Privacy Policy

/ JR Atelier Esthétique

Datenschutzerklärung

Introduction and Overview

We have drafted this privacy policy (version 03.11.2025-113075714) to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws. The terms used are gender-neutral.

In short: We provide you with comprehensive information about the data we process about you.

Privacy policies usually sound very technical and use legal terminology. This privacy policy, on the other hand, is intended to describe the most important things as simply and transparently as possible. Insofar as it promotes transparency, technical terms are explained in a reader-friendly manner, links to further information are provided, and graphics are used. We therefore use clear and simple language to inform you that we only process personal data in the course of our business activities if there is a corresponding legal basis for doing so. This is certainly not possible if you provide explanations that are as concise, unclear, and legally technical as possible, as is often the standard on the Internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps you will find some information that you did not know before.

If you still have questions, please contact the responsible body listed below or in the imprint, follow the links provided, and view further information on third-party websites. You will also find our contact details in the legal notice.

Scope of application

This privacy policy applies to all personal data processed by us within the company and to all personal data processed by companies commissioned by us (processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person’s name, email address, and postal address. The processing of personal data ensures that we can offer and bill for our services and products, whether online or offline. The scope of this privacy policy covers:

all online presences (websites, online shops) that we operate
Social media sites and email communication
Mobile apps for smartphones and other devices

In short: The privacy policy applies to all areas in which personal data is processed in a structured manner within the company via the channels mentioned. If we enter into legal relationships with you outside of these channels, we will inform you separately if necessary.

Legal basis

In the following privacy policy, we provide you with transparent information about the legal principles and regulations, i.e., the legal basis of the General Data Protection Regulation, which enable us to process personal data.

With regard to EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. You can, of course, read this EU General Data Protection Regulation online at EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.

We only process your data if at least one of the following conditions applies:

Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of your data entered in a contact form.
Contract (Article 6(1)(b) GDPR): We process your data in order to fulfill a contract or pre-contractual obligations with you. For example, if we conclude a purchase contract with you, we need personal information in advance.
Legal obligation (Article 6(1)(c) GDPR): We process your data if we are subject to a legal obligation. For example, we are legally obliged to retain invoices for accounting purposes. These usually contain personal data.
Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website securely and economically. This processing is therefore a legitimate interest.

Other conditions, such as the performance of tasks carried out in the public interest and the exercise of official authority, as well as the protection of vital interests, do not generally apply to us. If such a legal basis should nevertheless be relevant, it will be indicated at the appropriate place.

In addition to the EU regulation, national laws also apply:

In Austria, this is the Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data (Data Protection Act), or DSG for short.
In Germany, the Federal Data Protection Act, or BDSG for short, applies.

If other regional or national laws apply, we will inform you about them in the following sections.

Contact details of the controller

If you have any questions about data protection or the processing of personal data, you will find the contact details of the controller in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR) below:

Jelena Rajanok

Heiligenstädter Straße 38 / 2nd floor / Top 5

1190 Vienna

Email: office@jr-atelier-esthetique.at

Legal notice: https://www.jr-atelier-esthetique.at/impressum

Storage period

It is our general policy to store personal data only for as long as is absolutely necessary for the provision of our services and products. This means that we delete personal data as soon as the reason for data processing no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose has ceased to exist, for example for accounting purposes.

If you wish to have your data deleted or revoke your consent to data processing, the data will be deleted as soon as possible and insofar as there is no obligation to store it.

We will inform you about the specific duration of the respective data processing below, provided we have further information on this.

Rights under the General Data Protection Regulation

In accordance with Articles 13 and 14 of the GDPR, we inform you of the following rights to which you are entitled in order to ensure fair and transparent data processing:

According to Article 15 of the GDPR, you have the right to obtain information about whether we process your data. If this is the case, you have the right to receive a copy of the data and to obtain the following information:
- the purpose for which we are processing the data;
- the categories, i.e., the types of data being processed;
- who receives this data and, if the data is transferred to third countries, how security can be guaranteed;
- how long the data will be stored;
- the existence of the right to rectification, erasure, or restriction of processing and the right to object to processing;
- that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
- the origin of the data if we did not collect it from you;
- whether profiling is carried out, i.e., whether data is automatically evaluated to create a personal profile of you.
According to Article 16 of the GDPR, you have the right to have the data corrected, which means that we must correct the data if you find any errors.
According to Article 17 of the GDPR, you have the right to erasure (“right to be forgotten”), which specifically means that you may request the erasure of your data.
According to Article 18 GDPR, you have the right to restrict processing, which means that we may only store the data but not use it further.
According to Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data in a common format upon request.
According to Article 21 GDPR, you have a right to object, which, once enforced, will result in a change in the processing.
- If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you may object to the processing. We will then check as soon as possible whether we can legally comply with this objection.
- If data is used for direct marketing, you can object to this type of data processing at any time. We will then no longer be allowed to use your data for direct marketing.
- If data is used for profiling, you can object to this type of data processing at any time. We will then no longer be allowed to use your data for profiling.
According to Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (e.g., profiling).
According to Article 77 GDPR, you have the right to lodge a complaint. This means that you can complain to the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short: You have rights – don’t hesitate to contact the responsible party listed above!

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can lodge a complaint with the supervisory authority. In Austria, this is the data protection authority, whose website can be found at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

Austria Data Protection Authority

Head: Dr. Matthias Schmidl

Address: Barichgasse 40-42, 1030 Vienna

Phone number: +43 1 52 152-0

Email address:

dsb@dsb.gv.at

Website:

https://www.dsb.gv.at/

Data transfer to third countries

We only transfer or process data to countries outside the scope of the GDPR (third countries) if you consent to this processing or if there is other legal permission to do so. This applies in particular if the processing is required by law or necessary for the fulfillment of a contractual relationship and, in any case, only to the extent that this is generally permitted. In most cases, your consent is the most important reason for us to have data processed in third countries. The processing of personal data in third countries such as the USA, where many software manufacturers offer services and have their server locations, may mean that personal data is processed and stored in unexpected ways.

We expressly point out that, in the opinion of the European Court of Justice, an adequate level of protection for data transfers to the US currently only exists if a US company that processes personal data of EU citizens in the US is an active participant in the EU-US Data Privacy Framework. For more information, please visit: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Data processing by US services that are not active participants in the EU-US Data Privacy Framework may result in data not being processed and stored anonymously. Furthermore, US government authorities may have access to individual data. In addition, collected data may be linked to data from other services of the same provider, provided you have a corresponding user account. Where possible, we try to use server locations within the EU, if this is offered.

We will provide you with more detailed information about data transfers to third countries, where applicable, in the relevant sections of this privacy policy.

Security of data processing

We have implemented both technical and organizational measures to protect personal data. Where possible, we encrypt or pseudonymize personal data. In this way, we make it as difficult as possible for third parties to derive personal information from our data.

Article 25 of the GDPR refers to “data protection by design and by default,” meaning that security must always be considered and appropriate measures taken in both software (e.g., forms) and hardware (e.g., access to the server room). In the following, we will discuss specific measures where necessary.

TLS encryption with https

TLS, encryption, and https sound very technical, and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data over the Internet in a way that is secure against eavesdropping.

This means that the entire transmission of all data from your browser to our web server is secure—no one can “listen in.”

This means that we have introduced an additional layer of security and comply with data protection through technology design (Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission on the Internet, we can ensure the protection of confidential data.

You can recognize the use of this data transmission security by the small lock symbol in the upper left corner of the browser, to the left of the Internet address (e.g., examplepage.com) and the use of the https scheme (instead of http) as part of our Internet address.

If you would like to know more about encryption, we recommend searching Google for “Hypertext Transfer Protocol Secure wiki” to find useful links to further information.

Communication

Communication Summary? Affected persons: Anyone who communicates with us by phone, email, or online form

? Processed data: e.g., phone number, name, email address, form data entered. You can find more details on this under the respective contact type used

? Purpose: Handling communication with customers, business partners, etc.

? Storage period: Duration of the business transaction and legal requirements

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (b) GDPR (contract), Art. 6 (1) (f) GDPR (legitimate interests)

When you contact us and communicate with us by phone, email, or online form, personal data may be processed.

The data is processed for the purpose of handling and processing your inquiry and the associated business transaction. The data is stored for as long as necessary or as required by law.

Affected persons

The above-mentioned processes affect all persons who contact us via the communication channels provided by us.

Telephone

When you call us, the call data is stored in pseudonymized form on the respective end device and by the telecommunications provider used. In addition, data such as your name and telephone number may be sent by email and stored for the purpose of responding to your inquiry. The data will be deleted as soon as the business transaction has been completed and legal requirements allow.

Email

If you communicate with us by email, data may be stored on the respective end device (computer, laptop, smartphone, etc.) and data may be stored on the email server. The data will be deleted as soon as the business transaction has been completed and legal requirements allow.

Online forms

When you communicate with us using an online form, data is stored on our web server and, if necessary, forwarded to an email address belonging to us. The data will be deleted as soon as the business transaction has been completed and legal requirements allow.

Legal basis

The processing of data is based on the following legal basis:

Art. 6 (1) (a) GDPR (consent): You give us your consent to store your data and use it for purposes related to the business transaction;
Art. 6 (1) (b) GDPR (contract): It is necessary for the performance of a contract with you or a processor, such as a telephone provider, or we must process the data for pre-contractual activities, such as preparing an offer;
Art. 6 (1) (f) GDPR (legitimate interests): We want to handle customer inquiries and business communications in a professional manner. This requires certain technical equipment, such as email programs, Exchange servers, and mobile phone operators, in order to communicate efficiently.

Data processing agreement (DPA)

In this section, we would like to explain what a data processing agreement is and why it is necessary. Because the term “data processing agreement” is quite a tongue twister, we will often use the acronym DPA in this text. Like most companies, we do not work alone, but also use the services of other companies or individuals. By involving various companies or service providers, we may pass on personal data for processing. These partners then act as processors with whom we conclude a contract, known as a data processing agreement (DPA). The most important thing for you to know is that the processing of your personal data is carried out exclusively in accordance with our instructions and must be regulated by the DPA.

Who are processors?

As a company and website owner, we are responsible for all data that we process from you. In addition to the controllers, there may also be so-called processors. This includes any company or person who processes personal data on our behalf. More precisely, and according to the GDPR definition: any natural or legal person, public authority, agency, or other body that processes personal data on our behalf is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

For a better understanding of the terminology, here is an overview of the three roles in the GDPR:

Data subject (you as a customer or prospective customer) → Controller (we as a company and client) → Processor (service providers such as web hosts or cloud providers)

Contents of a data processing agreement

As mentioned above, we have concluded a DPA with our partners who act as processors. First and foremost, this agreement stipulates that the processor shall process the data to be processed exclusively in accordance with the GDPR. The agreement must be concluded in writing, but in this context, the electronic conclusion of the agreement is also considered “in writing.” Personal data may only be processed on the basis of the contract. The contract must contain the following:

Commitment to us as the controller
Obligations and rights of the controller
Categories of data subjects
Type of personal data
Type and purpose of data processing
Subject matter and duration of data processing
Place of data processing

Furthermore, the contract contains all the obligations of the processor. The most important obligations are:

Measures to ensure data security
Taking possible technical and organizational measures to protect the rights of the data subject
Maintaining a data processing directory
Cooperating with the data protection supervisory authority upon request
Performing a risk analysis with regard to the personal data received
Sub-processors may only be commissioned with the written consent of the controller

You can see what such a DPA looks like in concrete terms at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html, for example. A sample contract is presented here.

Cookies

Cookies Summary

? Data subjects: Visitors to the website

? Purpose: Depends on the respective cookie. More details can be found below or from the manufacturer of the software that sets the cookie.

? Storage period: depends on the respective cookie, can vary from hours to years

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What are cookies?

Our website uses HTTP cookies to store user-specific data.

Below, we explain what cookies are and why they are used so that you can better understand the following privacy policy.

Whenever you surf the Internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer, and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing cannot be denied: cookies are really useful little helpers. Almost all websites use cookies. More specifically, they are HTTP cookies, as there are also other cookies for other areas of application. HTTP cookies are small files that are stored on your computer by our website. These cookie files are automatically stored in the cookie folder, which is essentially the “brain” of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.

Cookies store certain user data about you, such as language or personal page settings. When you visit our site again, your browser transmits the “user-related” information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to. In some browsers, each cookie has its own file, while in others, such as Firefox, all cookies are stored in a single file.

The following graphic shows a possible interaction between a web browser such as Chrome and the web server. The web browser requests a website and receives a cookie from the server, which the browser reuses when another page is requested.

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiration time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, Trojans, or other “malware.” . Cookies cannot access information on your PC.

Cookie data may look like this, for example:

Name: _ga

Value: GA1.2.1326744211.152113075714-9

Purpose: To distinguish between website visitors

Expiration date: After 2 years

A browser should be able to support these minimum sizes:

At least 4096 bytes per cookie
At least 50 cookies per domain
At least 3000 cookies in total

What types of cookies are there?

The question of which cookies we use in particular depends on the services used and is clarified in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.

There are 4 types of cookies:

Essential cookies

These cookies are necessary to ensure the basic functionality of the website. For example, these cookies are needed when a user adds a product to their shopping cart, then continues to browse other pages and only proceeds to checkout later. These cookies ensure that the shopping cart is not deleted, even if the user closes their browser window.

Functional cookies

These cookies collect information about user behavior and whether the user receives any error messages. These cookies are also used to measure the loading time and behavior of the website in different browsers.

Targeted cookies

These cookies ensure better user-friendliness. For example, entered locations, font sizes, or form data are stored.

Advertising cookies

These cookies are also called targeting cookies. They are used to deliver personalized advertising to the user. This can be very practical, but also very annoying.

Usually, when you visit a website for the first time, you are asked which of these cookie types you want to allow. And, of course, this decision is also stored in a cookie.

If you would like to know more about cookies and are not afraid of technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments from the Internet Engineering Task Force (IETF) called “HTTP State Management Mechanism.”

Purpose of processing via cookies

The purpose ultimately depends on the respective cookie. You can find more details below or from the manufacturer of the software that sets the cookie.

What data is processed?

Cookies are little helpers for many different tasks. Unfortunately, it is not possible to generalize what data is stored in cookies, but we will inform you about the processed or stored data in the following privacy policy.

Storage period of cookies

The storage period depends on the respective cookie and is specified in more detail below. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.

You also have control over the storage period. You can manually delete all cookies at any time via your browser (see also “Right to object” below). Furthermore, cookies that are based on consent will be deleted at the latest after you revoke your consent, whereby the legality of the storage remains unaffected until then.

Right to object – how can I delete cookies?

You decide for yourself how and whether you want to use cookies. Regardless of which service or website the cookies come from, you always have the option to delete, deactivate, or only partially allow cookies. For example, you can block third-party cookies but allow all other cookies.

If you want to find out which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings:

Chrome: Delete, enable, and manage cookies in Chrome

Safari: Manage cookies and website data with Safari

Firefox: Delete cookies to remove data that websites have stored on your computer

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete and manage cookies

If you do not want cookies at all, you can set your browser to always inform you when a cookie is about to be set. This allows you to decide whether or not to allow each individual cookie. The procedure varies depending on the browser. The best way to find the instructions is to search Google using the search term “delete cookies Chrome” or “disable cookies Chrome” in the case of a Chrome browser.

Legal basis

The so-called “cookie guidelines” have been in place since 2009 . These stipulate that the storage of cookies requires your consent (Article 6 (1) (a) GDPR). However, there are still very different responses to these guidelines within the EU countries. In Austria, however, this directive was implemented in Section 165 (3) of the Telecommunications Act (2021). In Germany, the cookie guidelines have not been implemented as national law. Instead, this directive has largely been implemented in Section 15 (3) of the Telemedia Act (TMG), which was replaced by the Digital Services Act (DDG) in May 2024.

For cookies that are absolutely necessary, even if no consent has been given, there are legitimate interests (Article 6(1)(f) GDPR), which in most cases are of an economic nature. We want to provide visitors to the website with a pleasant user experience, and certain cookies are often absolutely necessary for this.

If cookies that are not absolutely necessary are used, this only happens with your consent. The legal basis for this is Article 6(1)(a) GDPR.

The following sections provide more detailed information about the use of cookies, if the software used employs cookies.

Web hosting Introduction

Web hosting Summary? Data subjects: Visitors to the website

? Purpose: Professional hosting of the website and securing its operation

? Processed data: IP address, time of website visit, browser used, and other data. More details can be found below or from the respective web hosting provider.

? Storage period: Depends on the respective provider, but usually 2 weeks

⚖️ Legal basis: Art. 6 (1) (f) GDPR (legitimate interests)

What is web hosting?

When you visit websites today, certain information—including personal data—is automatically generated and stored, as is the case on this website. This data should be processed as sparingly as possible and only when justified. By website, we mean all web pages on a domain, i.e., everything from the home page to the very last subpage (like this one). By domain, we mean, for example, example.com or sampleexample.com.

If you want to view a website on a computer, tablet, or smartphone, you use a program called a web browser. You probably know some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. We refer to these as browsers or web browsers for short.

To display the website, the browser must connect to another computer where the website’s code is stored: the web server. Operating a web server is a complicated and time-consuming task, which is why it is usually handled by professional providers. They offer web hosting and thus ensure reliable and error-free storage of website data. That’s a lot of technical terms, but please stay with us, it gets even better!

When the browser on your computer (desktop, laptop, tablet, or smartphone) establishes a connection and during the transfer of data to and from the web server, personal data may be processed. On the one hand, your computer stores data, and on the other hand, the web server must also store data for a period of time to ensure proper operation.

A picture is worth a thousand words, so the following graphic illustrates the interaction between the browser, the Internet, and the hosting provider.

Why do we process personal data?

The purposes of data processing are:

Professional hosting of the website and securing its operation
Maintaining operational and IT security
Anonymous evaluation of access behavior to improve our offering and, if necessary, for criminal prosecution or the pursuit of claims

What data is processed?

Even while you are visiting our website right now, our web server, which is the computer on which this website is stored, usually automatically stores data such as

the complete Internet address (URL) of the website accessed
browser and browser version (e.g., Chrome 87)
the operating system used (e.g., Windows 10)
the address (URL) of the previously visited page (referrer URL) (e.g., https://www.beispielquellsite.de/vondabinichgekommen/)
the host name and IP address of the device from which access is made (e.g., COMPUTERNAME and 194.23.43.121)
Date and time
in files, known as web server log files

How long is data stored?

As a rule, the above data is stored for two weeks and then automatically deleted. We do not pass on this data, but we cannot rule out the possibility that this data may be viewed by authorities in the event of illegal behavior.

In short: Your visit is logged by our provider (the company that runs our website on special computers (servers)), but we do not pass on your data without your consent!

Legal basis

The legality of the processing of personal data in the context of web hosting is based on Art. 6 (1) lit. f GDPR (safeguarding legitimate interests), because the use of professional hosting by a provider is necessary in order to present the company on the Internet in a secure and user-friendly manner and to be able to pursue attacks and claims arising from this, if necessary.

As a rule, there is a contract between us and the hosting provider for order processing in accordance with Art. 28 f. GDPR, which ensures compliance with data protection and guarantees data security.

Web hosting provider External Privacy policy

Below you will find the contact details of our external hosting provider, where you can find out more about data processing in addition to the information above:

Mittwald CM Service GmbH & Co. KG

Königsberger Straße 4-6

32339 Espelkamp

Germany

You can find out more about data processing at this provider in the privacy policy.

Web analytics Introduction

Web analytics privacy policy Summary? Data subjects: Visitors to the website

? Purpose: Evaluation of visitor information to optimize the website.

? Processed data: Access statistics containing data such as access locations, device data, access duration and time, navigation behavior, click behavior, and IP addresses. You can find more details on this in the respective web analytics tool used.

? Storage period: Depends on the web analytics tool used

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is web analytics?

We use software on our website to evaluate the behavior of website visitors, known as web analytics or web analysis for short. This involves collecting data that is stored, managed, and processed by the respective analytics tool provider (also known as a tracking tool). The data is used to create analyses of user behavior on our website and made available to us as the website operator. In addition, most tools offer various testing options. This allows us to test which offers or content are most popular with our visitors. To do this, we show you two different offers for a limited period of time. After the test (known as an A/B test), we know which product or content our website visitors find more interesting. For such testing procedures, as well as for other analytics procedures, user profiles can also be created and the data stored in cookies.

Why do we use web analytics?

We have a clear goal in mind with our website: we want to provide the best web offering on the market for our industry. To achieve this goal, we want to offer the best and most interesting products and services on the one hand, and ensure that you feel completely at home on our website on the other. With the help of web analytics tools, we can take a closer look at the behavior of our website visitors and then improve our website for you and us accordingly. For example, we can see the average age of our visitors, where they come from, when our website is most visited, or which content or products are particularly popular. All this information helps us to optimize the website and thus adapt it to your needs, interests, and wishes.

What data is processed?

The exact data that is stored depends, of course, on the analysis tools used. However, as a rule, the following information is stored: what content you view on our website, which buttons or links you click on, when you visit a page, which browser you use, which device (PC, tablet, smartphone, etc.) you use to visit the website, and which computer system you use. If you have agreed to the collection of location data, this may also be processed by the web analysis tool provider.

Your IP address is also stored. According to the General Data Protection Regulation (GDPR), IP addresses are personal data. However, your IP address is usually stored in pseudonymized form (i.e., in an unrecognizable and abbreviated form). For the purposes of testing, web analysis, and web optimization, no direct data such as your name, age, address, or email address is stored. All such data, if collected, is stored in pseudonymized form. This means that you cannot be identified as an individual.

The following example shows schematically how Google Analytics works as an example of client-based web tracking with JavaScript code.

How long the respective data is stored always depends on the provider. Some cookies only store data for a few minutes or until you leave the website, while other cookies can store data for several years.

Duration of data processing

We will inform you about the duration of data processing below, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary for the provision of our services and products. If it is required by law, for example in the case of accounting, this storage period may also be exceeded.

Right to object

Legal basis

The use of web analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by web analytics tools.

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors in order to improve our offering both technically and economically. With the help of web analytics, we can detect website errors, identify attacks, and improve economic efficiency. The legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use the tools if you have given your consent.

Since web analytics tools use cookies, we also recommend that you read our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Information on specific web analytics tools, if available, can be found in the following sections.

Google Analytics Privacy Policy

Google Analytics Privacy Policy Summary? Data subjects: Visitors to the website

? Purpose: Evaluation of visitor information to optimize the website.

? Processed data: Access statistics containing data such as access locations, device data, access duration and time, navigation behavior, and click behavior. More details can be found further down in this privacy policy.

? Storage period: individually adjustable; by default, Google Analytics stores data for 14 months

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is Google Analytics?

We use the Google Analytics 4 (GA4) analysis tracking tool from the American company Google Inc. on our website. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your actions on our website. By combining various technologies such as cookies, device IDs, and login information, you as a user can be identified across different devices. This allows your actions to be analyzed across platforms.

For example, when you click on a link, this event is stored in a cookie and sent to Google Analytics. The reports we receive from Google Analytics help us to better tailor our website and services to your needs. Below, we provide more detailed information about the tracking tool, including what data is processed and how you can prevent this.

Google Analytics is a tracking tool used to analyze traffic on our website. These measurements and analyses are based on a pseudonymous user identification number. This number does not contain any personal data such as name or address, but is used to assign events to a device. GA4 uses an event-based model that collects detailed information about user interactions such as page views, clicks, scrolling, and conversion events. In addition, various machine learning functions have been built into GA4 to better understand user behavior and certain trends. GA4 relies on modeling with the help of machine learning functions. This means that, based on the data collected, missing data can also be extrapolated in order to optimize the analysis and also to be able to make forecasts.

In order for Google Analytics to function, a tracking code is embedded in the code of our website. When you visit our website, this code records various events that you perform on our website. With GA4’s event-based data model, we as website operators can define and track specific events to obtain analyses of user interactions. This means that, in addition to general information such as clicks or page views, specific events that are important to our business can also be tracked. Such specific events can include, for example, submitting a contact form or purchasing a product.

As soon as you leave our website, this data is sent to the Google Analytics servers and stored there.

Google processes the data and we receive reports on your user behavior. These reports may include the following:

Audience reports: Audience reports help us get to know our users better and understand more precisely who is interested in our service.
Ad reports: Ad reports make it easier for us to analyze and improve our online advertising.
Acquisition reports: Acquisition reports give us helpful information about how we can get more people excited about our service.
Behavior reports: Here we learn how you interact with our website. We can track the path you take on our site and which links you click on.
Conversion reports: Conversion is the process by which you perform a desired action based on a marketing message. For example, when you go from being a mere website visitor to a buyer or newsletter subscriber. These reports help us learn more about how our marketing measures are received by you. This is how we want to increase our conversion rate.
Real-time reports: Here we can always see immediately what is happening on our website. For example, we can see how many users are currently reading this text.

In addition to the analysis reports mentioned above, Google Analytics 4 also offers the following features, among others:

Event-based data model: This model records very specific events that can take place on our website. For example, playing a video, purchasing a product, or subscribing to our newsletter.
Advanced analysis features: These features allow us to better understand your behavior on our website or certain general trends. For example, we can segment user groups, perform comparative analyses of target groups, or track your path on our website.
Predictive modeling: Based on collected data, machine learning can be used to extrapolate missing data that predicts future events and trends. This can help us develop better marketing strategies.
Cross-platform analysis: Data can be collected and analyzed from both websites and apps. This allows us to analyze user behavior across platforms, provided you have consented to data processing.

Why do we use Google Analytics on our website?

Our goal with this website is clear: we want to offer you the best possible service. The statistics and data from Google Analytics help us achieve this goal.

The statistically evaluated data gives us a clear picture of the strengths and weaknesses of our website. On the one hand, we can optimize our site so that it is easier for interested people to find on Google. On the other hand, the data helps us to better understand you as a visitor. This gives us a very clear idea of what we need to improve on our website in order to offer you the best possible service. The data also helps us to tailor our advertising and marketing activities to be more individual and cost-effective. After all, it only makes sense to show our products and services to people who are interested in them.

What data is stored by Google Analytics?

Google Analytics uses a tracking code to create a random, unique ID that is linked to your browser cookie. This allows Google Analytics to recognize you as a new user and assign you a user ID. The next time you visit our site, you will be recognized as a “returning” user. All collected data is stored together with this user ID. This is the only way to evaluate pseudonymous user profiles.

In order to analyze our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. For each newly created property, the Google Analytics 4 property is the default. Depending on the property used, data is stored for different lengths of time.

Through identifiers such as cookies, app instance IDs, user IDs, or custom event parameters, your interactions are measured across platforms, provided you have given your consent. Interactions are all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated by Google Analytics may be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, approve it. Exceptions may occur if required by law.

According to Google, IP addresses are not logged or stored in Google Analytics 4. However, Google uses IP address data to derive location data and deletes it immediately afterwards. All IP addresses collected from users in the EU are therefore deleted before the data is stored in a data center or on a server.

Since Google Analytics 4 focuses on event-based data, the tool uses significantly fewer cookies compared to previous versions (such as Google Universal Analytics). Nevertheless, there are some specific cookies that are used by GA4. These include, for example:

Name: _ga

Value: 2.1326744211.152113075714-5

Purpose: By default, analytics.js uses the _ga cookie to store the user ID. It is primarily used to distinguish between website visitors.

Expiration date: after 2 years

Name: _gid

Value: 2.1687193234.152113075714-1

Purpose: This cookie is also used to distinguish between website visitors.

Expiration date: After 24 hours

Name: _gat_gtag_UA_<property-id>

Value: 1

Purpose: Used to reduce the request rate. If Google Analytics is provided via Google Tag Manager, this cookie is named _dc_gtm_ <property-id>.

Expiration date: after 1 minute

Note: This list cannot claim to be complete, as Google constantly changes its choice of cookies. The aim of GA4 is also to improve data protection. The tool therefore offers a number of options for controlling data collection. For example, we can specify the storage period ourselves and also control data collection.

Here is an overview of the most important types of data collected by Google Analytics:

Heat maps: Google creates so-called heat maps. Heat maps show exactly which areas you click on. This gives us information about where you are “traveling” on our site.

Session duration: Google defines session duration as the time you spend on our site without leaving the page. If you have been inactive for 20 minutes, the session ends automatically.

Bounce rate: A bounce occurs when you view only one page on our website and then leave our website.

Account creation: When you create an account or place an order on our website, Google Analytics collects this data.

Location: IP addresses are not logged or stored in Google Analytics. However, shortly before the IP address is deleted, derivations are used for location data.

Technical information: Technical information includes your browser type, your Internet service provider, and your screen resolution.

Source of origin: Google Analytics and we are naturally also interested in which website or advertisement brought you to our site.

Other data includes contact details, any reviews, media playback (e.g., when you play a video on our site), sharing content via social media, or adding to your favorites. This list is not exhaustive and is only intended to provide a general overview of data storage by Google Analytics.

How long and where is the data stored?

Google has servers all over the world. You can find out exactly where Google’s data centers are located here: https://datacenters.google/

Your data is distributed across various physical data carriers. This has the advantage that the data can be retrieved more quickly and is better protected against manipulation. Every Google data center has appropriate emergency programs for your data. For example, if Google’s hardware fails or natural disasters cripple servers, the risk of service interruption at Google remains low.

The retention period for the data depends on the properties used. The storage period is always determined separately for each individual property. Google Analytics offers us four options for controlling the storage period:

2 months: this is the shortest storage period.
14 months: by default, data is stored for 14 months in GA4.
26 months: data can also be stored for 26 months.
Data is only deleted when we delete it manually

There is also the option of data only being deleted if you do not visit our website again within the period we have selected. In this case, the retention period is reset each time you visit our website again within the specified period.

Once the specified period has expired, the data is deleted once a month. This retention period applies to your data linked to cookies, user recognition, and advertising IDs (e.g., cookies from the DoubleClick domain). Report results are based on aggregated data and are stored independently of user data. Aggregated data is a combination of individual data into a larger unit.

How can I delete my data or prevent data storage?

Under European Union data protection law, you have the right to obtain information about your data, to update it, to delete it, or to restrict its use. You can prevent Google Analytics 4 from using your data by using the browser add-on to deactivate Google Analytics JavaScript (analytics.js, gtag.js). You can download and install the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de. Please note that this add-on only deactivates data collection by Google Analytics.

If you want to disable, delete, or manage cookies in general, you will find the relevant links to the respective instructions for the most popular browsers in the “Cookies” section.

Legal basis

The use of Google Analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by web analytics tools.

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors in order to improve our offering both technically and economically. With the help of Google Analytics, we can detect website errors, identify attacks, and improve economic efficiency. The legal basis for this is Art. 6 (1) (f) GDPR (legitimate interests). However, we only use Google Analytics if you have given your consent.

Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called standard contractual clauses (= Art. 46 (2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to third countries (such as the US) and stored there. Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

We hope we have been able to provide you with the most important information about data processing by Google Analytics. If you would like to learn more about the tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.

If you would like to learn more about data processing, please refer to Google’s privacy policy at https://policies.google.com/privacy?hl=de.

Data Processing Agreement (DPA) Google Analytics

We have concluded a data processing agreement (DPA) with Google in accordance with Article 28 of the General Data Protection Regulation (GDPR). You can read about what exactly a DPA is and, above all, what must be included in a DPA in our general section “Data Processing Agreement (DPA)”.

This agreement is required by law because Google processes personal data on our behalf. It clarifies that Google may only process data it receives from us in accordance with our instructions and must comply with the GDPR. The link to the data processing agreement can be found at https://business.safety.google/intl/de/adsprocessorterms/

Google Analytics reports on demographic characteristics and interests

We have enabled the advertising reporting features in Google Analytics. The reports on demographic characteristics and interests contain information on age, gender, and interests. This allows us to get a better picture of our users without being able to assign this data to individual persons. You can find out more about the advertising features at https://support.google.com/analytics/answer/3450482?hl=de_AT&utm_id=ad.

You can opt out of the use of your Google Account activity and information by checking the box under “Advertising settings” at https://adssettings.google.com/authenticated.

Google Analytics in consent mode

Depending on your consent, your personal data will be processed by Google Analytics in what is known as consent mode. You can choose whether or not to accept Google Analytics cookies. In doing so, you also choose which data Google Analytics is allowed to process about you. This collected data is mainly used to measure user behavior on the website, to display targeted advertising, and to provide us with web analytics reports. As a rule, you consent to data processing by Google via a cookie consent tool. If you do not consent to data processing, only aggregated data will be collected and processed. This means that data cannot be assigned to individual users and therefore no user profile of you will be created. You can also consent to statistical measurement only. In this case, no personal data will be processed and therefore not used for advertising or advertising success.

Google Analytics IP anonymization

We have implemented Google Analytics IP address anonymization on this website. This feature was developed by Google so that this website can comply with applicable data protection regulations and recommendations from local data protection authorities if they prohibit the storage of the full IP address. The anonymization or masking of the IP address takes place as soon as the IP addresses arrive in the Google Analytics data collection network and before the data is stored or processed.

For more information on IP anonymization, please visit https://support.google.com/analytics/answer/2763052?hl=de.

Email marketing Introduction

Email marketing Summary? Data subjects: Newsletter subscribers

? Purpose: Direct marketing via email, notification of system-relevant events

? Processed data: Data entered during registration, but at least the email address. More details can be found in the respective email marketing tool used.

? Storage period: Duration of the subscription

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is email marketing?

We also use email marketing to keep you up to date. If you have agreed to receive our emails or newsletters, your data will also be processed and stored. Email marketing is a sub-area of online marketing. It involves sending news or general information about a company, products, or services by email to a specific group of people who are interested in it.

If you want to participate in our email marketing (usually via newsletter), you normally only need to register with your email address. To do this, fill out an online form and submit it. However, we may also ask you for your title and name so that we can write to you personally.

Basically, signing up for newsletters works with the help of the so-called “double opt-in procedure.” After you have signed up for our newsletter on our website, you will receive an email asking you to confirm your newsletter subscription. This ensures that the email address belongs to you and that no one else has signed up with someone else’s email address. We or a notification tool we use logs every single registration. This is necessary so that we can also verify the legally correct registration process. As a rule, the time of registration, the time of registration confirmation, and your IP address are stored. In addition, any changes you make to your stored data are also logged.

Why do we use email marketing?

We naturally want to stay in touch with you and always present you with the most important news about our company. To do this, we use email marketing—often referred to simply as “newsletters”—as an essential part of our online marketing. If you agree to this or if it is legally permitted, we will send you newsletters, system emails, or other notifications by email. When we use the term “newsletter” in the following text, we mainly refer to emails that are sent out regularly. Of course, we do not want to bother you with our newsletters in any way. That is why we always strive to provide only relevant and interesting content. This allows you to learn more about our company, our services, or our products. Since we are always improving our offerings, our newsletter also keeps you informed about any news or special, lucrative promotions we may be offering. If we commission a service provider that offers a professional mailing tool for our email marketing, we do so in order to provide you with fast and secure newsletters. The purpose of our email marketing is to inform you about new offers and to help us achieve our business goals.

What data is processed?

When you subscribe to our newsletter via our website, you confirm your membership in an email list by email. In addition to your IP address and email address, your title, name, address, and telephone number may also be stored. However, this will only happen if you consent to this data storage. The data marked as such is necessary for you to participate in the service offered. Providing this information is voluntary, but if you do not provide it, you will not be able to use the service. In addition, information about your device or your preferred content on our website may also be stored. For more information on data storage when you visit a website, please refer to the section “Automatic data storage.” We record your declaration of consent so that we can always prove that it complies with our laws.

Duration of data processing

If you unsubscribe your email address from our email/newsletter distribution list, we may store your address for up to three years on the basis of our legitimate interests so that we can still prove your consent at that time. We may only process this data if we need to defend ourselves against any claims.

However, if you confirm that you have given us your consent to subscribe to the newsletter, you can submit an individual deletion request at any time. If you permanently object to the consent, we reserve the right to store your email address in a block list. As long as you have voluntarily subscribed to our newsletter, we will of course also retain your email address.

Right of objection

You can unsubscribe from the newsletter at any time. To do so, you simply need to revoke your consent to subscribe to the newsletter. This usually takes only a few seconds or one or two clicks. In most cases, you will find a link to unsubscribe from the newsletter at the end of each email. If you really cannot find the link in the newsletter, please contact us by email and we will cancel your newsletter subscription immediately.

Legal basis

Our newsletter is sent on the basis of your consent (Article 6(1)(a) GDPR). This means that we may only send you a newsletter if you have actively subscribed to it beforehand. We may also send you advertising messages if you have become our customer and have not objected to the use of your email address for direct marketing.

Information on specific email marketing services and how they process personal data can be found in the following sections, if available.

Messenger & Communication Introduction

Messenger & Communication Privacy Policy Summary

? Data subjects: Website visitors

? Purpose: Contact requests and general communication between us and you

? Processed data: Data such as name, address, email address, phone number, general content data, IP address if applicable

You can find more details on this in the tools used in each case.

? Storage period: Depends on the messenger & communication functions used

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests), Art. 6 (1) (b) GDPR (contractual or pre-contractual obligations)

What are messenger and communication functions?

We offer various options on our website (such as messenger and chat functions, online and contact forms, email, telephone) for communicating with us. Your data will also be processed and stored to the extent necessary to respond to your inquiry and take any subsequent action.

In addition to traditional means of communication such as email, contact forms, and telephone, we also use chats and messengers. The most commonly used messenger function at present is WhatsApp, but there are, of course, many different providers offering messenger functions specifically for websites. If content is end-to-end encrypted, this is indicated in the individual data protection texts or in the data protection declaration of the respective provider. End-to-end encryption simply means that the content of a message is not visible even to the provider. However, information about your device, location settings, and other technical data may still be processed and stored.

Why do we use messenger and communication functions?

Communication options with you are very important to us. After all, we want to talk to you and answer any questions you may have about our service in the best possible way. Effective communication is an important part of our service. With the practical messenger and communication functions, you can choose your preferred method at any time. In exceptional cases, however, we may not be able to answer certain questions via chat or messenger. This is the case, for example, when it comes to internal contractual matters. In such cases, we recommend other communication options such as email or telephone.

We generally assume that we remain responsible for data protection, even when using the services of a social media platform. However, the European Court of Justice has ruled that in certain cases, the operator of the social media platform may be jointly responsible with us within the meaning of Art. 26 GDPR. If this is the case, we will point this out separately and work on the basis of a relevant agreement. The essence of the agreement is reproduced below for the platform concerned.

Please note that when you use our built-in elements, your data may also be processed outside the European Union, as many providers, such as Facebook Messenger or WhatsApp, are American companies. This may make it more difficult for you to assert or enforce your rights with regard to your personal data.

What data is processed?

The exact data that is stored and processed depends on the respective provider of the messenger and communication functions. Basically, this includes data such as your name, address, telephone number, email address, and content data such as all information you enter in a contact form. In most cases, information about your device and IP address is also stored. Data collected via a messenger and communication function is also stored on the providers’ servers.

If you want to know exactly what data is stored and processed by the respective providers and how you can object to data processing, you should carefully read the respective company’s privacy policy.

How long is data stored?

How long the data is processed and stored depends primarily on the tools we use. You can find out more about data processing for each tool below. The providers’ privacy policies usually specify exactly what data is stored and processed and for how long. As a rule, personal data is only processed for as long as is necessary to provide our services. When data is stored in cookies, the storage period varies greatly. The data may be deleted immediately after leaving a website, but it may also remain stored for several years. Therefore, you should look at each individual cookie in detail if you want to know more about data storage. In most cases, you will also find informative information about the individual cookies in the privacy policies of the individual providers.

Right to object

Since cookies may be used for messenger and communication functions, we also recommend that you read our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal basis

If you have consented to your data being processed and stored by integrated messenger and communication functions, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR). We process your request and manage your data within the framework of contractual or pre-contractual relationships in order to fulfill our pre-contractual and contractual obligations or to respond to inquiries. The basis for this is Art. 6 (1) (b) GDPR. In principle, if consent has been given, your data will also be stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners.

Facebook Messenger Privacy Policy

Facebook Messenger Privacy Policy Summary? Data subjects: Facebook Messenger users

? Purpose: Communication

? Data processed: Contact details, messages, media

? Storage period: After account deletion

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is Facebook Messenger?

We use the instant messaging service Facebook Messenger on our website. The service provider is the American company Meta Platforms Inc. Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) is responsible for the European region.

Facebook Messenger is a chat messaging feature developed by Facebook that allows you to send and receive text messages, voice and video calls, photos, and other media files to other Facebook users.

When you use Facebook Messenger, your personal data is also processed on Facebook’s servers. In addition to your phone number and chat messages, this includes photos, videos, profile data, your address, and your location.

Why do we use Facebook Messenger?

We want to stay in touch with you, and the best way to do that is through messaging services such as Facebook Messenger. On the one hand, because the service works flawlessly, and on the other, because Facebook is still one of the best-known social media platforms. The service is practical and enables us to communicate with you quickly and easily.

What data is processed by Facebook Messenger?

When you use Facebook Messenger, various types of data, including personal data, may be processed. This includes account information such as your phone number, profile picture, username, or other information you provide to Facebook when creating and managing your account. Of course, Facebook also stores the content of your messages (text, photos, videos, voice messages). Facebook also stores so-called metadata, such as the date and time a message was sent or received. Facebook Messenger can also access your contacts to enable communication with them. Technical data such as device type, operating system, or location data is also stored.

How long and where is the data stored?

Facebook generally stores data until it is no longer needed for its own services and Facebook products. Facebook has servers located around the world where its data is stored. However, customer data is deleted within 48 hours after it has been matched with the user’s own data.

How can I delete my data or prevent data storage?

You have the right to access, correct, delete, or restrict the processing of your personal data at any time. You can also revoke your consent to the processing of your data at any time. Your data will only be permanently deleted if you delete your Facebook account.

Follow these steps to completely delete your Facebook account:

1) Log in to Facebook and then click on “Settings” in the top right-hand corner.

2) Then click on “Your Facebook Information” in the left-hand column.

3) Now click on “Deactivation and Deletion.”

4) Now select “Delete Account” and then click on “Continue and Delete Account.”

5) Now enter your password, click on ‘Continue’ and then on “Delete Account.”

Legal basis

The use of Facebook Messenger requires your consent, which we have obtained with our consent tool (pop-up). According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by Facebook Messenger.

In addition to consent, we have a legitimate interest in improving our service. Facebook Messenger enables us to communicate with you faster and more effectively. The legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use Facebook Messenger if you have given your consent.

Facebook also processes your data in the USA, among other places. Facebook and Meta Platforms are active participants in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Facebook uses so-called standard contractual clauses (= Art. 46 (2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to third countries (such as the US) and stored there. Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Facebook undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Facebook data processing terms, which refer to the standard contractual clauses, can be found at https://www.facebook.com/legal/terms/dataprocessing.

You can find out more about the data processed through the use of Facebook in the privacy policy at https://www.facebook.com/about/privacy.

WhatsApp Privacy Policy

WhatsApp Privacy Policy Summary

? Data subjects: WhatsApp users

? Purpose: Communication

? Data processed: Contact details, messages, media

? Storage period: After account deletion or deactivation

⚖️ Legal basis:

Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is WhatsApp?

We use the instant messaging service WhatsApp on our website. The service provider is the American company WhatsApp Inc., a subsidiary of Meta Platforms Inc. (until October 2021 Facebook Inc.). WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, is responsible for the European region.

We probably don’t need to introduce WhatsApp to you in any more detail. It is relatively likely that you yourself use this well-known messaging service on your smartphone. For many years, there have been voices criticizing WhatsApp and its parent company Meta Platforms with regard to the handling of personal data. In recent years, the main criticism has focused on the merging of WhatsApp user data with Facebook. Facebook responded to this in 2021 by updating its terms of use. Facebook stated that currently (as of 2021), no personal data from WhatsApp users is shared with Facebook.

Nevertheless, WhatsApp does of course process a considerable amount of your personal data if you use WhatsApp and have consented to data processing. In addition to your phone number and chat messages, this includes photos, videos, and profile data that you have sent. However, photos and videos are only stored temporarily, and all messages and phone calls are end-to-end encrypted.

This means that even Meta itself should not be able to view them. Information from your address book and other metadata is also stored by WhatsApp.

Why do we use WhatsApp?

We want to stay in touch with you, and WhatsApp is the best way to do that. This is partly because the service works flawlessly, and partly because WhatsApp is still the most widely used instant messaging tool worldwide. The service is practical and enables quick and easy communication with you.

What data is processed by WhatsApp?

When using WhatsApp, various types of data, including personal data, may be processed. This includes account information such as your phone number, profile picture, username, or other information that you provide to WhatsApp when creating and managing your WhatsApp account. Of course, WhatsApp also stores the content of your messages (text, photos, videos, voice messages). WhatsApp also stores so-called metadata, such as the date and time a message was sent or received. The phone numbers of the people involved and technical data such as device type, operating system, or location data are also stored.

How long and where is the data stored?

In principle, WhatsApp stores data for as long as necessary for legitimate purposes and to fulfill legal obligations. It is not possible to give a specific answer as to how long the data is stored, as this depends heavily on the type of data. As a rule, messages are only stored in encrypted form by WhatsApp during delivery and are deleted from the servers as soon as a message has been delivered. Messages are only stored longer on your own device. When media is sent, WhatsApp stores this data in encrypted form for up to 30 days to optimize delivery. Account data is stored for as long as you have an active WhatsApp account. If you delete or deactivate your account, your account data will normally also be deleted. The company stores the data stored on WhatsApp on its own servers, which are located around the world. Data is also collected with the help of cookies in order to operate the web-based WhatsApp services.

How can I delete my data or prevent data storage?

You have the right to access, correct, delete, or restrict the processing of your personal data at any time. You can also revoke your consent to the processing of your data at any time.

If you do not want cookies to be set and data to be stored in the desktop version, you can also prevent cookies from being set in your browser. You can manage, deactivate, or delete cookies in your browser. Depending on your browser, this works slightly differently. You can find more information in our section on cookies.

Legal basis

The use of WhatsApp requires your consent, which we have obtained with our consent tool (pop-up). According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by WhatsApp.

In addition to consent, we have a legitimate interest in improving our communication services. With the help of WhatsApp, we can respond to your inquiries faster and better, send you important messages, and thus take our service to the next level. The legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests).

However, we only use WhatsApp if you have given your consent.

WhatsApp also processes your data in the USA, among other places. WhatsApp is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

WhatsApp also uses standard contractual clauses (SCCs) (Art. 46(2) and (3) GDPR). . Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the US). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, WhatsApp commits to complying with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

Information on data transfer at WhatsApp that complies with the standard contractual clauses can be found at https://www.whatsapp.com/legal/business-data-transfer-addendum-20210927

We hope we have provided you with the most important information about the use and data processing by WhatsApp. You can find out more about the data processed through the use of WhatsApp in the privacy policy at https://www.whatsapp.com/privacy.

Social media introduction

Social media privacy policy summary? Data subjects: Visitors to the website

? Purpose: Presentation and optimization of our services, contact with visitors, interested parties, etc., advertising

? Processed data: Data such as phone numbers, email addresses, contact details, user behavior data, information about your device, and your IP address.

You can find more details on this in the respective social media tool used.

? Storage period: Depends on the social media platforms used

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is social media?

In addition to our website, we are also active on various social media platforms. User data may be processed so that we can specifically target users who are interested in us via social networks. In addition, elements of a social media platform may also be embedded directly into our website. This is the case, for example, when you click on a social button on our website and are redirected directly to our social media presence. Social media refers to websites and apps through which registered members can produce content, exchange content openly or in specific groups, and network with other members.

Why do we use social media?

For years, social media platforms have been the place where people communicate and connect online. Our social media presence allows us to bring our products and services closer to interested parties. The social media elements integrated into our website help you to switch to our social media content quickly and without complications.

The data stored and processed through your use of a social media channel is primarily used for the purpose of performing web analytics. The aim of these analyses is to develop more accurate and personalized marketing and advertising strategies. Depending on your behavior on a social media platform, the evaluated data can be used to draw appropriate conclusions about your interests and create so-called user profiles. This also enables the platforms to present you with customized advertisements. In most cases, cookies are set in your browser for this purpose, which store data about your usage behavior.

We generally assume that we remain responsible for data protection, even when we use the services of a social media platform. However, the European Court of Justice has ruled that in certain cases, the operator of the social media platform may be jointly responsible with us within the meaning of Art. 26 GDPR. If this is the case, we will point this out separately and work on the basis of a relevant agreement. The essence of the agreement is then reproduced below for the platform concerned.

Please note that when you use social media platforms or our built-in elements, your data may also be processed outside the European Union, as many social media channels, such as Facebook or Twitter, are American companies. This may make it more difficult for you to assert or enforce your rights with regard to your personal data.

What data is processed?

The exact data that is stored and processed depends on the respective provider of the social media platform. However, this usually includes data such as telephone numbers, email addresses, data that you enter in a contact form, user data such as which buttons you click, who you like or follow, when you visited which pages, information about your device, and your IP address. Most of this data is stored in cookies. Especially if you have a profile on the social media channel you are visiting and are logged in, data can be linked to your profile.

All data collected via a social media platform is also stored on the providers’ servers. This means that only the providers have access to the data and can provide you with the relevant information or make changes.

If you want to know exactly what data is stored and processed by social media providers and how you can object to data processing, you should carefully read the company’s privacy policy. If you have any questions about data storage and data processing or want to assert your rights, we recommend that you contact the provider directly.

Duration of data processing

We will inform you about the duration of data processing below, provided we have further information on this. For example, the social media platform Facebook stores data until it is no longer needed for its own purposes. However, customer data that is matched with its own user data is deleted within two days. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. If required by law, as in the case of accounting, for example, this storage period may be exceeded.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers such as embedded social media elements at any time. You can do this either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating, or deleting cookies in your browser.

Since social media tools may use cookies, we also recommend that you read our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal basis

If you have consented to your data being processed and stored by integrated social media elements, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR) . In principle, if you have given your consent, your data will also be stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the tools if you have given your consent. Most social media platforms also set cookies in your browser to store data. We therefore recommend that you read our privacy policy on cookies carefully and review the privacy policy or cookie policy of the respective service provider.

Information on specific social media platforms can be found in the following sections, where available.

Facebook Privacy Policy

Facebook Privacy Policy Summary

? Data subjects: Visitors to the website

? Purpose: Optimization of our services

More details can be found below in the privacy policy.

? Storage period: until the data is no longer useful for Facebook’s purposes

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What are Facebook tools?

We use selected Facebook tools on our website. Facebook is a social media network owned by Meta Platforms Inc. or, for the European region, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. These tools enable us to offer you and people who are interested in our products and services the best possible experience.

If data is collected and forwarded via our embedded Facebook elements or via our Facebook page (fan page), both we and Facebook Ireland Ltd. are responsible for this. Facebook is solely responsible for the further processing of this data. Our joint obligations have also been set out in a publicly accessible agreement at https://www.facebook.com/legal/controller_addendum. This agreement stipulates, for example, that we must clearly inform you about the use of Facebook tools on our site. Furthermore, we are also responsible for ensuring that the tools are integrated into our website in a manner that complies with data protection laws. Facebook, on the other hand, is responsible for the data security of Facebook products, for example. If you have any questions about data collection and data processing by Facebook, you can contact the company directly. If you direct your question to us, we are obliged to forward it to Facebook.

Below, we provide an overview of the various Facebook tools, what data is sent to Facebook, and how you can delete this data.

Among many other products, Facebook also offers what it calls “Facebook Business Tools.” This is the official name used by Facebook. However, as this term is not widely known, we have decided to simply refer to them as Facebook tools. These include, among others:

Facebook Pixel
Social plug-ins (such as the “Like” or “Share” button)
Facebook Login
Account Kit
APIs (application programming interface)
SDKs (collection of programming tools)
Platform integrations
Plugins
Codes
Specifications
Documentation
Technologies and services

These tools enable Facebook to expand its services and obtain information about user activities outside of Facebook.

Why do we use Facebook tools on our website?

We only want to show our services and products to people who are genuinely interested in them. With the help of advertisements (Facebook Ads), we can reach exactly these people. However, in order to show users relevant ads, Facebook needs information about people’s wants and needs. This means that information about user behavior (and contact details) on our website is made available to the company. This allows Facebook to collect better user data and show interested people relevant ads about our products or services. The tools thus enable customized advertising campaigns on Facebook.

Facebook refers to data about your behavior on our website as “event data.” This data is also used for measurement and analysis services. Facebook can thus create “campaign reports” on our behalf about the effectiveness of our advertising campaigns. Furthermore, analyses give us better insight into how you use our services, website, or products. This allows us to optimize your user experience on our website with some of these tools. For example, you can use social plug-ins to share content on our site directly on Facebook.

What data is stored by Facebook tools?

When you use certain Facebook tools, personal data (customer data) may be sent to Facebook. Depending on the tools used, customer data such as name, address, phone number, and IP address may be sent.

Facebook uses this information to compare the data with the data it already has about you (if you are a Facebook member). Before customer data is transmitted to Facebook, it undergoes a process known as “hashing.” This means that a data set of any size is transformed into a character string. This also serves to encrypt data.

In addition to contact data, “event data” is also transmitted. “Event data” refers to the information we receive about you on our website. For example, which subpages you visit or which products you buy from us. Facebook does not share the information it receives with third parties (such as advertisers) unless the company has explicit permission or is legally required to do so. “Event data” can also be linked to contact data. This enables Facebook to offer better personalized advertising. After the aforementioned matching process, Facebook deletes the contact data again.

In order to deliver optimized advertisements, Facebook only uses event data if it has been combined with other data (collected by Facebook in other ways). Facebook also uses this event data for security, protection, development, and research purposes. Much of this data is transferred to Facebook via cookies. Cookies are small text files that are used to store data or information in browsers. Depending on the tools used and whether you are a Facebook member, different numbers of cookies are created in your browser. We go into more detail about individual Facebook cookies in the descriptions of the individual Facebook tools. You can also find general information about the use of Facebook cookies at https://www.facebook.com/policies/cookies.

How long and where is the data stored?

Facebook generally stores data until it is no longer needed for its own services and Facebook products. Facebook has servers all over the world where its data is stored. However, customer data is deleted within 48 hours after it has been matched with your own user data.

How can I delete my data or prevent data storage?

In accordance with the General Data Protection Regulation, you have the right to access, correct, transfer, and delete your data.

Your data will only be completely deleted if you delete your Facebook account entirely. Here’s how to delete your Facebook account:

1) Click on Settings on the right-hand side of Facebook.

2) Then click on “Your Facebook Information” in the left-hand column.

3) Now click on “Deactivation and Deletion.”

4) Now select “Delete Account” and then click on “Continue and Delete Account.”

5) Now enter your password, click on ‘Continue’ and then on “Delete Account.”

The data that Facebook receives via our site is stored using cookies (e.g., for social plugins), among other things. You can deactivate, delete, or manage individual or all cookies in your browser. Depending on which browser you use, this works in different ways. Under the “Cookies” section, you will find the corresponding links to the respective instructions for the most popular browsers.

If you do not want cookies at all, you can set your browser to always inform you when a cookie is to be set. This allows you to decide whether or not to allow each individual cookie.

Legal basis

If you have consented to your data being processed and stored by integrated Facebook tools, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the tools if you have given your consent. Most social media platforms also set cookies in your browser to store data. We therefore recommend that you read our privacy policy on cookies carefully and review Facebook’s privacy policy or cookie policy.

Facebook also processes your data in the USA, among other places. Facebook and Meta Platforms are active participants in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the US. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

The Facebook data processing terms, which refer to the standard contractual clauses, can be found at https://www.facebook.com/legal/terms/dataprocessing.

We hope we have provided you with the most important information about the use and data processing by Facebook tools. If you would like to learn more about how Facebook uses your data, we recommend that you read the data policy at https://www.facebook.com/privacy/policy/.

Instagram Privacy Policy

Instagram Privacy Policy Summary

? Data subjects: Website visitors

? Purpose: Optimization of our services

You can find more details below in the privacy policy.

? Storage period: until Instagram no longer needs the data for its purposes

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is Instagram?

We have integrated Instagram features into our website. Instagram is a social media platform operated by Instagram LLC, 1601 Willow Rd, Menlo Park CA 94025, USA. Instagram has been a subsidiary of Meta Platforms Inc. since 2012 and is one of the Facebook products. The embedding of Instagram content on our website is called embedding. This allows us to show you content such as buttons, photos, or videos from Instagram directly on our website. When you visit pages on our website that have an Instagram feature integrated, data is transmitted to Instagram, stored, and processed. Instagram uses the same systems and technologies as Facebook. Your data is therefore processed across all Facebook companies.

Below, we would like to give you a more detailed insight into why Instagram collects data, what data is involved, and how you can largely control data processing. Since Instagram belongs to Meta Platforms Inc., we obtain our information from the Instagram guidelines on the one hand, but also from the Meta privacy policy itself on the other.

Instagram is one of the most popular social media networks worldwide. Instagram combines the advantages of a blog with the advantages of audiovisual platforms such as YouTube or Vimeo. On “Insta” (as many users casually call the platform), you can upload photos and short videos, edit them with various filters, and share them on other social networks. And if you don’t want to be active yourself, you can just follow other interesting users.

Why do we use Instagram on our website?

Instagram is the social media platform that has really taken off in recent years. And, of course, we have also responded to this boom. We want you to feel as comfortable as possible on our website. That’s why it goes without saying that we want to present our content in a varied way. The embedded Instagram features allow us to enrich our content with helpful, funny, or exciting content from the Instagram world. Since Instagram is a subsidiary of Facebook, the data collected can also be used for personalized advertising on Facebook. This ensures that our ads only reach people who are genuinely interested in our products or services.

Instagram also uses the collected data for measurement and analysis purposes. We receive summarized statistics, which give us more insight into your wishes and interests. It is important to note that these reports do not identify you personally.

What data is stored by Instagram?

When you visit one of our pages that has Instagram features (such as Instagram images or plug-ins) built in, your browser automatically connects to Instagram’s servers. Data is sent to Instagram, stored, and processed. This happens regardless of whether you have an Instagram account or not. This includes information about our website, your computer, purchases you have made, advertisements you see, and how you use our services. The date and time of your interaction with Instagram is also stored. If you have an Instagram account or are logged in, Instagram stores significantly more data about you.

Facebook distinguishes between customer data and event data. We assume that this is also the case with Instagram. Customer data includes, for example, name, address, telephone number, and IP address. This customer data is only transmitted to Instagram after it has been “hashed.” Hashing means that a data record is converted into a string of characters. This allows the contact data to be encrypted. In addition, the above-mentioned “event data” is also transmitted. Facebook—and consequently Instagram—understands “event data” to mean data about your user behavior. It may also happen that contact data is combined with event data. The contact data collected is compared with the data that Instagram already has about you.

The collected data is transmitted to Facebook via small text files (cookies), which are usually set in your browser. Depending on the Instagram features you use and whether you have an Instagram account yourself, different amounts of data are stored.

We assume that data processing on Instagram works in the same way as on Facebook. This means that if you have an Instagram account or have visited www.instagram.com, Instagram has at least set a cookie. If this is the case, your browser sends information to Instagram via the cookie as soon as you come into contact with an Instagram function. This data is deleted or anonymized after 90 days at the latest (after matching). Although we have looked closely at Instagram’s data processing, we cannot say exactly what data Instagram collects and stores.

Below, we show you the cookies that are set in your browser at a minimum when you click on an Instagram feature (such as a button or an Insta image). In our test, we assume that you do not have an Instagram account. If you are logged into Instagram, significantly more cookies will of course be set in your browser.

These cookies were used in our test:

Name: csrftoken

Value: “”

Purpose: This cookie is most likely set for security reasons to prevent fake requests. However, we were unable to find out more details.

Expiration date: after one year

Name: mid

Value: “”

Purpose: Instagram sets this cookie to optimize its own services and offers both on and off Instagram. The cookie assigns a unique user ID.

Expiration date: after the end of the session

Name: fbsr_113075714124024

Value: No information

Purpose: This cookie stores the login request for users of the Instagram app.

Expiration date: After the end of the session

Name: rur

Value: ATN

Purpose: This is an Instagram cookie that ensures functionality on Instagram.

Expiration date: after the end of the session

Name: urlgen

Value: “{”194.96.75.33“: 1901}:1iEtYv:Y833k2_UjKvXgYe113075714”

Purpose: This cookie is used for Instagram’s marketing purposes.

Expiration date: after the end of the session

Note: We cannot claim to be exhaustive here. Which cookies are set in each individual case depends on the embedded functions and your use of Instagram.

How long and where is the data stored?

Instagram shares the information it receives with Facebook companies, external partners, and people you connect with worldwide. Data processing is carried out in accordance with its own data policy. For security reasons, among others, your data is distributed across Facebook servers around the world. Most of these servers are located in the US.

How can I delete my data or prevent it from being stored?

Thanks to the General Data Protection Regulation, you have the right to access, transfer, correct, and delete your data. You can manage your data in the Instagram settings. If you want to completely delete your data on Instagram, you must permanently delete your Instagram account.

Here’s how to delete your Instagram account:

First, open the Instagram app. On your profile page, scroll down and click on “Help Center.” You will now be taken to the company’s website. On the website, click on “Manage your account” and then on “Delete your account.”

If you delete your account completely, Instagram will delete posts such as your photos and status updates. Information that other people have shared about you does not belong to your account and will therefore not be deleted.

As mentioned above, Instagram primarily stores your data via cookies. You can manage, deactivate, or delete these cookies in your browser. Depending on your browser, the management works a little differently. Under the “Cookies” section, you will find the corresponding links to the respective instructions for the most popular browsers.

You can also set your browser so that you are always informed when a cookie is to be set. Then you can always decide individually whether you want to allow the cookie or not.

Legal basis

If you have consented to your data being processed and stored by integrated social media elements, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the integrated social media elements if you have given your consent. Most social media platforms also set cookies in your browser to store data. We therefore recommend that you read our privacy policy on cookies carefully and review the privacy policy or cookie policy of the respective service provider.

Instagram also processes your data in the USA, among other places. Instagram and Meta Platforms are active participants in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Instagram uses so-called standard contractual clauses (= Art. 46 (2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to third countries (such as the US) and stored there. Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Instagram undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

We have tried to provide you with the most important information about data processing by Instagram. You can find out more about Instagram’s data policy at https://privacycenter.instagram.com/policy/.

TikTok Privacy Policy

TikTok Privacy Policy Summary? Data subjects: Visitors to the website

? Purpose: Optimization of our services

? Processed data: Your IP address, browser data, date, and time of your page view may be stored

More details can be found below in the privacy policy.

? Storage period: varies depending on settings

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is TikTok?

We use TikTok integration on our website. The service provider is the Chinese company Beijing Bytedance Technology Ltd. The Irish company TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, is responsible for the European region. TikTok is a popular social media platform, especially among young people, where users can create, share, and view short video clips.

In this privacy policy, we inform you about what data is processed by TikTok, how long the data is stored, and how you can manage your privacy settings.

Why do we use TikTok on our website?

We have integrated TikTok into our website so that you can watch TikTok videos and interact with them if you wish. TikTok is particularly known for its funny and creative content, and of course we don’t want to deprive you of such content. After all, we ourselves enjoy watching the occasional creative TikTok video.

What data is processed by TikTok?

When you watch or interact with TikTok videos on our website, TikTok may collect information about your usage behavior and your device. This may include data such as your IP address, browser type, operating system, location, and other technical information. TikTok may also use cookies and similar technologies to collect information and personalize your user experience.

If you have a TikTok account yourself, additional information may also be collected and processed. This includes user information (such as your name, date of birth, or email address) and data about your communication with other TikTok users.

How long and where is the data stored?

The storage period and storage locations of the data collected by TikTok can vary greatly and are subject to TikTok’s privacy policy. TikTok may also store data on servers in the US and other countries. The storage period is usually based on the respective legal requirements and internal guidelines. However, we have not yet been able to determine exactly how long data is stored. As soon as we have more detailed information, we will of course let you know.

How can I delete my data or prevent data storage?

If you have a TikTok account, you can manage your privacy settings directly on TikTok. For example, you can specify in your TikTok account settings which information may be shared and which may not. In addition, you can manage and disable cookies in your web browser to limit data collection. This is of course also possible without a TikTok account. Please note, however, that this may affect the functionality of our website and your TikTok experience.

Legal basis

If you have consented to TikTok processing and storing your data, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the integrated social media elements if you have given your consent. TikTok may also set cookies in your browser to store data.

We therefore recommend that you read our privacy policy on cookies carefully and review the privacy policy or cookie policy of the respective service provider. TikTok also processes your data in the USA, among other places. We would like to point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA.

This may entail various risks for the legality and security of data processing.

TikTok uses so-called standard contractual clauses (= Art. 46 (2) and (3) GDPR) as the basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, i.e. in particular in the USA) or for data transfers to such countries. Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the USA). Through these clauses, TikTok undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

For more information about TikTok’s privacy policy and TikTok’s data collection practices, please visit the TikTok website at https://www.tiktok.com/legal/page/eea/privacy-policy/en and the general information about TikTok at https://www.tiktok.com/en/.

Blogs and publication media Introduction

Blogs and publication media Privacy policy Summary? Data subjects: Website visitors

? Purpose: Presentation and optimization of our services, communication between website visitors, security measures, and administration

? Data processed: Data such as contact details, IP address, and published content.

More details can be found in the tools used.

? Storage period: Depends on the tools used

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests), Art. 6 (1) (b) GDPR (contract)

What are blogs and publication media?

We use blogs and other means of communication on our website to communicate with you and for you to communicate with us. In doing so, we may also store and process data about you. This may be necessary in order to display content appropriately, ensure communication works, and increase security. Our privacy policy provides general information about which data about you may be processed. Exact details on data processing always depend on the tools and functions used. You can find detailed information on data processing in the privacy policies of the individual providers.

Why do we use blogs and publication media?

Our main concern with our website is to offer you interesting and exciting content, and at the same time, your opinions and content are also important to us. That is why we want to create a good interactive exchange between us and you. We can achieve this with various blogs and publication options. For example, you can write comments on our content, comment on other comments, or in some cases even write your own posts.

What data is processed?

The exact data that is processed always depends on the communication functions we use. Very often, the IP address, user name, and published content are stored. This is primarily done to ensure security, prevent spam, and take action against illegal content. Cookies may also be used for data storage. These are small text files that are stored in your browser with information. You can find more details about the data collected and stored in our individual sections and in the privacy policy of the respective provider.

Duration of data processing

We will inform you about the duration of data processing below, provided we have further information on this. For example, post and comment functions store data until you revoke your consent to data storage. In general, personal data is only stored for as long as is absolutely necessary for the provision of our services.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party communication tools at any time. You can do this either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating, or deleting cookies in your browser.

Since cookies may also be used in publication media, we also recommend that you read our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal basis

We use the communication tools primarily on the basis of our legitimate interests (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers, business partners, and visitors. Insofar as the use serves the purpose of processing contractual relationships or initiating them, the legal basis is also Art. 6 (1) (b) GDPR.

Certain processing operations, in particular the use of cookies and the use of comment or message functions, require your consent. If and to the extent that you have consented to the processing and storage of your data by integrated publication media, this consent shall be deemed the legal basis for data processing (Art. 6 (1) (a) GDPR). Most of the communication functions we use set cookies in your browser to store data. We therefore recommend that you read our privacy policy on cookies carefully and review the privacy policy or cookie policy of the respective service provider.

Information on specific tools, if available, can be found in the following sections.

Blog posts and comment functions Privacy policy

There are various online communication tools that we can use on our website. For example, we use blog posts and comment functions. This gives you the opportunity to comment on content or write posts. If you use this function, your IP address may be stored for security reasons. This protects us from illegal content such as insults, unauthorized advertising, or prohibited political propaganda. In order to identify whether comments are spam, we may also store and process user information on the basis of our legitimate interest. If we launch a survey, we also store your IP address for the duration of the survey so that we can ensure that all participants only vote once. Cookies may also be used for storage purposes. All data that we store about you (such as content or information about you) will remain stored until you object.

Cookie Consent Management Platform Introduction

Cookie Consent Management Platform Summary? Data subjects: Website visitors

? Purpose: Obtaining and managing consent to certain cookies and thus the use of certain tools

? Processed data: Data for managing cookie settings, such as IP address, time of consent, type of consent, individual consents. More details can be found in the tool used.

? Storage period: Depends on the tool used, but you should expect periods of several years

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is a cookie consent management platform?

We use consent management platform (CMP) software on our website, which makes it easier for us and you to handle scripts and cookies correctly and securely. The software automatically creates a cookie pop-up, scans and checks all scripts and cookies, provides you with the cookie consent required by data protection law, and helps us and you keep track of all cookies. Most cookie consent management tools identify and categorize all existing cookies. As a website visitor, you then decide for yourself whether and which scripts and cookies you allow or do not allow. The following graphic illustrates the relationship between the browser, web server, and CMP.

Why do we use a cookie management tool?

Our goal is to offer you the best possible transparency in the area of data protection. We are also legally obligated to do so. We want to inform you as best we can about all tools and cookies that can store and process your data. It is also your right to decide for yourself which cookies you accept and which you do not. In order to grant you this right, we first need to know exactly which cookies have landed on our website. Thanks to a cookie management tool that regularly scans the website for all existing cookies, we know about all cookies and can provide you with information about them in accordance with the GDPR. You can then accept or reject cookies via the consent system.

What data is processed?

Our cookie management tool allows you to manage each individual cookie yourself and gives you complete control over the storage and processing of your data. Your consent is stored so that we do not have to ask you for it every time you visit our website and so that we can prove your consent if required by law. This is stored either in an opt-in cookie or on a server. The storage period for your cookie consent varies depending on the provider of the cookie management tool. In most cases, this data (such as pseudonymous user ID, time of consent, details of cookie categories or tools, browser, device information) is stored for up to two years.

Duration of data processing

We will inform you about the duration of data processing below, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. Data stored in cookies is stored for varying lengths of time. Some cookies are deleted as soon as you leave the website, while others may remain stored in your browser for several years. The exact duration of data processing depends on the tool used, but in most cases you should expect a storage period of several years. The respective privacy policies of the individual providers usually provide detailed information about the duration of data processing.

Right to object

You also have the right and the option to revoke your consent to the use of cookies at any time. You can do this either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating, or deleting cookies in your browser.

Information on specific cookie management tools, if available, can be found in the following sections.

Legal basis

If you agree to cookies, your personal data will be processed and stored via these cookies. If we are permitted to use cookies based on your consent (Article 6(1)(a) GDPR), this consent also constitutes the legal basis for the use of cookies and the processing of your data. Cookie consent management platform software is used to manage consent to cookies and to enable you to give your consent. The use of this software enables us to operate the website in an efficient and legally compliant manner, which constitutes a legitimate interest (Article 6(1)(f) GDPR).

BorlabsCookie Privacy Policy

We use BorlabsCookie on our website, which is, among other things, a tool for storing your cookie consent. The service provider is the German company Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg, Germany.

You can find out more about the data processed through the use of BorlabsCookie in the privacy policy at

https://de.borlabs.io/datenschutz/.

Security & Anti-Spam

Security & Anti-Spam Privacy Policy Summary? Data subjects: Visitors to the website

? Purpose: Cybersecurity

? Processed data: Data such as your IP address, name, or technical data such as browser version

More details can be found below and in the individual privacy policy texts.

? Storage period: In most cases, the data is stored until it is no longer needed to fulfill the service.

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is security and anti-spam software?

Security and anti-spam software protects you and us from various spam or phishing emails and other possible cyberattacks. Spam refers to unsolicited advertising emails sent in bulk. Such emails are also known as junk mail and can incur costs. Phishing emails, on the other hand, are messages that aim to build trust through fake messages or websites in order to obtain personal data. Anti-spam software usually protects against unwanted spam messages or malicious emails that could introduce viruses into our system. We also use general firewall and security systems that protect our computers from unwanted network attacks.

Why do we use security and anti-spam software?

We place particular emphasis on security on our website. After all, it’s not just about our security, but above all about yours. Unfortunately, cyber threats are now part of everyday life in the world of IT and the internet. Hackers often use cyber attacks to try to steal personal data from IT systems. That’s why a good defense system is absolutely essential. A security system monitors all incoming and outgoing connections to our network and computers. In order to achieve even greater security against cyber attacks, we use additional external security services in addition to the standardized security systems on our computers. This better prevents unauthorized data traffic and protects us from cybercrime.

What data is processed by security and anti-spam software?

The exact data that is collected and stored depends, of course, on the respective service. However, we always endeavor to use only programs that collect data very sparingly or only store data that is necessary for the performance of the service offered. In principle, the service may store data such as name, address, IP address, email address, and technical data such as browser type or browser version. Performance and log data may also be collected in order to detect potential incoming threats in a timely manner. This data is processed within the scope of the services and in compliance with applicable laws. This also includes the GDPR for US providers (via the standard contractual clauses). In some cases, these security services also work with third-party providers who may store and/or process data under instruction and in accordance with data protection guidelines and other security measures. Data storage is usually carried out via cookies.

Duration of data processing

We will inform you about the duration of data processing below, provided we have further information on this. For example, security programs store data until you or we revoke the data storage. In general, personal data is only stored for as long as is absolutely necessary for the provision of services. In many cases, unfortunately, we do not have precise information from the providers about the length of storage.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party security software at any time. You can do this either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating, or deleting cookies in your browser.

Since cookies may also be used for such security services, we recommend that you read our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal basis

We use security services primarily on the basis of our legitimate interests (Art. 6 (1) (f) GDPR) in a good security system against various cyber attacks.

Certain processing operations, in particular the use of cookies and security functions, require your consent. If you have consented to your data being processed and stored by integrated security services, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR). Most of the services we use set cookies in your browser to store data. We therefore recommend that you read our privacy policy on cookies carefully and review the privacy policy or cookie policy of the respective service provider.

Information on specific tools, if available, can be found in the following sections.

Google reCAPTCHA Privacy Policy

Google reCAPTCHA Privacy Policy Summary

? Data subjects: Visitors to the website

? Purpose: Optimization of our services and protection against cyber attacks

You can find more details below in this privacy policy.

? Storage period: Depends on the stored data

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is reCAPTCHA?

Our primary goal is to secure and protect our website for you and for us in the best possible way. To ensure this, we use Google reCAPTCHA from Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. With reCAPTCHA, we can determine whether you are a real person and not a robot or other spam software. By spam, we mean any unsolicited information that reaches us electronically. With classic CAPTCHAS, you usually had to solve text or image puzzles for verification. With Google’s reCAPTCHA, we usually don’t have to bother you with such puzzles. In most cases, all you have to do is check a box to confirm that you are not a bot. With the new Invisible reCAPTCHA version, you don’t even have to check a box. You can find out exactly how this works and, above all, what data is used for this purpose in the course of this privacy policy.

reCAPTCHA is a free captcha service from Google that protects websites from spam software and abuse by non-human visitors. This service is most commonly used when you fill out forms on the internet. A captcha service is a type of automatic Turing test designed to ensure that an action on the internet is performed by a human and not a bot. In the classic Turing test (named after computer scientist Alan Turing), a human determines the difference between a bot and a human. With captchas, this is also done by a computer or software program. Classic captchas work with small tasks that are easy for humans to solve but pose considerable difficulties for machines. With reCAPTCHA, you no longer have to actively solve puzzles. The tool uses modern risk techniques to distinguish humans from bots. All you have to do is check the “I am not a robot” text box, or in the case of Invisible reCAPTCHA, even that is no longer necessary. With reCAPTCHA, a JavaScript element is embedded in the source code and the tool then runs in the background and analyzes your user behavior. The software calculates a so-called captcha score from these user actions. Google uses this score to calculate the probability that you are a human even before you enter the captcha. reCAPTCHA and captchas in general are always used when bots could manipulate or abuse certain actions (such as registrations, surveys, etc.).

Why do we use reCAPTCHA on our website?

We only want to welcome real people to our site. Bots or spam software of any kind are welcome to stay at home. That’s why we do everything we can to protect ourselves and offer you the best possible user experience. For this reason, we use Google reCAPTCHA from Google. This allows us to be fairly certain that we remain a “bot-free” website. When you use reCAPTCHA, data is sent to Google to determine whether you are actually a human. reCAPTCHA therefore serves to ensure the security of our website and, consequently, your security as well. Without reCAPTCHA, for example, a bot could register as many email addresses as possible during registration in order to subsequently “spam” forums or blogs with unwanted advertising content. With reCAPTCHA, we can prevent such bot attacks.

What data is stored by reCAPTCHA?

reCAPTCHA collects personal data from users to determine whether the actions on our website are actually performed by humans. This means that the IP address and other data required by Google for the reCAPTCHA service may be sent to Google. IP addresses are almost always truncated within the member states of the EU or other signatory states to the Agreement on the European Economic Area before the data is sent to a server in the USA. The IP address is not combined with other data from Google unless you are logged into your Google account while using reCAPTCHA. First, the reCAPTCHA algorithm checks whether Google cookies from other Google services (YouTube, Gmail, etc.) are already placed on your browser. ReCAPTCHA then sets an additional cookie in your browser and captures a snapshot of your browser window.

The following list of collected browser and user data is not exhaustive. Rather, these are examples of data that, to our knowledge, is processed by Google.

Referrer URL (the address of the page from which the visitor comes)
IP address (e.g., 256.123.123.1)
Information about the operating system (the software that enables your computer to operate. Well-known operating systems are Windows, Mac OS X, or Linux)
Cookies (small text files that store data in your browser)
Mouse and keyboard behavior (every action you perform with the mouse or keyboard is stored)
Date and language settings (the language and date you have preset on your PC are stored)
All JavaScript objects (JavaScript is a programming language that enables websites to adapt to the user. JavaScript objects can collect all kinds of data under one name)
Screen resolution (shows how many pixels the image display consists of)

It is undisputed that Google uses and analyzes this data even before you click on the “I am not a robot” checkbox. With the Invisible reCAPTCHA version, there is no need to check the box, and the entire recognition process runs in the background. Google does not provide detailed information about exactly how much and what data it stores.

The following cookies are used by reCAPTCHA: We refer to the reCAPTCHA demo version from Google at https://www.google.com/recaptcha/api2/demo. All of these cookies require a unique identifier for tracking purposes. Here is a list of cookies that Google reCAPTCHA has set on the demo version:

Name: IDE

Value: WqTUmlnmv_qXyi_DGNPLESKnRNrpgXoy1K-pAZtAkMbHI-113075714-8

Purpose: This cookie is set by DoubleClick (also owned by Google) to record and report a user’s actions on the website when interacting with advertisements. This allows the effectiveness of advertising to be measured and appropriate optimization measures to be taken. IDE is stored in browsers under the domain doubleclick.net.

Expiration date: after one year

Name: 1P_JAR

Value: 2019-5-14-12

Purpose: This cookie collects statistics on website usage and measures conversions. A conversion occurs, for example, when a user becomes a buyer. The cookie is also used to display relevant advertisements to users. Furthermore, the cookie can be used to prevent a user from seeing the same ad more than once.

Expiration date: after one month

Name: ANID

Value: U7j1v3dZa1130757140xgZFmiqWppRWKOr

Purpose: We were unable to find out much information about this cookie. Google’s privacy policy mentions the cookie in connection with “advertising cookies” such as “DSID,” “FLC,” “AID,” and “TAID.” ANID is stored under the domain google.com.

Expiration date: after 9 months

Name: CONSENT

Value: YES+AT.de+20150628-20-0

Purpose: This cookie stores the status of a user’s consent to use various Google services. CONSENT also serves security purposes by verifying users, preventing login information fraud, and protecting user data from unauthorized attacks.

Expiration date: after 19 years

Name: NID

Value: 0WmuWqy113075714zILzqV_nmt3sDXwPeM5Q

Purpose: NID is used by Google to tailor advertisements to your Google search. With the help of this cookie, Google “remembers” your most frequently entered search queries or your previous interaction with advertisements. This ensures that you always receive customized advertisements. The cookie contains a unique ID to collect the user’s personal settings for advertising purposes.

Expiration date: after 6 months

Name: DV

Value: gEAABBCjJMXcI0dSAAAANbqc113075714-4

Purpose: This cookie is set as soon as you check the “I am not a robot” box. The cookie is used by Google Analytics for personalized advertising. DV collects information in anonymized form and is also used to differentiate between users.

Expiration date: after 10 minutes

Note: This list cannot claim to be complete, as experience has shown that Google frequently changes its choice of cookies.

How long and where is the data stored?

By inserting reCAPTCHA, your data is transferred to the Google server. Even after repeated inquiries, Google does not clearly state where exactly this data is stored. Without confirmation from Google, it can be assumed that data such as mouse interaction, time spent on the website, or language settings are stored on European or American Google servers. The IP address that your browser transmits to Google is not merged with other Google data from other Google services. However, if you are logged into your Google account while using the reCAPTCHA plug-in, the data will be merged. In this case, Google’s different privacy policy applies.

How can I delete my data or prevent data storage?

If you do not want any data about you and your behavior to be transmitted to Google, you must log out of Google completely and delete all Google cookies before visiting our website or using the reCAPTCHA software. In principle, the data is automatically transmitted to Google as soon as you visit our site. To delete this data, you must contact Google Support at https://support.google.com/?hl=de&tid=113075714.

By using our website, you agree that Google LLC and its representatives may automatically collect, process, and use data.

Please note that when using this tool, your data may also be stored and processed outside the EU. Most third countries (including the US) are considered unsafe under current European data protection law. Data may therefore not simply be transferred to unsafe third countries, stored and processed there, unless there are appropriate safeguards (such as EU standard contractual clauses) between us and the non-European service provider.

Legal basis

If you have consented to the use of Google reCAPTCHA, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur during collection by Google reCAPTCHA.

We also have a legitimate interest in using Google reCAPTCHA to optimize our online service and make it more secure. The corresponding legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use Google reCAPTCHA if you have given your consent.

Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

You can find out more about reCAPTCHA on Google’s web developer page at https://developers.google.com/recaptcha/. Although Google goes into more detail about the technical development of reCAPTCHA here, you will not find any specific information about data storage and data protection issues. A good overview of the basic use of data at Google can be found in the company’s own privacy policy at https://policies.google.com/privacy.

Audio & Video Introduction

Audio & Video Privacy Policy Summary? Affected parties: Visitors to the website

? Purpose: Optimization of our services

? Processed data: Data such as contact details, user behavior data, information about your device, and your IP address may be stored.

You can find more details below in the relevant privacy policy texts.

? Storage period: Data is generally stored for as long as it is necessary for the purpose of the service.

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What are audio and video elements?

We have integrated audio and video elements into our website so that you can watch videos or listen to music/podcasts directly via our website. The content is provided by service providers. All content is therefore also obtained from the providers’ respective servers.

These are integrated functional elements from platforms such as YouTube, Vimeo, or Spotify. The use of these portals is usually free of charge, but paid content may also be published. With the help of these integrated elements, you can listen to or view the respective content via our website.

When you use audio or video elements on our website, your personal data may also be transmitted to the service providers, processed, and stored.

Why do we use audio and video elements on our website?

Of course, we want to provide you with the best possible experience on our website. And we are aware that content is no longer conveyed solely through text and static images. Instead of simply providing you with a link to a video, we offer audio and video formats directly on our website that are entertaining or informative, and ideally both. This expands our service and makes it easier for you to access interesting content. In addition to our texts and images, we also offer video and/or audio content.

What data is stored by audio and video elements?

When you visit a page on our website that has an embedded video, for example, your server connects to the service provider’s server. In the process, your data is also transferred to the third-party provider and stored there. Some data is collected and stored regardless of whether you have an account with the third-party provider or not. This usually includes your IP address, browser type, operating system, and other general information about your device. In addition, most providers also collect information about your web activity. This includes, for example, session duration, bounce rate, which buttons you clicked on, or which website you used to access the service. All this information is usually stored via cookies or pixel tags (also known as web beacons). Pseudonymized data is usually stored in cookies in your browser. You can always find out exactly which data is stored and processed in the privacy policy of the respective provider.

Duration of data processing

You can find out exactly how long the data is stored on the servers of third-party providers either further down in the privacy policy of the respective tool or in the provider’s privacy policy. As a matter of principle, personal data is only ever processed for as long as is absolutely necessary for the provision of our services or products. This also applies to third-party providers as a rule. In most cases, you can assume that certain data will be stored on the servers of third-party providers for several years. Data can be stored for different lengths of time, especially in cookies. Some cookies are deleted as soon as you leave the website, while others may remain stored in your browser for several years.

Right to object

Since cookies are usually also used by the integrated audio and video functions on our site, you should also read our general privacy policy on cookies. You can find out more about how your data is handled and stored in the privacy policies of the respective third-party providers.

Legal basis

If you have consented to your data being processed and stored by integrated audio and video elements, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR) . In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the integrated audio and video elements if you have given your consent.

YouTube Privacy Policy

YouTube Privacy Policy Summary

? Data subjects: Visitors to the website

You can find more details below in this privacy policy.

? Storage period: Data is generally stored for as long as it is necessary for the purpose of the service.

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is YouTube?

We have integrated YouTube videos into our website. This allows us to present interesting videos directly on our site. YouTube is a video portal that has been a subsidiary of Google since 2006. The video portal is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

When you visit a page on our website that has a YouTube video embedded in it, your browser automatically connects to the YouTube or Google servers. Various data is transferred (depending on your settings). Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all data processing in the European area.

In the following, we would like to explain in more detail what data is processed, why we have integrated YouTube videos, and how you can manage or delete your data.

On YouTube, users can watch, rate, comment on, and upload videos free of charge. Over the last few years, YouTube has become one of the most important social media channels worldwide. To enable us to display videos on our website, YouTube provides a code snippet that we have incorporated into our site.

Why do we use YouTube videos on our website?

YouTube is the video platform with the most visitors and the best content. We strive to offer you the best possible user experience on our website. And, of course, interesting videos are a must. With the help of our embedded videos, we provide you with additional helpful content alongside our texts and images. In addition, our website is easier to find on the Google search engine thanks to the embedded videos. Even when we place ads via Google Ads, Google can only show these ads to people who are interested in our offers, thanks to the data it collects.

What data is stored by YouTube?

As soon as you visit one of our pages that has a YouTube video embedded in it, YouTube sets at least one cookie that stores your IP address and our URL. If you are logged into your YouTube account, YouTube can usually assign your interactions on our website to your profile using cookies. This includes data such as session duration, bounce rate, approximate location, technical information such as browser type, screen resolution, or your internet service provider. Other data may include contact details, any reviews, sharing content via social media, or adding to your favorites on YouTube.

If you are not logged into a Google account or YouTube account, Google stores data with a unique identifier linked to your device, browser, or app. This allows your preferred language setting to be retained, for example. However, much interaction data cannot be stored because fewer cookies are set.

The following list shows cookies that were set in a browser test. On the one hand, we show cookies that are set without a logged-in YouTube account. On the other hand, we show cookies that are set with a logged-in account. The list cannot claim to be complete because user data always depends on interactions on YouTube.

Name: YSC

Value: b9-CV6ojI5Y113075714-1

Purpose: This cookie registers a unique ID to store statistics about the video you have watched.

Expiration date: after the end of the session

Name: PREF

Value: f1=50000000

Purpose: This cookie also registers your unique ID. Google uses PREF to obtain statistics about how you use YouTube videos on our website.

Expiration date: after 8 months

Name: GPS

Value: 1

Purpose: This cookie registers your unique ID on mobile devices to track your GPS location.

Expiration date: after 30 minutes

Name: VISITOR_INFO1_LIVE

Value: 95Chz8bagyU

Purpose: This cookie attempts to estimate the user’s bandwidth on our websites (with embedded YouTube videos).

Expiration date: after 8 months

Additional cookies that are set when you are logged in with your YouTube account:

Name: APISID

Value: zILlvClZSkqGsSwI/AU1aZI6HY7113075714-

Purpose: This cookie is used to create a profile of your interests. The data is used for personalized advertising.

Expiration date: after 2 years

Name: CONSENT

Value: YES+AT.de+20150628-20-0

Purpose: This cookie stores the status of a user’s consent to use various Google services. CONSENT also serves security purposes by verifying users and protecting user data from unauthorized attacks.

Expiration date: after 19 years

Name: HSID

Value: AcRwpgUik9Dveht0I

Purpose: This cookie is used to create a profile of your interests. This data helps to display personalized advertising.

Expiration date: after 2 years

Name: LOGIN_INFO

Value: AFmmF2swRQIhALl6aL…

Purpose: This cookie stores information about your login details.

Expiration date: after 2 years

Name: SAPISID

Value: 7oaPxoG-pZsJuuF5/AnUdDUIsJ9iJz2vdM

Purpose: This cookie works by uniquely identifying your browser and device. It is used to create a profile of your interests.

Expiration date: after 2 years

Name: SID

Value: oQfNKjAsI113075714-

Purpose: This cookie stores your Google account ID and your last login time in digitally signed and encrypted form.

Expiration date: after 2 years

Name: SIDCC

Value: AN0-TYuqub2JOcDTyL

Purpose: This cookie stores information about how you use the website and what advertisements you may have seen before visiting our site.

Expiration date: after 3 months

How long and where is the data stored?

The data that YouTube receives and processes from you is stored on Google servers. Most of these servers are located in America. At https://datacenters.google/, you can see exactly where the Google data centers are located. Your data is distributed across the servers. This makes the data faster to retrieve and better protected against manipulation.

Google stores the collected data for varying lengths of time. Some data can be deleted at any time, some is automatically deleted after a limited period of time, and some is stored by Google for a longer period of time. Some data (such as items from “My Activity,” photos or documents, products) stored in your Google account will remain stored until you delete it. Even if you are not signed in to a Google account, you can delete some data associated with your device, browser, or app.

How can I delete my data or prevent data storage?

In principle, you can delete data in your Google account manually. With the automatic deletion function for location and activity data introduced in 2019, information is stored for either 3 or 18 months, depending on your decision, and then deleted.

Regardless of whether you have a Google account or not, you can configure your browser to delete or disable Google cookies. Depending on which browser you use, this works in different ways. Under the “Cookies” section, you will find the corresponding links to the respective instructions for the most popular browsers.

If you do not want to have cookies at all, you can set your browser to always inform you when a cookie is to be set. This allows you to decide whether to allow each individual cookie or not.

Legal basis

If you have consented to your data being processed and stored by integrated YouTube elements, this consent serves as the legal basis for data processing (Art. 6 (1) (a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the integrated YouTube elements if you have given your consent. YouTube also sets cookies in your browser to store data.

We therefore recommend that you read our privacy policy on cookies carefully and review the privacy policy or cookie policy of the respective service provider. YouTube also processes your data in the USA, among other places. YouTube and Google are active participants in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA.

You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Google also uses standard contractual clauses (SCCs) (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the US). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

Since YouTube is a subsidiary of Google, there is a joint privacy policy. If you would like to learn more about how your data is handled, we recommend reading the privacy policy at https://policies.google.com/privacy?hl=de.

YouTube Subscribe button Privacy policy

We have integrated the YouTube Subscribe button into our website. You can usually recognize the button by the classic YouTube logo. The logo shows the words “Subscribe” or ‘YouTube’ in white lettering on a red background, with the white “play” symbol to the left. However, the button may also have a different design.

Our YouTube channel offers you a constant stream of funny, interesting, or exciting videos. With the integrated “Subscribe” button, you can subscribe to our channel directly from our website without having to visit the YouTube website. We want to make it as easy as possible for you to access our comprehensive content. Please note that YouTube may store and process your data as a result.

When you see a built-in subscribe button on our site, YouTube sets at least one cookie, according to Google. This cookie stores your IP address and our URL. YouTube can also obtain information about your browser, your approximate location, and your default language. In our test, the following four cookies were set without being logged in to YouTube:

Name: YSC

Value: b9-CV6ojI5113075714Y

Purpose: This cookie registers a unique ID to store statistics about the video you have watched.

Expiration date: after the end of the session

Name: PREF

Value: f1=50000000

Purpose: This cookie also registers your unique ID. Google receives statistics via PREF on how you use YouTube videos on our website.

Expiration date: after 8 months

Name: GPS

Value: 1

Purpose: This cookie registers your unique ID on mobile devices to track your GPS location.

Expiration date: after 30 minutes

Name: VISITOR_INFO1_LIVE

Value: 11307571495Chz8bagyU

Purpose: This cookie attempts to estimate the user’s bandwidth on our websites (with embedded YouTube videos).

Expiration date: after 8 months

Note: These cookies were set after a test and cannot claim to be complete.

If you are logged into your YouTube account, YouTube can store many of your actions/interactions on our website using cookies and assign them to your YouTube account. This provides YouTube with information such as how long you surf our site, what type of browser you use, what screen resolution you prefer, or what actions you perform.

YouTube uses this data to improve its own services and offerings, as well as to provide analyses and statistics for advertisers (who use Google Ads).

Web design Introduction

Web design Privacy policy Summary? Affected parties: Visitors to the website

? Purpose: To improve the user experience

? Processed data: The data processed depends heavily on the services used. In most cases, this includes the IP address, technical data, language settings, browser version, screen resolution, and browser name. You can find more details on this in the respective web design tools used.

? Storage period: Depends on the tools used

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is web design?

We use various tools on our website that serve our web design purposes. Contrary to popular belief, web design is not just about making our website look pretty, but also about functionality and performance. But of course, the right look for a website is also one of the main goals of professional web design. Web design is a subfield of media design and deals with the visual, structural, and functional design of a website. The aim of web design is to improve your experience on our website. In web design jargon, this is referred to as user experience (UX) and usability. User experience refers to all the impressions and experiences that a website visitor has on a website. One sub-item of user experience is usability. This refers to the user-friendliness of a website. The main focus here is on ensuring that content, subpages, or products are clearly structured and that you can find what you are looking for quickly and easily. In order to offer you the best possible experience on our website, we also use third-party web design tools. In this privacy policy, the category “web design” therefore includes all services that improve the design of our website. These can be fonts, various plugins, or other integrated web design functions, for example.

Why do we use web design tools?

How you absorb information on a website depends heavily on the structure, functionality, and visual perception of the website. That is why good, professional web design has become increasingly important to us. We are constantly working to improve our website and see this as an extended service for you as a website visitor. Furthermore, an attractive and functional website also has economic advantages for us. After all, you will only visit us and take advantage of our offers if you feel completely at ease.

What data is stored by web design tools?

When you visit our website, web design elements may be integrated into our pages that can also process data. The exact nature of this data depends, of course, heavily on the tools used. Below, you can see exactly which tools we use for our website. For more detailed information about data processing, we recommend that you also read the respective privacy policy of the tools used. In most cases, you will find out what data is processed, whether cookies are used, and how long the data is stored. Fonts such as Google Fonts, for example, also automatically transfer information such as language settings, IP address, browser version, browser screen resolution, and browser name to Google servers.

Duration of data processing

How long data is processed is very individual and depends on the web design elements used. If cookies are used, for example, the storage period can be as short as one minute or as long as a few years. Please inform yourself about this. We recommend that you read our general section on cookies and the privacy policies of the tools used. There you will usually find out exactly which cookies are used and what information is stored in them. Google font files, for example, are stored for one year. This is to improve the loading time of a website. As a matter of principle, data is only stored for as long as is necessary to provide the service. In the case of legal requirements, data may also be stored for longer.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. You can do this either via our cookie management tool or via other opt-out functions. You can also prevent data collection by cookies by managing, deactivating, or deleting cookies in your browser. However, some web design elements (usually fonts) also contain data that cannot be deleted so easily. This is the case when data is automatically collected when a page is accessed and transmitted to a third-party provider (such as Google). In this case, please contact the support team of the relevant provider. In the case of Google, you can reach support at https://support.google.com/?hl=de.

Legal basis

If you have consented to the use of web design tools, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by web design tools. We also have a legitimate interest in improving the web design of our website. After all, this is the only way we can provide you with an attractive and professional website. The corresponding legal basis for this is Art. 6 (1) (f) GDPR (legitimate interests). However, we only use web design tools if you have given your consent. We would like to emphasize this again here.

Information on specific web design tools can be found in the following sections, if available.

Adobe Fonts Privacy Policy

We use Adobe Fonts, a web font hosting service, on our website. The service provider is the American company Adobe Inc. The Irish company Adobe Systems Software Ireland Companies, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, is responsible for the European region.

Adobe also processes your data in the US, among other places. Adobe is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the US. For more information, please visit https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Adobe also uses standard contractual clauses (SCCs) (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the US). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Adobe commits to complying with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

For more information on Adobe’s standard contractual clauses, please visit https://www.adobe.com/at/privacy/eudatatransfers.html.

You can find out more about the data processed through the use of Adobe Fonts in the privacy policy at https://www.adobe.com/at/privacy.html

Font Awesome Privacy Policy

Font Awesome Privacy Policy Summary? Data subjects: Website visitors

? Purpose: Optimization of our services

? Processed data: IP address and which icon files are loaded

More details can be found further down in this privacy policy.

? Storage period: Files in identifiable form are stored for a few weeks

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is Font Awesome?

We use Font Awesome from the American company Fonticons (307 S. Main St., Suite 202, Bentonville, AR 72712, USA) on our website. When you visit one of our web pages, the Font Awesome web font (specifically icons) is loaded via the Font Awesome Content Delivery Network (CDN). This ensures that the text, fonts, and icons are displayed correctly on every device. In this privacy policy, we go into more detail about data storage and data processing by this service.

Icons are playing an increasingly important role for websites. Font Awesome is a web font that was developed specifically for web designers and web developers. With Font Awesome, icons can be scaled and colored as desired using the CSS stylesheet language. They thus replace old image icons. Font Awesome CDN is the easiest way to load the icons or fonts onto your website. To do this, we only had to embed a small line of code into our website.

Why do we use Font Awesome on our website?

Font Awesome allows us to better present content on our website. This makes it easier for you to navigate our website and understand the content. The icons can even replace entire words in some cases, saving space. This is particularly useful when we optimize content specifically for smartphones. These icons are inserted as HTML code instead of images. This allows us to edit the icons with CSS exactly as we want. At the same time, Font Awesome also improves our loading speed because it only uses HTML elements and not icon images. All these advantages help us to make the website even clearer, fresher, and faster for you.

What data is stored by Font Awesome?

The Font Awesome Content Delivery Network (CDN) is used to load icons and symbols. CDNs are networks of servers distributed worldwide that make it possible to quickly load files from nearby. This means that as soon as you visit one of our pages, the corresponding icons are provided by Font Awesome.

In order for the web fonts to be loaded, your browser must connect to the servers of Fonticons, Inc. Your IP address is recognized in the process. Font Awesome also collects data about which icon files are downloaded and when. Technical data such as your browser version, screen resolution, or the time the page was accessed is also transmitted.

This data is collected and stored for the following reasons:

to optimize content delivery networks
to detect and fix technical errors
to protect CDNs from misuse and attacks
to be able to charge fees to Font Awesome Pro customers
to find out the popularity of icons
to know which computer and software you are using

If your browser does not support web fonts, a standard font from your PC will be used automatically. To the best of our knowledge, no cookies are set. We are in contact with Font Awesome’s data protection department and will let you know as soon as we find out more.

How long and where is the data stored?

Font Awesome stores data about the use of the content delivery network on servers in the United States of America. However, the CDN servers are located worldwide and store user data wherever you are located. In identifiable form, the data is usually only stored for a few weeks. Aggregated statistics on the use of the CDNs may also be stored for longer. Personal data is not included here.

How can I delete my data or prevent data storage?

To the best of our knowledge, Font Awesome does not store any personal data via the content delivery networks. If you do not want data about the icons used to be stored, you will unfortunately not be able to visit our website. If your browser does not allow web fonts, no data will be transferred or stored. In this case, your computer’s default font will simply be used.

Legal basis

If you have consented to the use of Font Awesome, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when it is collected by Font Awesome.

We also have a legitimate interest in using Font Awesome to optimize our online service. The corresponding legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use Font Awesome if you have given your consent.

We would like to point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. Data processing is mainly carried out by Font Awesome. This may mean that data is not processed and stored anonymously. Furthermore, US government authorities may have access to individual data.

It may also happen that this data is linked to data from other Font Awesome services for which you have a user account.

If you would like to learn more about Font Awesome and how it handles data, we recommend reading the privacy policy at https://fontawesome.com/privacy and the help page at https://fontawesome.com/support.Google Fonts Privacy PolicyGoogle Fonts Privacy Policy Summary? Affected persons: Visitors to the website? Purpose: Optimization of our services? Processed data: Data such as IP address and CSS and font requestsMore details can be found further down in this privacy policy.? Storage period: Font files are stored by Google for one year⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)What are Google Fonts?We use Google Fonts on our website. These are the “Google fonts” from Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.You do not need to register or enter a password to use Google fonts. Furthermore, no cookies are stored in your browser. The files (CSS, fonts) are requested via the Google domains fonts.googleapis.com and fonts.gstatic.com. According to Google, requests for CSS and fonts are completely separate from all other Google services. If you have a Google account, you do not need to worry that your Google account data will be transmitted to Google while using Google Fonts. Google collects data on the use of CSS (Cascading Style Sheets) and the fonts used and stores this data securely. We will take a closer look at exactly how the data is stored later on.Google Fonts (formerly Google Web Fonts) is a directory of over 800 fonts that Google makes available to its users free of charge.Many of these fonts are published under the SIL Open Font License, while others are published under the Apache License. Both are free software licenses.Why do we use Google Fonts on our website?With Google Fonts, we can use fonts on our own website without having to upload them to our own server. Google Fonts is an important component in maintaining the high quality of our website. All Google fonts are automatically optimized for the web, which saves data volume and is a big advantage, especially for use on mobile devices. When you visit our site, the low file size ensures fast loading times. Furthermore, Google Fonts are secure web fonts. Different image synthesis systems (rendering) in different browsers, operating systems, and mobile devices can lead to errors. Such errors can sometimes distort text or entire web pages visually. Thanks to the fast Content Delivery Network (CDN), there are no cross-platform issues with Google Fonts. Google Fonts supports all popular browsers (Google Chrome, Mozilla Firefox, Apple Safari, Opera) and works reliably on most modern mobile operating systems, including Android 2.2+ and iOS 4.2+ (iPhone, iPad, iPod). We use Google Fonts so that we can present our entire online service as beautifully and uniformly as possible.What data is stored by Google?When you visit our website, the fonts are downloaded via a Google server. This external call transmits data to the Google servers. This also allows Google to recognize that you or your IP address has visited our website. The Google Fonts API was developed to reduce the use, storage, and collection of end-user data to what is necessary for the proper provision of fonts. API stands for “Application Programming Interface” and serves, among other things, as a data transmitter in the software sector.Google Fonts stores CSS and font requests securely with Google and is therefore protected. Google can use the usage statistics it collects to determine how well individual fonts are received. Google publishes the results on internal analysis pages, such as Google Analytics. Google also uses data from its own web crawler to determine which websites use Google fonts. This data is published in the Google Fonts BigQuery database. Entrepreneurs and developers use the Google web service BigQuery to examine and move large amounts of data.However, it should be noted that every Google Font request automatically transmits information such as language settings, IP address, browser version, browser screen resolution, and browser name to Google’s servers. It is not clear whether this data is also stored, and Google does not communicate this clearly.How long and where is the data stored?Google stores requests for CSS assets on its servers, which are mainly located outside the EU, for one day. This allows us to use the fonts with the help of a Google stylesheet. A stylesheet is a format template that can be used to quickly and easily change the design or font of a website, for example.The font files are stored by Google for one year. Google’s goal is to improve the loading time of websites. When millions of websites refer to the same fonts, they are cached after the first visit and immediately reappear on all other websites visited later. Google sometimes updates font files to reduce file size, increase language coverage, and improve design.How can I delete my data or prevent data storage?The data that Google stores for one day or one year cannot simply be deleted. The data is automatically transmitted to Google when the page is accessed. To delete this data prematurely, you must contact Google Support at https://support.google.com/?hl=de&tid=113075714. In this case, you can only prevent data storage by not visiting our site.Unlike other web fonts, Google allows us unrestricted access to all fonts. This means we have unlimited access to a sea of fonts, allowing us to get the most out of our website. You can find more information about Google Fonts and other questions at https://developers.google.com/fonts/faq?tid=113075714. Although Google addresses data protection issues there, it does not provide detailed information about data storage. It is relatively difficult to obtain precise information about stored data from Google.Legal basisIf you have consented to the use of Google Fonts, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by Google Fonts.

We also have a legitimate interest in using Google Fonts to optimize our online service. The corresponding legal basis for this is Art. 6 (1) (f) GDPR (legitimate interests). However, we only use Google Fonts if you have given your consent.

In addition, Google uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the US). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

You can also read about what data Google generally collects and what this data is used for at https://www.google.com/intl/de/policies/privacy/.

Google Fonts Local Privacy Policy

We use Google Fonts from Google Inc. on our website. Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for the European region. We have integrated the Google fonts locally, i.e. on our web server – not on Google’s servers. This means that there is no connection to Google servers and therefore no data transfer or storage.

What are Google Fonts?

Google Fonts used to be called Google Web Fonts. It is an interactive directory with over 800 fonts that Google provides free of charge. Google Fonts allows you to use fonts without uploading them to your own server. However, in order to prevent any transfer of information to Google servers, we have downloaded the fonts to our server. In this way, we comply with data protection regulations and do not forward any data to Google Fonts.

Online map services Introduction

Online map services Privacy policy Summary

? Purpose: To improve the user experience

? Processed data: The data processed depends heavily on the services used. In most cases, this includes IP address, location data, search items, and/or technical data. You can find more details on this in the respective tools used.

? Storage period: Depends on the tools used

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What are online map services?

We also use online map services as an extended service for our website. Google Maps is probably the service you are most familiar with, but there are also other providers that specialize in creating digital maps. Such services enable locations, route plans, or other geographical information to be displayed directly on our website. With an integrated map service, you no longer have to leave our website to view the route to a location, for example. To ensure that the online map on our website works, map sections are integrated using HTML code. The services can then display road maps, the earth’s surface, or aerial or satellite images. When you use the built-in map service, data is also transferred to the tool used and stored there. This data may also include personal data.

Why do we use online map services on our website?

Generally speaking, our aim is to make your time on our website as pleasant as possible. And of course, your time will only be pleasant if you can easily find your way around our website and find all the information you need quickly and easily. That’s why we thought an online map system could significantly optimize our website service. Without leaving our website, you can easily view route descriptions, locations, and even points of interest with the help of the map system. It is also very convenient that you can see at a glance where our company is located, so you can find us quickly and easily. As you can see, there are many advantages, and we clearly consider online map services on our website to be part of our customer service.

What data is stored by online map services?

When you open a page on our website that has an online map function, personal data may be transmitted to the respective service and stored there. In most cases, this is your IP address, which can also be used to determine your approximate location. In addition to your IP address, data such as search terms entered and longitude and latitude coordinates are also stored. If you enter an address for route planning, for example, this data is also stored. The data is not stored by us, but on the servers of the integrated tools. You can think of it like this: you are on our website, but when you interact with a map service, this interaction actually takes place on their website. To ensure that the service works properly, at least one cookie is usually set in your browser. Google Maps, for example, also uses cookies to record user behavior in order to optimize its own service and display personalized advertising. You can find out more about cookies in our “Cookies” section.

How long and where is the data stored?

Each online map service processes different user data. If we have further information, we will inform you about the duration of data processing below in the relevant sections on the individual tools. As a general rule, personal data is only stored for as long as is necessary to provide the service. Google Maps, for example, stores certain data for a specified period of time, while other data must be deleted by you. Mapbox, for example, stores your IP address for 30 days and then deletes it. As you can see, each tool stores data for different lengths of time. We therefore recommend that you carefully review the privacy policies of the tools used.

The providers also use cookies to store data about your user behavior with the map service. You can find more general information about cookies in our “Cookies” section, but you can also find out which cookies may be used in the privacy policies of the individual providers. In most cases, however, this is only an illustrative list and is not complete.

Right to object

You always have the option and the right to access your personal data and to object to its use and processing. You can also revoke your consent at any time. The easiest way to do this is usually via the cookie consent tool. However, there are also other opt-out tools that you can use. You can also manage, delete, or deactivate cookies set by the providers used with just a few clicks of the mouse. However, this may mean that some functions of the service no longer work as usual. How you manage cookies in your browser depends on the browser you are using. In the “Cookies” section, you will also find links to instructions for the most important browsers.

Legal basis

If you have consented to the use of an online map service, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by an online map service.

We also have a legitimate interest in using an online map service to optimize our service on our website. The corresponding legal basis for this is Art. 6 (1) (f) GDPR (legitimate interests). However, we only use an online map service if you have given your consent. We would like to emphasize this point once again at this juncture.

Information on specific online map services can be found in the following sections, if available.

Google Maps Privacy Policy

Google Maps Privacy Policy Summary ? Data subjects: Website visitors

? Purpose: Optimization of our services

? Processed data: Data such as search terms entered, your IP address, and latitude and longitude coordinates.

More details can be found further down in this privacy policy.

? Storage period: Depends on the data stored

⚖️ Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)

What is Google Maps?

We use Google Maps from Google Inc. on our website. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Maps allows us to show you locations more effectively and thus tailor our service to your needs. When you use Google Maps, data is transferred to Google and stored on Google’s servers. Here we would like to explain in more detail what Google Maps is, why we use this Google service, what data is stored, and how you can prevent this.

Google Maps is an internet map service provided by Google. With Google Maps, you can search for the exact locations of cities, landmarks, accommodations, or businesses online via a PC, tablet, or app. If businesses are listed on Google My Business, additional information about the company is displayed alongside the location. To show how to get there, map sections of a location can be embedded in a website using HTML code. Google Maps displays the Earth’s surface as a road map or as an aerial or satellite image. Thanks to Street View images and high-quality satellite images, very accurate representations are possible.

Why do we use Google Maps on our website?

All our efforts on this page are aimed at providing you with a useful and meaningful experience on our website. By integrating Google Maps, we can provide you with the most important information about various locations. You can see at a glance where our company is based. The directions always show you the best or fastest way to get to us. You can call up directions for routes by car, public transport, on foot, or by bike. For us, providing Google Maps is part of our customer service.

What data is stored by Google Maps?

In order for Google Maps to offer its full range of services, the company must collect and store data from you. This includes the search terms you enter, your IP address, and your latitude and longitude coordinates. If you use the route planner function, the starting address you enter is also stored. However, this data is stored on the Google Maps website. We can only inform you about this, but we cannot influence it. Since we have integrated Google Maps into our website, Google sets at least one cookie (name: NID) in your browser. This cookie stores data about your user behavior. Google primarily uses this data to optimize its own services and to provide you with individual, personalized advertising.

The following cookie is set in your browser due to the integration of Google Maps:

Name: NID

Value: 188=h26c1Ktha7fCQTx8rXgLyATyITJ113075714-5

Purpose: NID is used by Google to tailor advertisements to your Google search. With the help of the cookie, Google “remembers” your most frequently entered search queries or your previous interaction with advertisements. This ensures that you always receive customized advertisements. The cookie contains a unique ID that Google uses to collect your personal settings for advertising purposes.

Expiration date: after 6 months

Note: We cannot guarantee the completeness of the information provided about the stored data. Changes can never be ruled out, especially when cookies are used. To identify the NID cookie, a separate test page was created that only included Google Maps.

How long and where is the data stored?

Google’s servers are located in data centers around the world. However, most servers are located in America. For this reason, your data is increasingly stored in the USA. You can find out exactly where Google’s data centers are located here: https://datacenters.google/

Google distributes the data across various data carriers. This makes the data more quickly accessible and better protected against any attempts at manipulation. Each data center also has special emergency programs. For example, if there are problems with Google’s hardware or a natural disaster cripples the servers, the data remains fairly secure and protected.

Google stores some data for a specified period of time. For other data, Google only offers the option of deleting it manually. The company also anonymizes information (such as advertising data) in server logs by deleting part of the IP address and cookie information after 9 or 18 months.

How can I delete my data or prevent data storage?

With the automatic deletion feature for location and activity data introduced in 2019, information about your location and web/app activity is stored for either 3 or 18 months, depending on your decision, and then deleted. You can also manually delete this data from your history at any time via your Google account. If you want to completely prevent your location from being tracked, you must pause the “Web & App Activity” section in your Google account. Click on “Data & personalization” and then on the “Activity settings” option. Here you can turn activities on or off.

You can also disable, delete, or manage individual cookies in your browser. Depending on which browser you use, this works slightly differently. Under the “Cookies” section, you will find the corresponding links to the respective instructions for the most popular browsers.

If you do not want to have any cookies at all, you can set your browser to always inform you when a cookie is to be set. This allows you to decide whether to allow or reject each individual cookie.

Legal basis

If you have consented to the use of Google Maps, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when data is collected by Google Maps.

We also have a legitimate interest in using Google Maps to optimize our online service. The corresponding legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use Google Maps if you have given your consent.

Google also uses standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the US). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

If you would like to learn more about Google’s data processing, we recommend reading the company’s own privacy policy at https://policies.google.com/privacy?hl=de.

Explanation of terms used

We always strive to make our privacy policy as clear and understandable as possible. However, this is not always easy, especially when it comes to technical and legal issues. It often makes sense to use legal terms (such as personal data) or certain technical terms (such as cookies, IP address). However, we do not want to use them without explanation. Below you will find an alphabetical list of important terms used that we may not have covered sufficiently in the previous privacy policy. If these terms are taken from the GDPR and are definitions, we will also cite the GDPR texts here and add our own explanations where necessary.

Supervisory authority

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the following definitions apply:

“Supervisory authority” means an independent public authority established by a Member State pursuant to Article 51;

Explanation: “Supervisory authorities” are always independent government bodies that also have the power to issue instructions in certain cases. They are responsible for carrying out what is known as state supervision and are located in ministries, special departments, or other authorities. In Austria, data protection is overseen by the Austrian Data Protection Authority, while in Germany, each federal state has its own data protection authority.

Processor

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

“Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data that we process from you. In addition to the controllers, there may also be so-called processors. This includes any company or person who processes personal data on our behalf. Processors can therefore be service providers such as tax advisors, but also hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

File system

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term

“file system” means any structured collection of personal data which are accessible according to specific criteria, whether centralized, decentralized or organized according to functional or geographical criteria;

Explanation: Any organized storage of data on a computer data carrier is referred to as a “file system.” For example, when we store your name and email address on a server for our newsletter, this data is located in a so-called “file system.” The most important tasks of a “file system” include quickly searching for and finding specific data and, of course, storing the data securely.

Third party

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

“third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data;

Explanation: The GDPR basically only explains what a “third party” is not. In practice, any “third party” who also has an interest in the personal data but does not belong to the above-mentioned persons, authorities, or institutions is a third party. For example, a parent company can act as a “third party.” In this case, the subsidiary is the controller and the parent company is the “third party.” However, this does not mean that the parent company is automatically allowed to view, collect, or store the personal data of the subsidiary.

Consent

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the following definitions apply:

“Consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: On websites, such consent is usually given via a cookie consent tool. You are probably familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree to or consent to data processing. In most cases, you can also make individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not give your consent, no personal data about you may be processed. Of course, consent can also be given in writing, i.e., not via a tool.

Health data

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the following definitions apply:

“Health data” means personal data related to the physical or mental health of a natural person, including the provision of health care services, and which reveal information about their health status;

Explanation: Health data therefore includes all stored information relating to your own health. This is often data that is also recorded in a patient file. This includes, for example, which medications you use, X-ray images, your entire medical history, and, as a rule, your vaccination status.

Personal data

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the following definitions apply:

“Personal data”

means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Explanation: Personal data is therefore all data that can identify you as a person. This usually includes data such as:

Name
Address
Email address
Postal address
Phone number
Date of birth
Identification numbers such as social security number, tax identification number, ID card number, or student ID number
Bank details such as account number, credit information, account balances, and much more.

According to the European Court of Justice (ECJ), your IP address is also considered personal data. IT experts can use your IP address to determine at least the approximate location of your device and, subsequently, you as the connection owner. Therefore, storing an IP address also requires a legal basis within the meaning of the GDPR. There are also so-called “special categories” of personal data that are particularly sensitive. These include:

racial and ethnic origin
political opinions
religious or philosophical beliefs
trade union membership
genetic data, such as data taken from blood or saliva samples
biometric data (i.e., information about psychological, physical, or behavioral characteristics that can identify a person).
Health data
Data on sexual orientation or sex life

Profiling

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the following definitions apply:

“Profiling” means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

Explanation: Profiling involves gathering various pieces of information about a person in order to learn more about that person. In the web sector, profiling is often used for advertising purposes or for credit checks. Web and advertising analysis programs, for example, collect data about your behavior and interests on a website. This results in a specific user profile that can be used to target advertising to a specific audience.

Pseudonymization

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

“pseudonymization” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person;

Explanation: Our privacy policy often refers to pseudonymized data. Pseudonymized data means that you can no longer be identified as a person unless other information is added. However, pseudonymization should not be confused with anonymization. Anonymization removes all personal references so that they can only be reconstructed with a disproportionate amount of technical effort.

Controller

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the following definitions apply:

“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Explanation: In our case, we are responsible for the processing of your personal data and are therefore the “controller.” If we pass on collected data to other service providers for processing, they are “processors.” For this purpose, a “processing agreement (PA)” must be signed.

Processing

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

“processing”

means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,

distribution or otherwise making available, alignment or combination, restriction, erasure or destruction;Note: When we refer to processing in our privacy policy, we mean any type of data processing. As mentioned above in the original GDPR declaration, this includes not only the collection but also the storage and processing of data.All texts are protected by copyright.Source: Privacy policy created with the data protection generator for Austria by AdSimple

Follow Us

Search

Privacy Policy

/ JR Atelier Esthétique

Datenschutzerklärung

Table of Contents

Introduction and Overview

Scope of application

Legal basis

Contact details of the controller

Storage period

Rights under the General Data Protection Regulation

Austria Data Protection Authority

Data transfer to third countries

Security of data processing

TLS encryption with https

Communication

Affected persons

Telephone

Email

Online forms

Legal basis

Data processing agreement (DPA)

Who are processors?

Contents of a data processing agreement

Cookies

What are cookies?

What types of cookies are there?

Purpose of processing via cookies

What data is processed?

Storage period of cookies

Right to object – how can I delete cookies?

Legal basis

Web hosting Introduction

What is web hosting?

Why do we process personal data?

What data is processed?

How long is data stored?

Legal basis

Web hosting provider External Privacy policy

Web analytics Introduction

What is web analytics?

Why do we use web analytics?

What data is processed?

Duration of data processing

Right to object

Legal basis

Google Analytics Privacy Policy

What is Google Analytics?

Why do we use Google Analytics on our website?

What data is stored by Google Analytics?

How long and where is the data stored?

How can I delete my data or prevent data storage?

Legal basis

Data Processing Agreement (DPA) Google Analytics

Google Analytics reports on demographic characteristics and interests

Google Analytics in consent mode

Google Analytics IP anonymization

Email marketing Introduction

What is email marketing?

Why do we use email marketing?

What data is processed?

Duration of data processing

Right of objection

Legal basis

Messenger & Communication Introduction

What are messenger and communication functions?

Why do we use messenger and communication functions?

What data is processed?

How long is data stored?

Right to object

Legal basis

Facebook Messenger Privacy Policy

What is Facebook Messenger?

Why do we use Facebook Messenger?

What data is processed by Facebook Messenger?

How long and where is the data stored?

How can I delete my data or prevent data storage?

Legal basis

WhatsApp Privacy Policy