Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to shortly as "data") we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and especially on our websites, mobile applications, and external online presences, such as our social media profiles (hereinafter collectively referred to as the "online offering").

The terms used are not gender-specific.

As of: February 22, 2024

Table of Contents

• Preamble
• Controller
• Overview of Processing
• Relevant Legal Bases
• Security Measures
• Transfer of Personal Data
• International Data Transfers
• Deletion of Data
• Rights of Data Subjects
• Use of Cookies
• Business Services
• Use of Online Platforms for Sales and Distribution
• Provision of the Online Offering and Web Hosting
• Contact and Inquiry Management
• Communication via Messenger
• Video Conferences, Online Meetings, Webinars, and Screen Sharing
• Promotional Communication via Email, Mail, Fax, or Telephone
• Contests and Competitions
• Web Analysis, Monitoring, and Optimization
• Online Marketing
• Customer Reviews and Rating Processes
• Social Media Presence
• Plugins and Embedded Functions and Content
• Modification and Update of the Privacy Policy
• Definitions

Controller

Heuhandel K + K GmbH
Querenburger Str. 40
44789 Bochum
Germany

Email Address: hart@kk-heuhandel.de Phone: 023458875728 Impressum: https://kk-heuhandel.de/de/impressum/

Overview of Processing

The following overview summarizes the types of processed data and the purposes of their processing and refers to the affected individuals.

Types of Processed Data

• Inventory Data.
• Payment Data.
• Contact Data.
• Content Data.
• Contract Data.
• Usage Data.
• Meta, Communication, and Process Data.

Categories of Data Subjects

• Customers.
• Prospects.
• Communication Partners.
• Users.
• Contest and Competition Participants.
• Business and Contract Partners.
• Persons Depicted.

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.
• Contact inquiries and communication.
• Security measures.
• Direct marketing.
• Reach measurement.
• Tracking.
• Office and organizational procedures.
• Conversion measurement.
• Management and response to inquiries.
• Conducting contests and competitions.
• Feedback.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, if more specific legal bases are applicable in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6 (1) (a) GDPR) - The data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6 (1) (b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6 (1) (c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 (1) (f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes in particular the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission, as well as automated decision-making and profiling. Furthermore, data protection laws of the individual federal states may apply.

Relevant legal bases under Swiss data protection law: If you are located in Switzerland, we process your data based on the Federal Data Protection Act (known as "Swiss DSG"). This also applies if our processing of your data otherwise affects you in Switzerland and you are affected by the processing. The Swiss DSG generally does not require (unlike, for example, the GDPR) that a legal basis be specified for the processing of personal data. We process personal data only if the processing is lawful, carried out in good faith, and proportionate (Art. 6 (1) and (2) of the Swiss DSG). Furthermore, we only collect personal data for specific and recognizable purposes and only process it in a way that is compatible with these purposes (Art. 6 (3) of the Swiss DSG).

Note on the applicability of GDPR and Swiss DSG: These data protection notices serve both to provide information under the Swiss Federal Data Protection Act (Swiss DSG) and under the General Data Protection Regulation (GDPR). For this reason, please note that due to broader spatial application and comprehensibility, the terms of the GDPR are used. In particular, instead of the terms used in the Swiss DSG such as "processing" of "personal data," "overriding interest," and "particularly sensitive personal data," the terms used in the GDPR such as "processing" of "personal data," "legitimate interest," and "special categories of data" are used. However, the legal significance of the terms is determined within the scope of the applicability of the Swiss DSG according to the Swiss DSG.

Security Measures

In accordance with legal requirements and taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as the access, input, transmission, securing availability, and separation of data. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data threats. We also consider the protection of personal data during the development or selection of hardware, software, and procedures in accordance with the principle of data protection, through technology design and data protection-friendly settings.

TLS/SSL encryption (https): To protect user data transmitted via our online services, we use TLS/SSL encryption. Secure Sockets Layer (SSL) is the standard technology for securing Internet connections by encrypting the data transmitted between a website or app and a browser (or between two servers). Transport Layer Security (TLS) is an updated and more secure version of SSL. Hyper Text Transfer Protocol Secure (HTTPS) is displayed in the URL when a website is secured by an SSL/TLS certificate.

Transfer of Personal Data

As part of our processing of personal data, it may happen that the data is transferred to other entities, companies, legally independent organizational units, or individuals or disclosed to them. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and in particular conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

Transfer of data within the corporate group: We may transfer personal data to other companies within our corporate group or grant them access to this data. If this transfer is for administrative purposes, the transfer of data is based on our legitimate business and economic interests or takes place if necessary to fulfill our contract-related obligations or if consent of the data subjects or legal permission is available.

International Data Transfers

Data Processing in Third Countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if processing takes place as part of using third-party services or disclosing/transferring data to other individuals, entities, or companies, this only occurs in accordance with legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for data transfer. Otherwise, data transfers only occur if the data protection level is otherwise secured, especially through standard contractual clauses (Art. 46 (2) (c) GDPR), explicit consent, or in the case of contractual or legally required transfers (Art. 49 (1) GDPR). Furthermore, we inform you about the basis of third-country transfers for each provider from the third country, with adequacy decisions being the primary basis. Information on third-country transfers and existing adequacy decisions can be found in the EU Commission's information portal: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called "Data Privacy Framework" (DPF), the EU Commission has also recognized the level of data protection as safe for certain companies from the USA within the framework of the adequacy decision of 10.07.2023. You can find the list of certified companies as well as further information on the DPF on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). We inform you within the privacy notices which service providers certified under the Data Privacy Framework are used by us.

Disclosure of Personal Data Abroad: According to Swiss data protection law (DSG), we only disclose personal data abroad if adequate protection for the data subjects is ensured (Art. 16 Swiss DSG). If the Federal Council has not determined adequate protection (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we implement alternative security measures. These may include international agreements, specific guarantees, data protection clauses in contracts, standard data protection clauses approved by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or internal data protection regulations pre-approved by the FDPIC or a competent data protection authority of another country.

According to Art. 16 of the Swiss DSG, exceptions for the disclosure of data abroad can be permitted if certain conditions are met, including consent of the data subject, contract fulfillment, public interest, protection of life or physical integrity, publicly available data, or data from a legally provided register. These disclosures always comply with legal requirements.

Data Deletion

The data processed by us will be deleted or restricted in processing in accordance with legal requirements as soon as their processing is revoked, or other permissions no longer apply (e.g., if the purpose of processing this data no longer applies or they are not required for the purpose). If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person. In the context of our privacy notices, we may provide users with further information on deletion and retention of data specific to the respective processing processes.

Rights of the Data Subjects

Rights of the Data Subjects under the GDPR: As data subjects, you have various rights under the GDPR, particularly arising from Articles 15 to 21 of the GDPR:

• Right to Object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
• Right to Withdraw Consent: You have the right to withdraw consent given at any time.
• Right to Information: You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and certain additional information.
• Right to Rectification: You have the right to obtain the rectification of inaccurate personal data concerning you.
• Right to Erasure and Restriction of Processing: You have the right to obtain the erasure of personal data concerning you without undue delay or alternatively, the restriction of processing.
• Right to Data Portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format or to transmit those data to another controller.
• Right to Lodge a Complaint with a Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Rights of the Data Subjects under the Swiss DSG:

As data subjects under the Swiss DSG, you have the following rights:

• Right to Information: You have the right to request confirmation as to whether personal data concerning you is being processed and to obtain access to the personal data and certain additional information necessary to exercise your rights under this law and to ensure transparent data processing.
• Right to Data Disclosure or Transfer: You have the right to request the disclosure of your personal data that you have provided to us in a common electronic format.
• Right to Rectification: You have the right to request the correction of inaccurate personal data concerning you.
• Right to Object, Deletion, and Destruction: You have the right to object to the processing of your data and to request the deletion or destruction of personal data concerning you.

Use of Cookies

Cookies are small text files or other storage technologies that store information on devices and retrieve information from devices. For example, to store the login status in a user account, the contents of a shopping cart in an e-shop, the content accessed, or functions used in an online service. Cookies can also be used for various purposes, such as functionality, security, and convenience of online services, as well as for analyzing visitor traffic.

Notes on Consent: We use cookies in accordance with legal requirements. Therefore, we obtain prior consent from users, unless it is not legally required. Consent is not necessary, in particular, when storing and retrieving information, including cookies, is essential to provide users with an expressly requested telemedia service (i.e., our online service). Essential cookies typically include cookies with functions related to the display and functionality of the online service, load balancing, security, storing user preferences, or similar purposes related to providing the main and ancillary functions of the online service requested by users. Revocable consent is clearly communicated to users and includes information on the respective cookie usage.

Notes on Data Protection Legal Bases: The legal basis for processing users' personal data using cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is the declared consent. Otherwise, the data processed using cookies is based on our legitimate interests (e.g., in the commercial operation of our online service and improving its usability) or, if the use of cookies is necessary to fulfill our contractual obligations, on the basis of fulfilling our contractual obligations. We will clarify the purposes for which cookies are processed as part of this privacy policy or in the context of our consent and processing processes.

Storage Duration: With regard to the storage duration, the following types of cookies are distinguished:

• Temporary Cookies (also: Session Cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their device (e.g., browser or mobile application).
• Persistent Cookies: Persistent cookies remain stored even after the device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user revisits a website. The data collected from users using cookies can also be used for audience measurement. If we do not provide users with explicit information about the type and storage duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are persistent and that the storage duration can be up to two years.

General Notes on Revocation and Objection (Opt-Out): Users can revoke their consent given at any time and object to processing in accordance with legal requirements. To do this, users can restrict the use of cookies in their browser settings (which may also restrict the functionality of our online service). Objection to the use of cookies for online marketing purposes can also be made through the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Cookie Settings / Objection Option:

Change Privacy Settings

Privacy Settings History

Withdraw Consents

• Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• Processing of Cookie Data Based on Consent: We use a consent management procedure: Procedure for obtaining, logging, managing, and revoking consents, especially for the use of cookies and similar technologies for storing, accessing, and processing information on users' devices and their processing within the framework of the consent management procedure: Procedure for obtaining, logging, managing, and revoking consents, especially for the use of cookies and similar technologies for storing, accessing, and processing information on users' devices and their processing-Procedure named processes and providers can be obtained and managed by users and revoked. The consent declaration is stored to avoid having to repeat the query and to be able to prove consent in accordance with legal obligations. Storage can be server-side and/or in a cookie (so-called opt-in cookie or using similar technologies) to assign consent to a user or their device. Subject to individual information about providers of cookie management services, the following information applies: The duration of consent storage can be up to two years. In this case, a pseudonymous user identifier is formed and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), and the browser, system, and device used; Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
• Real Cookie banner: To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool "Real Cookie Banner". Details on the functionality of "Real Cookie Banner" can be found at https://devowl.io/de/rcb/datenverarbeitung/.
  
  Legal bases for the processing of personal data in this context are Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and related consents.
  
  Providing personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide personal data. If you do not provide personal data, we cannot manage your consents; Service Provider: devowl.io GmbH
  Tannet 12
  94539 Grafling
  Germany
  
  Email: mail@devowl.io (Please submit support inquiries about products via the support page)
  Phone: +49 991 20098959 (We do not offer telephone support and therefore ask you to open a support ticket for questions)
  
  Management: Matthias Günter and Jan Karres
  Responsible for editorial content: Matthias Günter and Jan Karres
  
  Court of registration: Local Court Deggendorf, Germany
  
  Commercial Register: HRB 5100
  VAT ID: DE328159884; Website: https://devowl.io/de/; Data Privacy Policy: https://devowl.io/de/datenschutzerklaerung/. Basis of Third Country Transfers: Switzerland - Adequacy Decision (Sweden).

Business Services

We process data of our contractual and business partners, e.g., customers and prospects (collectively referred to as "contractual partners") within the scope of contractual and similar legal relationships as well as associated measures and in the context of communication with contractual partners (or pre-contractually), e.g., to respond to inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed services, any obligations to update, and remedy warranty and other performance disruptions. Furthermore, we process the data to safeguard our rights and for the purposes of associated administrative tasks and organizational activities of the company. In addition, we process the data based on our legitimate interests in proper and efficient business management as well as security measures to protect our contractual partners and our business operations from misuse, jeopardization of their data, secrets, information, and rights (e.g., for the involvement of telecommunications, transportation, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Under applicable law, we only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about further forms of processing, e.g., for marketing purposes, as part of this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, by special labeling (e.g., colors) or symbols (e.g., asterisks or similar), or personally.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as they must be kept for legal reasons of archiving. The statutory retention period is ten years for tax-relevant documents as well as for commercial books, inventories, opening balances, annual financial statements, the instructions for understanding these documents, and other organizational documents and booking vouchers, and six years for received commercial and business letters and copies of sent commercial and business letters. The period begins with the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance, the annual financial statement, or the management report was drawn up, the commercial or business letter was received or sent, or the booking voucher was created, and the record was made or the other documents were created.

As far as we use third-party providers or platforms to provide our services, the terms and privacy policies of the respective third-party providers or platforms apply in the relationship between users and providers.

• Processed Data Types: Inventory Data (e.g., names, addresses); Payment Data (e.g., bank details, invoices, payment history); Contact Data (e.g., email, phone numbers); Contract Data (e.g., subject matter of the contract, duration, customer category).
• Affected Persons: Prospects. Business and contractual partners.
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Contact inquiries and communication; Office and organizational procedures. Administration and response to inquiries.
• Legal Bases: Contractual Performance and Pre-contractual Inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Legal Obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR). Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• Hay Trading: Personal acceptance of orders for animal feed - hay. Delivery of the goods to the customer; Service Provider: Hay Trading K + K GmbH
  Querenburger Str. 40
  44789 Bochum
  Germany; Website: https://kk-heuhandel.de; Privacy Policy: /de/datenschutzerklaerung/. Basis of Third Country Transfers: Switzerland - Adequacy Decision (Germany).

Use of Online Platforms for Sales and Distribution Purposes

We offer our services on online platforms operated by other service providers. In this context, in addition to our privacy policy, the privacy policies of the respective platforms also apply. This applies in particular to the execution of the payment process and the procedures for reach measurement and interest-based marketing used on the platforms.

• Processed Data Types: Inventory Data (e.g., names, addresses); Payment Data (e.g., bank details, invoices, payment history); Contact Data (e.g., email, phone numbers); Contract Data (e.g., subject matter of the contract, duration, customer category); Usage Data (e.g., visited web pages, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Affected Persons: Customers.
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations. Marketing.
• Legal Bases: Contractual Performance and Pre-contractual Inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR). Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• eBay: Online marketplace for e-commerce; Service Provider: eBay Marketplaces GmbH, Helvetiastrasse 15/17, 3005 Bern, Switzerland; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.ebay.de/; Privacy Policy: https://www.ebay.de/help/policies/member-behavior-policies/datenschutzerklrung?id=4260. Basis of Third Country Transfers: EU/EEA - Adequacy Decision (Switzerland).

Provision of Online Offerings and Web Hosting

We process user data to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the contents and functions of our online services to the user's browser or device.

• Processed Data Types: Usage Data (e.g., visited web pages, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, timestamps, identification numbers, consent status); Content Data (e.g., entries in online forms).
• Affected Persons: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Provision of our online services and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Security measures.
• Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• Provision of Online Offerings on Rented Space: For the provision of our online offerings, we use storage space, computing capacity, and software that we rent or otherwise obtain from a corresponding server provider (also called "web hoster"); Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
• Collection of Access Data and Log Files: Access to our online offering is logged in the form of so-called "server log files." Server log files may include the address and name of the accessed web pages and files, date and time of access, transmitted data volumes, message about successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), and usually IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and to ensure the load and stability of the servers; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Data Deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes are excluded from deletion until the respective incident has been finally clarified.
• Email Dispatch and Hosting: The web hosting services we use also include the sending, receiving, and storage of emails. For these purposes, the addresses of the recipients as well as senders and further information regarding email dispatch (e.g., the involved providers) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that emails are generally not encrypted when sent over the Internet. In most cases, emails are encrypted in transit, but (unless an end-to-end encryption method is used) not on the servers from which they are sent and received. Therefore, we cannot assume responsibility for the transmission path of emails between the sender and the recipient on our server; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
• STRATO: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacities); Service Provider: STRATO AG, Pascalstraße 10, 10587 Berlin, Germany; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.strato.de; Privacy Policy: https://www.strato.de/datenschutz/; Data Processing Agreement: Provided by the service provider. Basis of Third Country Transfers: Switzerland - Adequacy Decision (Germany).

Contact and Inquiry Management

When contacting us (e.g., by post, contact form, email, telephone, or via social media) and within the scope of existing user and business relationships, the information provided by the inquiring parties is processed to the extent necessary to respond to the contact inquiries and any requested measures.

• Processed Data Types: Contact Data (e.g., email, phone numbers); Content Data (e.g., entries in online forms); Usage Data (e.g., visited web pages, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Affected Persons: Communication partners.
• Purposes of Processing: Contact inquiries and communication; Management and response to inquiries; Feedback (e.g., collecting feedback via online form). Provision of our online offerings and user-friendliness.
• Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Contractual Performance and Pre-contractual Inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• Contact Form: When users contact us via our contact form, email, or other communication channels, we process the data provided to us in this context to process the stated request; Legal Bases: Contractual Performance and Pre-contractual Inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Communication via Messenger

We use messengers for communication purposes and therefore ask you to observe the following information regarding the functionality of the messengers, encryption, the use of metadata of the communication, and your objection options.

You can also contact us through alternative means, e.g., via telephone or email.

Please use the contact options provided to you or those specified within our online offering.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we would like to point out that the communication content (i.e., the content of the message and attached images) is encrypted end-to-end. This means that the content of the messages is not visible, not even to the messenger providers themselves. You should always use an up-to-date version of the messenger with encryption enabled to ensure the encryption of message contents.

However, we would like to additionally inform our communication partners that while the messenger providers cannot view the content, they may become aware of when communication partners communicate with us and technical information about the communication partners' devices and, depending on their device settings, location information (known as metadata) may be processed.

Notes on Legal Bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for processing their data is their consent. Otherwise, if we do not ask for consent and they contact us, for example, we use messengers in relation to our contractual partners and in the context of contract initiation as a contractual measure and, in the case of other interested parties and communication partners, based on our legitimate interests in fast and efficient communication and meeting the needs of our communication partners in communication via messenger. Furthermore, please note that we do not transmit the contact details provided to us to the messengers without your consent.

Revocation, Objection, and Deletion: You can revoke consent granted at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we delete the messages in accordance with our general deletion policies (i.e., e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise, as soon as we can assume that any information requested by communication partners has been answered, if no reference back to a previous conversation is expected and deletion does not conflict with legal retention obligations.

Reservation of Referral to Other Communication Channels: Finally, we would like to point out for reasons of your security that we reserve the right not to answer inquiries via messenger. This is the case, for example, if contract details require special confidentiality or if a response via messenger does not meet formal requirements. In such cases, we will refer you to more appropriate communication channels.

• Processed Data Types: Contact Data (e.g., email, phone numbers); Usage Data (e.g., visited web pages, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, timestamps, identification numbers, consent status); Content Data (e.g., entries in online forms).
• Affected Persons: Communication partners.
• Purposes of Processing: Contact inquiries and communication; Direct marketing (e.g., by email or post).
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• Instagram: Messaging via the Instagram social network; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy. Basis of Third Country Transfers: Switzerland - Adequacy Decision (Ireland).
• Facebook Messenger: Facebook Messenger with end-to-end encryption (end-to-end encryption of the Facebook Messenger requires activation unless it is already activated by default); Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing. Basis of Third Country Transfers: EU/EWR - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland).
• Microsoft Teams: Microsoft Teams - Messenger; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-365; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Notes: https://www.microsoft.com/de-de/trustcenter. Basis of Third Country Transfers: EU/EWR - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland).
• WhatsApp: WhatsApp Messenger with end-to-end encryption; Service Provider: WhatsApp Ireland Limited, 4 Grand Canal Quay, Dublin 2, D02 KH28, Ireland; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.whatsapp.com/; Privacy Policy: https://www.whatsapp.com/legal. Basis of Third Country Transfers: EU/EWR - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland).

Video Conferences, Online Meetings, Webinars, and Screen Sharing

We use platforms and applications from other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as "conferences"). When selecting the conference platforms and their services, we comply with legal requirements.

Data Processed by Conference Platforms: In the context of participating in a conference, conference platforms process the personal data of participants as listed below. The extent of processing depends on the data required for a specific conference (e.g., provision of access data or real names) and any optional information provided by participants. In addition to processing for conducting the conference, participant data may also be processed by conference platforms for security purposes or service optimization. Processed data includes personal information (first name, last name), contact information (email address, phone number), access data (access codes or passwords), profile pictures, information about professional position/function, the IP address of internet access, information about participants' devices, their operating system, browser, and its technical and language settings, information about the content of communication processes, i.e., inputs in chats as well as audio and video data, and the use of other available functions (e.g., surveys). Communication content is encrypted to the extent provided technically by the conference providers. If participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and Recordings: If text inputs, participation results (e.g., from surveys), as well as video or audio recordings are logged, this will be transparently communicated to participants in advance, and their consent will be obtained if necessary.

Participant Data Protection Measures: Please refer to the privacy notices of the conference platforms for details on how your data is processed by them and choose the optimal security and privacy settings within the conference platform settings. Additionally, please ensure data and personal privacy in the background of your recording during a video conference (e.g., by informing cohabitants, locking doors, and using, where technically possible, the background blur function). Links to conference rooms and access data must not be shared with unauthorized third parties.

Notes on Legal Bases: If, in addition to the conference platforms, we also process user data and request user consent for the use of conference platforms or specific features (e.g., consent to record conferences), the legal basis for processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g., in participant lists, in the case of processing conversation results, etc.). Otherwise, user data is processed based on our legitimate interests in efficient and secure communication with our communication partners.

• Processed Data Types: Master Data (e.g., names, addresses); Contact Data (e.g., email, phone numbers); Content Data (e.g., inputs in online forms); Usage Data (e.g., visited websites, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Affected Persons: Communication partners; Users (e.g., website visitors, users of online services); Depicted persons.
• Purposes of Processing: Provision of contractual services and customer support; Contact inquiries and communication. Office and organizational procedures.
• Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• Microsoft Teams: Conference and communication software; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-365; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Notes: https://www.microsoft.com/de-de/trustcenter. Basis of Third Country Transfers: EU/EWR - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland).

Advertising Communication via Email, Post, Fax, or Phone

We process personal data for the purpose of advertising communication, which may take place through various channels such as email, telephone, post, or fax, in accordance with legal requirements.

Recipients have the right to revoke consent given at any time or to object to advertising communication at any time.

After revocation or objection, we store the data required to provide evidence of previous consent for contact or sending information for up to three years after the end of the year of revocation or objection based on our legitimate interests. The processing of this data is limited to the purpose of possible defense against claims. Based on the legitimate interest of permanently observing user revocation or objection, we also store the data required to prevent further contact (e.g., email address, phone number, name, depending on the communication channel).

• Processed Data Types: Master Data (e.g., names, addresses); Contact Data (e.g., email, phone numbers).
• Affected Persons: Communication partners.
• Purposes of Processing: Direct marketing (e.g., by email or post).
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Contests and Competitions

We process personal data of participants in contests and competitions only in compliance with the relevant data protection regulations, to the extent that processing is contractually necessary for the provision, execution, and handling of the contest, participants have consented to the processing, or processing serves our legitimate interests (e.g., in the security of the contest or protecting our interests against misuse by possible collection of IP addresses when submitting contest entries).

If contributions from participants are published as part of the contests (e.g., as part of a vote or presentation of contest entries or winners or reporting on the contest), we would like to point out that the names of the participants may also be published in this context. Participants can object to this at any time.

If the contest takes place within an online platform or social network (e.g., Facebook or Instagram, hereinafter referred to as "online platform"), the terms of use and data protection regulations of the respective platforms also apply. In these cases, we would like to point out that we are responsible for the information provided by participants in the context of the contest and that inquiries regarding the contest should be directed to us.

The data of participants will be deleted as soon as the contest or competition has ended and the data is no longer required to inform the winners or because no further inquiries about the contest are to be expected. In principle, the data of participants will be deleted no later than 6 months after the end of the contest. Data of winners may be retained for a longer period to answer queries about the prizes or to fulfill prize obligations; in this case, the retention period depends on the nature of the prize and may be up to three years for goods or services, for example, to handle warranty claims. Furthermore, participant data may be stored for a longer period, e.g., in the form of reporting on the contest in online and offline media.

If data was collected for other purposes within the scope of the contest, their processing and retention period are based on the privacy notices for that use (e.g., in the case of newsletter registration as part of a contest).

• Processed Data Types: Master Data (e.g., names, addresses); Content Data (e.g., inputs in online forms); Meta, Communication, and Process Data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Affected Persons: Contest and competition participants.
• Purposes of Processing: Conducting contests and competitions.
• Legal Bases: Contractual Performance and Pre-contractual Inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Web Analytics, Monitoring, and Optimization

Web analytics (also referred to as "reach measurement") is used to evaluate visitor traffic to our online offering and may include pseudonymous values such as visitor behavior, interests, or demographic information, such as age or gender. With the help of reach analysis, we can, for example, determine at what time our online offering or its functions or contents are most frequently used or invite reuse. Likewise, we can track which areas require optimization.

In addition to web analytics, we may also use testing procedures to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles may be created for these purposes, i.e., data concerning a user's behavior may be summarized for a usage analysis and stored in a browser, or a device profile, and information may be stored and retrieved from it. The data collected may include, in particular, visited websites and the elements used there, as well as technical information such as the browser used, the computer system used, and information on usage times. If users have consented to the collection of their location data vis-à-vis us or the providers of the services we use, location data may also be processed.

The IP addresses of users are also stored. However, we use IP masking (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as email addresses or names) is stored as part of web analytics, A/B testing, and optimization, but rather pseudonyms. This means that we and the providers of the software used do not know the actual identity of users, but only the information stored in their profiles for the purposes of the respective procedures.

• Processed Data Types: Usage Data (e.g., visited websites, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Affected Persons: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Reach measurement (e.g., access statistics, recognition of recurring visitors); Profiles with user-related information (creating user profiles). Provision of our online offering and user-friendliness.
• Security Measures: IP Masking (Pseudonymization of the IP Address).
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further Information on Processing Processes, Procedures, and Services:

• Google Analytics: We use Google Analytics to measure and analyze the use of our online offering based on a pseudonymous user identification number. This identification number does not contain unique data such as names or email addresses. It is used to assign analysis information to a device to recognize which content users have accessed within one or more usage processes, which search terms they have used, accessed again, or interacted with our online offering. The time of use and its duration are also stored, as well as the sources of users referring to our online offering and technical aspects of their devices and browsers.
  Pseudonymous user profiles are created with information from the use of various devices, with cookies possibly being used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). In EU traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. They are not logged, not accessible, and not used for further purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security Measures: IP Masking (Pseudonymization of the IP Address); Privacy Policy: https://policies.google.com/privacy; Data Processing Terms: https://business.safety.google/adsprocessorterms/; Basis of Third Country Transfers: EU/EWR - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland); Opt-out Options: Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Ad Display Settings: https://myadcenter.google.com/personalizationoff. Further Information: https://business.safety.google/adsservices/ (Types of Processing and Processed Data).

Online Marketing

We process personal data for the purpose of online marketing, which includes, in particular, the marketing of advertising space or the display of advertising and other content (collectively referred to as "content") based on potential user interests, as well as measuring their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (a so-called "cookie") or similar methods are used, whereby information relevant to the user for the display of the aforementioned content is stored. This information may include, for example, viewed content, visited websites, used online networks, but also communication partners and technical information such as the browser used, the operating system used, as well as information about usage times and functions used. If users have consented to the collection of their location data, this data may also be processed.

The IP addresses of users are also stored. However, we use available IP masking techniques (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) are stored as part of the online marketing process, but pseudonyms. That is, neither we nor the providers of the online marketing process know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is typically stored in cookies or similar methods. These cookies can later be read on other websites that use the same online marketing process, analyzed for the purpose of displaying content, supplemented with additional data, and stored on the server of the online marketing process provider.

In exceptional cases, clear data can be assigned to the profiles. This is the case, for example, if users are members of a social network whose online marketing process we use and the network links the users' profiles with the aforementioned information. Please note that users can make additional agreements with the providers, for example by giving consent during registration.

We generally only have access to summarized information about the success of our advertisements. However, we can check, as part of so-called conversion measurements, which of our online marketing processes led to a so-called conversion, i.e., for example, to a contract with us. The conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, please assume that cookies used are stored for a period of two years.

• Processed Data Types: Usage Data (e.g., visited websites, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, time information, identification numbers, consent status).
• Affected Persons: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Reach Measurement (e.g., access statistics, recognition of returning visitors); Tracking (e.g., interest/behavioral profiling, use of cookies); Marketing; Profiles with user-related information (creation of user profiles); Conversion Measurement (measurement of the effectiveness of marketing measures).
• Security Measures: IP Masking (pseudonymization of the IP address).
• Legal Basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
• Opt-Out Options: Please refer to the privacy notices of the respective providers and the opt-out options provided for by the providers (so-called "opt-out"). If no explicit opt-out option has been provided, there is the possibility to disable cookies in the settings of your browser. However, this may restrict the functionality of our online offering. We therefore recommend the following opt-out options, which are summarized and offered for respective regions:
  
  a) Europe: https://www.youronlinechoices.eu.
  b) Canada: https://www.youradchoices.ca/choices.
  c) USA: https://www.aboutads.info/choices.
  d) Cross-regional: https://optout.aboutads.info.

Additional Information on Processing Procedures, Procedures, and Services:

• Google Ads and Conversion Measurement: Online marketing processes for the purpose of placing content and advertisements within the service provider's advertising network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who are presumed to have an interest in the advertisements. In addition, we measure the conversion of the advertisements, i.e., whether users have used them to interact with the advertisements and to use the advertised offers (so-called conversion). However, we only receive anonymous information and no personal information about individual users; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for Third Country Transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland); Additional Information: Types of processing and processed data: https://business.safety.google/adsservices/. Data processing terms between controllers and standard contractual clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.

Customer Reviews and Rating Procedures

We participate in review and rating procedures to evaluate, optimize, and promote our services. If users rate us or provide feedback through the participating review platforms or procedures, the general terms and conditions and privacy policies of the providers also apply. In most cases, registration with the respective providers is also required for the review.

To ensure that reviewing individuals have actually used our services, we transmit the necessary data concerning the customer and the service used to the respective review platform with the customer's consent (including name, email address, and order number or item number). This data is used solely to verify the authenticity of the user.

• Processed Data Types: Contract Data (e.g., contract subject matter, duration, customer category); Usage Data (e.g., visited websites, interest in content, access times); Meta, Communication, and Process Data (e.g., IP addresses, time information, identification numbers, consent status).
• Affected Persons: Customers; Users (e.g., website visitors, users of online services).
• Purposes of Processing: Feedback (e.g., collecting feedback via online form); Marketing.
• Legal Basis: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Additional Information on Processing Procedures, Procedures, and Services:

• Google Customer Reviews: Service for obtaining and/or displaying customer satisfaction and opinions; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for Third Country Transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland); Additional Information: As part of the collection of customer reviews, an identification number and time for the transaction to be reviewed are processed, and for review requests sent directly to customers, the customer's email address and their indication of the country of residence as well as the review information itself are processed; Further details on the types of processing and the data processed: https://business.safety.google/adsservices/. Data processing terms for Google advertising products: Information on the services Data processing terms between controllers and standard contractual clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.

Social Media Presence

We maintain online presences within social networks and process user data in this context to communicate with active users there or to provide information about us.

We would like to point out that user data may be processed outside the European Union in this context.

This may entail risks for users, as enforcement of user rights, for example, could be made more difficult.

Furthermore, user data within social networks is typically processed for market research and advertising purposes. For instance, user profiles can be created based on user behavior and resulting interests. These user profiles can then be used to display advertisements within and outside of the networks that presumably match the interests of the users. For these purposes, cookies are usually stored on users' computers, containing information about user behavior and interests. Additionally, data can be stored in user profiles regardless of the devices used by the users (especially if users are members of the respective platforms and logged in).

For a detailed description of the respective processing methods and opt-out options, we refer to the privacy policies and information provided by the operators of the respective networks.

Even in the case of inquiries about information and the assertion of data subject rights, we would like to point out that these can be most effectively asserted with the providers. Only the providers have access to the data of the users and can take appropriate measures and provide information directly. If you still need assistance, you can contact us.

• Processed data types: Contact details (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited websites, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Affected persons: Users (e.g., website visitors, users of online services).
• Purposes of processing: Contact inquiries and communication; Feedback (e.g., collecting feedback via online form). Marketing.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing procedures, procedures, and services:

• Instagram: Social network; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland).
• Facebook Pages: Profiles within the social network Facebook; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland); Additional Information: We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not further processing) of data from visitors to our Facebook page (so-called "Fanpage"). This data includes information about the types of content users view or interact with, or the actions they take (see "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see "Device Information" in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, known as "Page Insights," to page operators so that they can understand how people interact with their pages and associated content. We have entered into a special agreement with Facebook ("Information on Page Insights", https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular the security measures Facebook must observe and in which Facebook has agreed to fulfill data subjects' rights (i.e., users can, for example, direct inquiries or deletion requests directly to Facebook). The rights of users (in particular, to information, deletion, objection, and complaint to the responsible supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information on Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data). Joint responsibility is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, especially regarding the transmission of the data to the parent company Meta Platforms, Inc. in the USA.

Plugins and embedded functions as well as content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include, for example, graphics, videos, or maps (hereinafter uniformly referred to as "content").

The integration always presupposes that the third-party providers of this content process the IP address of the users, as they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content or functions. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the user's device and may contain technical information about the browser and operating system, referring websites, visit time, and other information about the use of our online offering, as well as be linked to such information from other sources.

• Processed data types: Usage data (e.g., visited websites, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Affected persons: Users (e.g., website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness. Provision of contractual services and fulfillment of contractual obligations.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing procedures, procedures, and services:

• reCAPTCHA: We integrate the "reCAPTCHA" function to determine whether inputs (e.g., in online forms) are made by humans or by automatically acting machines (so-called "bots"). Processed data may include IP addresses, information about operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, duration of stay on websites, previously visited websites, interactions with ReCaptcha on other websites, and possibly cookies, as well as results of manual recognition processes (e.g., answering questions or selecting objects in images). Data processing is based on our legitimate interest in protecting our online offering from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.google.com/recaptcha/; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland). Opt-out option: Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying advertising: https://myadcenter.google.com/personalizationoff.

Changes and updates to the privacy policy

We ask you to regularly inform yourself about the content of our privacy policy. We will adjust the privacy policy as soon as the changes to our data processing require it. We will inform you as soon as the changes require your cooperation (e.g., consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time, and we ask you to verify the information before contacting them.

Definitions

In this section, you will find an overview of the terms used in this privacy policy. Where the terms are legally defined, their legal definitions apply. The following explanations are primarily intended to aid understanding.

• Conversion Measurement: Conversion measurement (also referred to as "visit action analysis") is a method used to determine the effectiveness of marketing measures. Typically, a cookie is stored on users' devices within the websites where the marketing measures take place and is then retrieved again on the target website. For example, this allows us to track whether the ads we placed on other websites were successful.
• Personal Data: "Personal data" refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Profiles with User-related Information: The processing of "profiles with user-related information," or simply "profiles," includes any form of automated processing of personal data consisting of the use of personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may involve different information regarding demographics, behavior and interests, such as interaction with websites and their content, etc.). Cookies and web beacons are often used for profiling purposes.
• Reach Measurement: Reach measurement (also known as web analytics) is used to evaluate visitor traffic to an online offering and may include the behavior or interests of visitors in specific information, such as the content of websites. With the help of reach analysis, operators of online offerings, for example, can determine when users visit their websites and what content they are interested in, allowing them to better tailor the content of the websites to the needs of their visitors. Pseudonymous cookies and web beacons are often used for reach analysis purposes to recognize repeat visitors and obtain more accurate analyses of the use of an online offering.
• Tracking: "Tracking" refers to the ability to track user behavior across multiple online offerings. Typically, behavior and interest information related to the used online offerings is stored in cookies or on servers of the providers of tracking technologies (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to match their interests.
• Controller: The "controller" is the natural or legal person, authority, agency, or other body that alone or jointly with others determines the purposes and means of the processing of personal data.
• Processing: "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and includes practically any handling of data, whether it be collecting, evaluating, storing, transmitting, or deleting.