain
- Device type, model, brand, screen resolutions
- Operating system, versions, families
- Browser, version, configuration, engines, plugins, language, language code
- Location data
- Pages per visit, number of visits, repeat visits
- Visit time, visit day
- Entry pages, exit pages, page URL, page title
- Search terms, downloads
- Search engines, search terms, websites, social networks
- Campaigns, campaign keywords
We have concluded a data processing agreement with Google for this purpose. The provider’s terms of use can be found at:www.google.com/analytics/terms/de.html and the privacy policy at:www.google.de/intl/de/policies/privacy .
- Purpose of processing personal data
The purpose of using the web analysis service is to analyze the use of our website and to be able to optimize the website regularly on the basis of the analyses. The statistics obtained enable us to continuously improve our offering and make it more interesting for you as a user.
- Legal basis for the processing of personal data
The legal basis for the use of the web analysis service is Art. 6 (1) (a) GDPR in the case of prior consent given by the user.
- Duration of storage and data deletion
According to Google, the data sent by Google and linked to cookies, user IDs (e.g., user ID) or advertising IDs is automatically deleted after 14 months at the latest. For details, please refer to our Cookie Consent Manager. According to Google, data that has reached its retention period is automatically deleted once a month. Please note that we have no influence on the duration of storage at Google.
- Right to object and right to erasure
As a user, you have the following options for objection and removal:
- You can revoke your consent to the use of analysis and advertising cookies at any time with future effect by notifying us or by changing your data protection or privacy settings in our Cookie Consent Manager.
- You can prevent the storage of cookies by adjusting your browser settings accordingly.
- You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout.
- Opt-out cookies prevent the future collection of your data when you visit this website.
This website uses Google Analytics with the extension “_anonymizeIp()”. This means that IP addresses are truncated before being processed, thus ruling out any possibility of personal reference. If the data collected about you is of a personal nature, it will be immediately excluded and the personal data will be deleted immediately.
- Transfer of personal data outside the EU/EEA
The processing of personal data by Google in the USA is not completely excluded. In cases where personal data is transferred to the USA, Google invokes the conclusion of standard contractual clauses. In addition, Google LLC is certified under the EU-US Data Privacy Framework by the US Department of Commerce, so that the adequacy decision of the EU Commission also applies to data transfers directly to the USA.
- Use of Google Tag Manager
We use the functions of Google Tag Manager on our website. Google Tag Manager is a solution that allows marketers to manage so-called website tags via an interface. The “Tag Manager” tool itself, which implements the tags, is a service that can collect personal data by setting cookies. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at the domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager. You can find more information about the provider and how Tag Manager works here: https://www.google.com/analytics/tag-manager/use-policy/.
Click here to be excluded from collection via Google Tag Manager: Enable/disable Google Tag Manager collection.
VII. Provision of a contact form and email contact
- Description and scope of the processing of personal data
We provide a contact form on our website for you to contact us electronically. If and to the extent that users send us an inquiry or message via the contact form, the data entered in the input mask will be transmitted to us and stored by us. This includes your last name, first name, email address, and your request.
When the message is sent, the following data is also stored:
- The user’s IP address
- Date and time of the message
Your consent is obtained for the processing of the data during the sending process and reference is made to this privacy policy.
In addition, it is possible to contact us via the email address provided in our contact details. In this case, the user’s personal data transmitted with the email and the request communicated will be stored by us.
In this context, the data will not be passed on to third parties. The transmitted data will be used exclusively for processing the contact and handling your request.
- Purpose of processing personal data
The processing of personal data from the input mask serves us solely for the purpose of processing the contact and handling your request. If you contact us by email, this also constitutes the necessary legitimate interest in the processing of the personal data transmitted.
The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
- Legal basis for the processing of personal data
The legal basis for the processing of personal data is Art. 6 (1) (a) GDPR if the user has given their consent. If your request is aimed at concluding a contract or is related to the fulfillment of a contract, the legal basis for the processing of personal data is Art. 6 (1) (b) GDPR. The processing of personal data transmitted in the course of sending an email and not aimed at concluding a contract or related to the performance of a contract is based on our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR. It is not apparent that the interests, fundamental rights, and freedoms of the data subject outweigh this interest.
- Duration of storage and data deletion
In principle, the transmitted data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. This is the case for personal data from the input mask of the contact form and data transmitted by email when the processing of the user’s request has been completed or the conversation with the user has ended. It can be assumed that the processing of the request has been completed or the conversation has ended if it can be inferred from the circumstances that the matter in question has been finally clarified for the user. This does not apply if the email contact is aimed at concluding a contract or if the personal data is required for the performance of a contract. In these cases, a longer retention period may apply for contractual or legal reasons.
The additional personal data collected during the sending process is usually deleted after a period of seven days at the latest.
- Right to object and right to erasure
Users have the option of revoking their consent to the processing of their personal data at any time. If the user contacts us by email, they can object to the storage and processing of their personal data at any time. If the processing is based on the user’s consent, the conversation cannot be continued. In this case, all personal data stored in the course of establishing contact will also be deleted.
VIII. Use of spam protection for contact form
- Description and scope of the processing of personal data
We use the “reCAPTCHA” service provided by Google Ireland Limited, based at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to protect our contact form. The service is designed to verify whether the data entered in the contact form is entered by a human or by an automated program. To do this, the service analyzes the user’s behavior based on various characteristics. Google uses cookies for this purpose at . Cookies are data records that the Internet browser stores on the user’s device. However, both the use of cookies and the analysis only take place once the user has given their consent to the use of the function. The following user data, among other things, is processed for this purpose:
- The user’s IP address,
- the answers given by the user to the tasks set.
This information is evaluated by reCAPTCHA by means of an analysis. The data collected during the analysis is forwarded to Google. For further information, please refer to the provider’s privacy policy and terms of use at the following links: https://policies.google.com/privacy?hl=de and https://policies.google.com/terms?hl=de.
- Purpose of processing personal data
The analysis serves to determine whether the respective data entry in the contact form is made by a human or by an automated program. We use the service to protect our content and services from abusive automated spying. In addition, we have an interest in ensuring that our contact form is used exclusively for sending inquiries by humans and not for sending spam messages.
- Legal basis for the processing of personal data
The legal basis for the processing of personal data is Art. 6 (1) (a) GDPR if the user has given their consent.
- Duration of data storage and data deletion
According to Google, the cookies used by Google for reCAPTCHA usually expire after 30 days. However, there are also cookies that have an expiration date of 6 months to 2 years or longer. For details, please refer to our Cookie Consent Manager. Please note that we have no influence on the duration of storage at Google.
- Right to object and right to erasure
As a user, you have the following options for objection and removal:
- You can revoke your consent to the use of the service at any time with future effect by notifying us or by changing your data protection or privacy settings in our Cookie Consent Manager.
- You can prevent the storage of cookies by adjusting your browser settings accordingly.
- You can also prevent Google from collecting the data generated by cookies and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout.
- Transfer of personal data outside the EU/EEA
The processing of personal data by Google in the USA is not completely excluded. In cases where personal data is transferred to the USA, Google invokes the conclusion of standard contractual clauses. In addition, Google LLC is certified under the EU-US Data Privacy Framework by the US Department of Commerce, so that the adequacy decision of the EU Commission also applies to data transfers directly to the USA.
IX. Subscription and dispatch of newsletters
- Description and scope of the processing of personal data
As part of the services offered on our website, users have the option of subscribing to a free newsletter. When you register to receive the newsletter, the data from the input mask is transmitted to us. This is data that allows us to verify that you agree to receive the newsletter, such as your last name, first name, and email address.
The following data is also collected during registration:
- IP address of the accessing device
- Date and time of registration
No further data is collected, or only on a voluntary basis. We use this data exclusively for sending the newsletter. When you register to receive the newsletter, your consent is obtained for the processing of your data and reference is made to this privacy policy.
After registering on our website, you will receive an email with a confirmation link that you can use to confirm your registration for our newsletter (double opt-in procedure). This confirmation serves as proof that you, as the owner of the email address provided, agree to receive the newsletter.
To send the newsletter, we use the “SendFox” service provided by the newsletter service provider Sumo Group Inc., located at 1305 E. 6th St #3, Austin, TX 78702, USA, with whom we have concluded a data processing agreement. Further information on the provider’s data protection can be found here: https://sendfox.com/privacy
Based on your consent, we evaluate user behavior within the newsletter we send out through the provider. Each newsletter sent to you contains so-called tracking pixels, which enable us to evaluate confirmation of receipt and reading as well as information about the links you have clicked on in our newsletter with regard to opening and click rates. This information is summarized in corresponding user profiles.
- Purpose of processing personal data
Both the collection of the email address and the collection of further information from the user serve to ensure that the user is the owner of the email address provided and therefore agrees to receive the newsletter. In addition, we need the user’s email address in order to deliver the newsletter.
The processing of other personal data collected during the registration process serves to prevent misuse of our services and the email address entered.
The information collected by evaluating opening and click rates is used to improve the technical aspects and content of our newsletter. By creating individual user profiles, we can tailor our advertising to the interests of users and optimize our offers on our website.
- Legal basis for the processing of personal data
The legal basis for the processing of data when registering for the newsletter subscription, for the evaluation of opening and click rates, and for the creation of user profiles is the consent of the user in accordance with Art. 6 (1) (a) GDPR.
The use of the newsletter service provider and the transfer of personal data for the purpose of sending the newsletter are based on our legitimate interests in effective and user-friendly newsletter marketing in accordance with Art. 6 (1) (f) GDPR. It is not apparent that the interests, fundamental rights, and freedoms of the data subject outweigh this interest.
- Duration of storage and data deletion
In principle, the data is deleted as soon as it is no longer necessary for the purpose for which it was collected. The user’s email address is therefore stored for as long as the newsletter subscription exists and the user’s consent to the use of their data has not been revoked. This also applies to the storage of the evaluation of the opening and click rates and the user profiles created on this basis.
Other personal data collected during the registration process is usually deleted after a period of seven days.
- Right to object and right to erasure
The user can cancel their subscription to the newsletter at any time and revoke their consent to the use of their data. Each newsletter contains a link that allows users to unsubscribe from the newsletter.
In this case, it is also possible to revoke consent to the storage of personal data collected during the registration process. The legality of the data processing carried out until the revocation of consent remains unaffected by the revocation.
It is not possible to revoke consent for newsletter tracking separately. In this case, the entire subscription must be terminated.
- Transfer of personal data outside the EU/EEA
If you give your consent to receive the newsletter, you also consent, in accordance with Art. 49 (1) (a) GDPR, to your data being processed in a third country outside the EU/EEA. Your data may be processed in the USA. If you do not want this, you can refuse to give your consent. In addition, you can revoke your consent at any time with effect for the future. The legality of the data processing carried out until the revocation of your consent remains unaffected by this.
X. Data processing during registration and/or login to the portal
- Description and scope of the processing of personal data
We offer our contractual partners on our website the opportunity to register on the “https://app.planubo.com” portal. The personal data required for registration is entered into a corresponding input mask, transmitted to us, and stored. The following data is collected during the registration process:
- Last name, first name
- Address (optional)
The following data is also stored at the time of registration:
- IP address
- Date and time of registration
- Purpose of processing personal data
The registration of the contractual partner is necessary for the performance of a contract with them and for the implementation of pre-contractual measures.
- Legal basis for the processing of personal data
Since the registration serves to fulfill a contract to which the user is a party and is also necessary for the implementation of pre-contractual measures, the legal basis for the processing of the data is Art. 6 (1) (b) GDPR.
- Duration of storage and data deletion
In principle, the data is deleted as soon as it is no longer necessary for the purpose for which it was collected. This is the case for data collected during the registration process when the data is no longer necessary for the fulfillment and execution of the contract or pre-contractual measures. Even after the conclusion or termination of the contract, it may be necessary to store personal data of the contractual partner in order to comply with contractual or legal obligations and for corresponding verification purposes.
- Right to object and right to erasure
Contractual partners have the option of canceling their registration and/or deleting their user account. The stored data can be changed at any time independently in the user account or by notifying us. In this case, it will no longer be possible to use our services.
Insofar as the data collected is necessary for the fulfillment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible if there are no contractual or legal obligations or reasons for deletion that prevent this.
XI. Online presence on social networks and use of social media buttons
- Description and scope of the processing of personal data
We maintain online presences within social networks of social media providers. In this context, our website uses simple links on the one hand and social media buttons on the other, which do not establish a direct connection to the respective network when the page is loaded. This means that the “Like” and “Share” buttons used here differ from the widely used social media plugins, which already transmit data to social networks when the page is loaded without the button having to be clicked. The version of the Shariff button we use only establishes direct contact between the social network and the user when the latter actively clicks on the respective social media button. The integrated Shariff button thus prevents users from leaving a digital trail on every page they visit and thereby transmitting personal data directly to the respective social network of the social media provider. When visiting the respective social network, the data protection information and terms of use of the respective social media provider apply. For further information, please refer to our social media privacy policy.
- Purpose of processing personal data
We maintain online presences within social networks of social media providers in order to communicate with customers, interested parties, and users who are active there and to inform them about our services. The integrated “Like” and “Share” buttons are used to enable faster and easier user response and thus faster and more effective communication with us.
- Legal basis for the processing of personal data
The legal basis for processing is therefore Art. 6 (1) (a) GDPR if the user has given their consent. Furthermore, we have a legitimate interest in maintaining an online presence on social media in accordance with Art. 6 (1) (f) GDPR. It is not apparent that the interests, fundamental rights, and freedoms of the data subject outweigh this interest.
- Transfer of personal data
We use social media buttons for the social networks listed below. A connection to the social media provider is only established when the user actively clicks on the social media button of the social network.
a) “Instagram“: Instagram’s social media buttons are usually associated with an Instagram logo. The social media provider is Meta Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The social network’s privacy policy can be found at: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect.
b) “Facebook“: Facebook’s social media buttons are usually associated with a Facebook logo. The social media provider is Meta Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The social network’s privacy policy can be found at: https://www.facebook.com/about/privacy/.
c) “X“: X social media buttons are usually associated with an X logo. The social media provider is X Internet Unlimited Company, based in Ireland. The social network’s privacy policy can be found at: https://x.com/de/privacy
d) “LinkedIn“: LinkedIn’s social media buttons are usually associated with a LinkedIn logo. The social media provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The social network’s privacy policy can be found at: https://www.linkedin.com/legal/privacy-policy.
5. Right to object and right to erasure
Users have the option to revoke their consent to the processing of their personal data at any time. Revoking consent does not affect the legality of the processing carried out on the basis of the consent until revocation. If the processing is based on the user’s consent, cannot continue to communicate with the user via the social media provider’s channels.
- Transfer of personal data outside the EU/EEA
The processing of personal data by providers in the USA is not completely excluded. In cases where personal data is transferred to the USA, the providers refer to the conclusion of standard contractual clauses on the one hand and to certification under the EU-US Data Privacy Framework at the US Department of Commerce on the other, so that the adequacy decision of the EU Commission also applies to data transfers directly to the USA. Specifically, this concerns the following data recipients and the respective transfer mechanisms applied:
- Facebook and Instagram: Meta Platforms Ltd. transfers personal data to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA, on the basis of https://www.facebook.com/legal/EU_data_transfer_addendum approved by the European Commission. In addition, Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
- LinkedIn: LinkedIn transfers data to LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085, USA, on the basis of standard contractual clauses approved by the European Commission (https://de.linkedin.com/legal/l/dpa). In addition, LinkedIn Corporation is certified under the EU-US Data Privacy Framework.
- X: X transfers data to X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, on the basis of standard contractual clauses approved by the European Commission (https://help.x.com/de/rules-and-policies/global-operations-and-data-transfer). X Corp. is also certified under the EU-US Data Privacy Framework.
XII. Integration of YouTube videos
- Description and scope of the processing of personal data
We have embedded videos on individual pages of our website that are made available via the YouTube platform. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This allows us to present videos directly on our website. However, we use the extended data protection mode for this purpose. When you visit a page that has a YouTube video embedded in it, a grayed-out area appears at first. Only after you have given us your consent to display the YouTube video can the video be played. At a minimum, your IP address will be stored in the process.
For more information about Google’s data processing, please visit: https://policies.google.com/privacy?hl=de&gl=en. This privacy policy applies to all services offered by Google Ireland Limited and its affiliates, including YouTube.
- Purpose of processing personal data
We use YouTube to optimize and present our offerings and services to you in an appealing way. We want to offer you the best possible user experience on our website, which includes our embedded videos, which may contain content that is helpful and interesting to you.
- Legal basis for the processing of personal data
The legal basis for the processing of data is Art. 6 (1) (a) GDPR if the user has given their consent.
- Duration of storage and data deletion
In principle, the data is deleted as soon as it is no longer necessary for the purpose for which it was collected. For details, please refer to our Cookie Consent Manager. We would like to point out that we have no influence on the duration of storage on YouTube.
- Right to object and right to erasure
Users have the option of revoking their consent to the processing of personal data at any time. Revoking consent does not affect the legality of the processing carried out on the basis of the consent until revocation.
- Transfer of personal data outside the EU/EEA
The processing of personal data by YouTube in the USA is not completely excluded. In cases where personal data is transferred to Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, YouTube invokes the conclusion of standard contractual clauses. Google LLC is also certified under the EU-US Data Privacy Framework.
XIII. Use of fonts through direct integration of third-party providers
- Description and scope of the processing of personal data
Within the framework of our website, we use so-called web fonts provided by the following providers for the uniform display of fonts:
- Google Ireland Limited, based at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”)
- Fonticons, Inc., located at 307 S. Main St. Suite 202, Bentonville, AR 72712 (“FontAwesome”)
The required fonts are loaded via a direct connection to the respective provider’s server and then into the user’s browser cache in order to display texts and fonts correctly on . If the browser used does not support web fonts, a standard font from the user’s device is used.
No cookies are set on the user’s device when visiting our website. The connection to the providers’ servers is only established once the user has consented to the transfer of their data.
Further information on Google web fonts can be found here: https://fonts.google.com. For information on data protection, please refer to the following information from the provider: https://developers.google.com/fonts/faq/privacy?hl=de.
Further information on FontAwesome web fonts can be found here: https://fontawesome.com/tos. For information on data protection, please refer to the following information provided by the provider: https://fontawesome.com/privacy.
- Purpose of processing personal data
Web fonts are a freely available library with a variety of fonts for use on websites. By using web fonts, our website can be presented to the user in an appealing and recognizable design and in a uniform manner and quality across all devices. This enables us to technically ensure that all users of our website have a consistent and pleasant user experience.
- Legal basis for the processing of personal data
The legal basis for the processing of data is Art. 6 (1) (a) GDPR if the user has given their consent.
- Duration of storage and data deletion
In principle, the data is deleted as soon as it is no longer necessary for the purpose for which it was collected. For details, please refer to our Cookie Consent Manager. We would like to point out that we have no influence on the duration of storage by third-party providers.
- Right to object and right to erasure
Users have the option of revoking their consent to the processing of personal data at any time. Revoking consent does not affect the legality of the processing carried out on the basis of the consent until revocation.
- Transfer of personal data outside the EU/EEA
The processing of personal data by Google and FontAwesome in the USA is not completely excluded. For the exceptional cases in which personal data is transferred to the USA, Google agrees to standard contractual clauses as part of the contractual arrangements. In addition, Google LLC and Fonticons, Inc. are certified under the EU-US Data Privacy Framework by the US Department of Commerce, so that the adequacy decision of the EU Commission also applies to data transfers directly to the USA.
XIV. Use of the Google Ads online advertising program (including Google Conversion Tracking)
- Description and scope of the processing of personal data
We use “Google Ads,” an online advertising program from Google Ireland Ltd. based in Gordon House, Barrow Street, Dublin 4, Ireland (“Google Ads”), on our website. This solution allows us to advertise our products and services in a targeted manner by presenting our ads to users when they are searching online for the services we offer. We can use various advertising campaigns via Google Ads for this purpose.
As part of our advertising activities through Google Ads, we use conversion tracking on our website. When you click on an ad placed by Google, a conversion tracking cookie is set on your device. Cookies are data records that the Internet browser stores on the user’s device. As soon as the visitor calls up a specific (sub)page of our website and performs a specific action, Google recognizes the cookie that has been set and stores the action as a so-called conversion. As long as the cookie is still valid, it can be used to determine whether the user clicked on an ad placed by Google and was thereby redirected to the respective (sub)page of our website.
If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged into your Google account, it is possible that Google will process your IP address.
We ourselves do not collect or process any personal data in the context of these advertising measures. We only receive statistical evaluations from Google. This allows us, for example, to determine the total number of users who have clicked on our ads and thus learn which of the advertising measures used are particularly effective. We do not receive any further data; in particular, we cannot identify users on the basis of these statistical evaluations.
We have concluded a data processing agreement with the provider for this purpose. Further information on Google Ads and Google Conversion Tracking can be found in Google’s privacy policy at: https://www.google.de/policies/privacy/. Information on data processing services for advertising can be found at: https://privacy.google.com/businesses/adsservices.
- Purpose of processing personal data
We use Google Ads to draw attention to our advertising offers on other websites. Our goal is to target our advertising measures at those users who are actually interested in our advertising offers. Google Ads also provides us with statistics on the total number of users who clicked on our ad and were redirected to a (sub)page of our website that has been tagged with a conversion tracking tag. Tracking allows us to measure the success of individual advertising measures and tailor our advertising offers to the interests and needs of our users.
- Legal basis for the processing of personal data
The legal basis for data processing is Art. 6 (1) (a) GDPR if the user has given their consent.
- Duration of storage and data deletion
According to Google, the cookies used by Google for advertising measures within the framework of Google Ads generally expire after 30 days. However, there are also cookies that are used in connection with Google Analytics that have an expiration date of 3 months. For details, please refer to our Cookie Consent Manager. We would like to point out that we have no influence on the duration of storage at Google.
- Right to object and removal option
Users can choose not to participate in Google Ads conversion tracking. There are various ways in which you can prevent participation:
- You can revoke your consent to the use of advertising cookies at any time with future effect by changing your data protection or privacy settings in our Cookie Consent Manager.
- You can deactivate the conversion tracking cookie yourself via the browser of your device:google.de/settings/ads . In this case, you will not be included in the statistical collection of the tracking tool.
- You can change the cookie settings in your device’s browser at any time, in particular by generally suppressing third-party cookies that contain third-party advertisements.
- You can check interest-based ads from providers who are part of the “About Ads” self-regulation campaign via the following link and deactivate them if necessary: https://youradchoices.com.
- You can use the plugin provided for your browser, which allows you to permanently deactivate cookies. However, we would like to point out that in this case you may not be able to use all the functions of our website to their full extent.
- Transfer of personal data outside the EU/EEA
The processing of personal data by Google in the USA is not completely excluded. For the exceptional cases in which personal data is transferred to the USA, Google agrees to standard contractual clauses as part of the contractual arrangements. In addition, Google LLC is certified under the EU-US Data Privacy Framework by the US Department of Commerce, so that the adequacy decision of the EU Commission also applies to data transfers directly to the USA.
XV. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR. Within the framework of the legal provisions, you have the following rights vis-à-vis the controller:
- Right to information under Art. 15 GDPR
Within the framework of the statutory provisions, you have the right to obtain information about your personal data stored by us at any time and free of charge. In this respect, you can also request confirmation as to whether your personal data is being processed by us.
- Right to rectification pursuant to Art. 16 GDPR
Within the framework of the statutory provisions, you have the right to have your personal data corrected and/or completed if the personal data processed by us is incorrect or incomplete.
- Right to erasure pursuant to Art. 17 GDPR
Within the framework of the statutory provisions, you can request that we delete your personal data immediately if
- the purposes for which your personal data was collected or processed no longer exist;
- you withdraw your consent on which the processing was based in accordance with Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing;
- you object to the processing pursuant to Art. 21 GDPR;
- your personal data has been processed unlawfully;
- the erasure of your personal data is necessary to comply with a legal obligation under Union or Member State law to which we, as the controller, are subject;
- your personal data has been collected in relation to information society services offered pursuant to Art. 8(1) GDPR.
The right to erasure does not apply if processing is still necessary for one of the following reasons:
- to comply with a legal obligation which requires processing under Union or Member State law to which we, as the controller, are subject; or
- for the establishment, exercise, or defense of legal claims.
- Right to restriction of processing pursuant to Art. 18 GDPR
You have the right to request the restriction of the processing of your personal data in the following cases:
- if you dispute the accuracy of your personal data stored by us, you may request the restriction of the processing of your personal data for the duration of the review;
- if the processing is unlawful, you may request the restriction of processing instead of the erasure of your personal data;
- if we no longer need the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims, or
- if you have lodged an objection to the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whose legitimate interests prevail.
If the processing of your personal data has been restricted, this data may, with the exception of its storage, only be processed with your consent or for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.
- Right to be informed pursuant to Art. 19 GDPR
If you have asserted your right to rectification, erasure, or restriction of processing against us, we are obliged to notify all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction of processing. This does not apply if this proves impossible or involves disproportionate effort. Within the framework of the statutory provisions, you may request to be informed about these recipients.
- Right to data portability pursuant to Art. 20 GDPR
Within the framework of the statutory provisions, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format and to request the direct transfer of this data to another controller, provided that
- the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR, and
- the processing is carried out using automated means.
The direct transfer of your personal data from one controller to another controller can only take place if this is technically feasible.
- Right to object pursuant to Art. 21 GDPR
If the processing of your personal data is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
Insofar as we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. If you object to processing for direct marketing purposes, your personal data will no longer be used for these purposes.
- Right to revoke the data protection consent declaration
If you give us your prior consent for a data processing operation, you have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.
- Automated decision-making in individual cases, including profiling, pursuant to Art. 22 GDPR
We do not use exclusively automated processing—including profiling—to make decisions that could have legal effects on you or similarly significantly affect you.
- Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.
Status of the privacy policy: June 4, 2025