Privacy Policy

Introduction

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as... e.g. Our social media profiles (hereinafter collectively referred to as "online presence"). The terms used are not gender-specific.
As of June 10, 2022

 

Contents

• Introduction
• Controller
• Contact data protection officer
• Overview of the processing operations
• Relevant legal bases
• Security Measures:
• Transmission of personal data
• Data processing in third countries
• Deletion of data
• Use of Cookie policy
• Links to other websites, liability, copyrights, objection to advertising
• Business Services
• Payment procedure
• Provision of the online offer and web hosting
• Special notes on applications (apps)
• Contact and request management
• Communication via messenger
• Video conferences, Online meetingsWebinars and screen sharing
• Application process
• Cloud Services
• Newsletters and Electronic Communications
• Advertising communication via email, post, fax or telephone
• Sweepstakes and competitions
• Polls and surveys
• Web analysis, monitoring and optimization
• Visitor structure analysis
• Online marketing
• Presence in social networks (social media)
• Plugins and embedded functions as well as content
• Management, organization and support tools
• Modification and update of the privacy policy
• Rights of data subjects
• Terminology and Definitions

 

Liablity holder

The Bergisches Land GmbH
Friedrich-Ebert-Strasse 75
51429 Bergisch Gladbach
Germany
Authorized representatives: Gabi Wilhelm (Managing Director)
E-mail address: info@dasbergische.de 
Telephone: +49 2204 / 84-3000
Imprint: https://www.dasbergische.de/de/impressum/index.html

 

Contact data protection officer

datenschutz@dasbergische.de 
If you require confidentiality, please contact our data protection officer by mail with the subject line "Personal / Confidential".

 

Overview of the processing operations

The following summary summarizes the types of data processed and the purposes of their processing and refers to the individuals concerned.

 

Types of processed data

• Inventory data (e.g. Names, addresses).
• Applicant data (e.g. Personal details, postal and contact addresses, application documents and the information contained therein, such as e.g. Cover letter, CV, certificates and other information relating to a specific position or voluntarily provided by applicants regarding their person or qualifications).
• Content data (e.g. Entries in online forms).
• Contact details (e.g. Email, phone numbers).
• Meta/communication data (e.g. Device information, IP addresses).
• Usage data (e.g. (websites visited, interest in content, access times).
• Location data (information on the geographical position of a device or a person).
• Contract data (e.g. Subject of the contract, term, customer category).
• Payment details (e.g. Bank details, invoices, payment history).

 

Categories of data subjects

• Employees (e.g. Employees, applicants, former employees).
• Applicants.
• Business and contractor.
• Interested persons.
• Communication partner.
• Customers.
• Users (e.g. Website visitors, users of online services).
• Pupils/ Students/ Participants.
• Sweepstakes and competition participants.

 

Purposes of Processing

• Providing our online offer and user-friendliness.
• Conversion measurement (measurement of the effectiveness of marketing measures).
• Application process (justification and any subsequent implementation as well as possible subsequent termination of the employment relationship).
• Office and organizational procedures.
• Direct marketing (e.g. via email or post).
• Conducting sweepstakes and competitions.
• Feedback (e.g. (Collecting feedback via online form).
• Marketing.
• Contact requests and communication.
• Profiles containing user-related information (creating user profiles).
• Range measurement (e.g. Access statistics, recognition of returning visitors).
• Safety measures.
• Provision of contractual services and customer service.
• Management and answering of inquiries.

 

Relevant legal bases

Below you will find an overview of the legal basis of GDPR, on the basis of which we process personal data. Please note that in addition to the regulations of the GDPR national data protection regulations in your or This may apply in your country of residence or domicile. If more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

 

• consent (Type. 6 Abs 1 S.1 bed. a. GDPR) - The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes.
• Fulfillment of contract and pre-contractual inquiries (Art. 6 para. 1 S. 1 lit. b DSGVO) - Die Verarbeitung ist für die Erfüllung eines Vertrags, dess Vertragspartei die betroffene Person ist, oder zur Durchführung vorvertraglicher Maßnahmen erforderlich, die auf Anfrage der betroffenen Person erfolgen.
• Legal obligation (Art. 6 para. 1 S. 1 lit. c DSGVO) - The processing is necessary to fulfill a legal obligation to which the controller is subject.
• Justified interests (Art. 6 para. 1 S. 1 lit. f.DSGVO) - The processing is necessary to safeguard the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, outweigh this.
• Application procedure as a pre-contractual or contractual relationship (Art. 9 Para. 2 lit. b GDPR) - Insofar as special categories of personal data within the meaning of Article 9(1) GDPR (e.g., health data, such as information on severe disability or ethnic origin) are requested from applicants during the application process so that the controller or the data subject can exercise their rights and fulfill their obligations under employment law and social security and social protection law, their processing is carried out in accordance with Article 9(2)(b) GDPR, in the case of the protection of the vital interests of the applicants or other persons in accordance with Article 9(2)(c) GDPR, or for the purposes of preventive or occupational medicine, for the assessment of the employee's fitness for work, for medical diagnosis, the provision of health or social care or treatment, or for the management of health or social care systems and services in accordance with Article 9(2)(h) GDPR. In the case of the disclosure of special categories of data based on voluntary consent, their processing is carried out on the basis of Art. 9 para. 2 lit. a. GDPR.

 

National data protection regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection in Germany apply. This includes in particular the law on the protection against misuse of personal data in data processing (Bundesdatenschutzgesetz - BDSG). In particular, the BDSG contains special rules on the right of access, the right of cancellation, the right to object, the processing of special categories of personal data, processing for other purposes and for transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates the data processing for employment purposes (§ 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships and the consent of employees. Furthermore, state data protection laws of the individual federal states can be applied.

 

Security Measures:

We will take appropriate technical and organizational measures in accordance with the law, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing, the different probabilities of occurrence and the extent to which the rights and freedoms of individuals are threatened to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, transfer of, and ensuring the availability and separation of the data. Furthermore, we have established procedures that guarantee the exercise of data subject rights, the deletion of data, and responses to data breaches. We also consider the protection of personal data during the development and selection of hardware, software, and processes, in accordance with the principles of data protection by design and by default.

 

SSL encryption (https)To protect the data you transmit via our online service, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in your browser's address bar.

 

Transmission of personal data

As part of our processing of personal data, it may happen that the data is transmitted to other bodies, companies, legally independent organizational units or persons or that it is disclosed to them. The recipients of this data can include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such a case, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

 

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU) and the European Economic Area (EEA)) or if processing takes place in the context of using third-party services or disclosing or transferring data to other persons, bodies, or companies, this is done only in accordance with legal requirements. Subject to explicit consent or where transfer is required by contract or law, we only process or have data processed in third countries with a recognized level of data protection, contractual obligations through so-called standard contractual clauses of the EU Commission, certifications, or binding internal data protection regulations (Articles 44 to 49 GDPR, EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection.de).

 

Deletion of data

The data we process will be deleted in accordance with legal requirements as soon as the consent to process it is withdrawn or other permissions cease to apply (e.g., if the purpose for processing this data no longer exists or it is no longer necessary for that purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means the data will be blocked and not processed for any other purpose. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person. Within the framework of our privacy policy, we can provide users with further information on the deletion and retention of data that applies specifically to the respective processing activities.

 

Use of cookies

Cookies are text files containing data from visited websites or domains, stored by a browser on the user's computer. A cookie primarily serves to store information about a user during or after their visit to an online service. This stored information can include, for example, language settings on a website, login status, items in a shopping cart, or the point at which a video was paused. We also include other technologies that perform the same functions as cookies in the term "cookies" (e.g., when user data is stored using pseudonymous online identifiers, also known as "user IDs").

 

The following cookie types and functions are distinguished:

• Temporary cookies (also: session or session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his browser.
• Permanent Cookies: Permanent Cookies bleiben auch nach dem Schließen des Browsers gespeichert. So kann beispielsweise der Login-Status gespeichert oder bevorzugte Inhalte direkt angezeigt werden, wenn der Nutzer eine Website erneut besucht. Ebenso können die Interessen von Nutzern, die zur Reichweitenmessung oder zu Marketingzwecken verwendet werden, in einem solchen Cookie gespeichert werden.
• First party cookies: First-party cookies are set by ourselves.
• Third-party cookies (also: third-party cookies): Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
• Necessary (also: essential or absolutely necessary) cookies: Cookies may be absolutely necessary for the operation of a website (e.g., to save logins or other user input, or for security reasons).
• Statistics, marketing and personalization cookiesFurthermore, cookies are generally used for audience measurement and when a user's interests or behavior (e.g., viewing specific content, using certain functions, etc.) on individual websites are stored in a user profile. Such profiles serve to show users content that corresponds to their potential interests. This process is also known as "tracking," i.e., monitoring users' potential interests. If we use cookies or tracking technologies, we will inform you separately in our privacy policy or when obtaining your consent.

 

Notes on legal bases: The legal basis on which we process your personal data with the help of cookies depends on whether we ask for your consent. If this is the case and you consent to the use of cookies, the legal basis for the processing of your data is the informed consent. Otherwise, the data processed by means of cookies will be processed on the basis of our legitimate interests (eg in the course of a business operation of our online offer and its improvement) or, if the use of cookies is required, in order to fulfill our contractual obligations.

 

Storage time: If we do not provide you with any explicit information on the storage duration of permanent cookies (e.g. in the context of a so-called cookie opt-in), please assume that the storage duration can be up to two years.

 

General information on revocation and opposition (opt-out):

Depending on whether processing is based on consent or legal permission, you have the right to withdraw your consent or object to the processing of your data by cookie technologies at any time (collectively referred to as "opting out"). You can initially declare your objection via your browser settings, for example, by disabling the use of cookies (although this may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be made via a variety of services, especially in the case of tracking, through the websites themselves. optout.aboutads.info and www.youronlinechoices.com be explained. In addition, you can receive further objection notices in the context of the information on the service providers and cookies used.

 

Processing of cookie data based on consentWe use a cookie consent management process to obtain, manage, and revoke user consent for the use of cookies and the processing activities and providers mentioned within this process. The consent declaration is stored to avoid having to request it again and to provide proof of consent in accordance with legal requirements. Storage can be server-side and/or in a cookie (so-called opt-in cookie, or using comparable technologies) to associate the consent with a user or their device. Subject to individual specifications for cookie management service providers, the following applies: The consent can be stored for up to two years. A pseudonymous user identifier is created and stored along with the date and time of consent, information on the scope of the consent (e.g., which categories of cookies and/or service providers), and the browser, operating system, and device used.

 

• Processed data types: Usage data (eg visited websites, interest in content, access times), meta / communication data (eg device information, IP addresses).
• Affected people: Users (eg website visitors, users of online services).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate Interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

 

 

Deployed services and service providers:

• Cookiefirst: Cookie consent management; Service provider: Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH Amsterdam, Netherlands; Website: cookiefirst.com/de/; Data protection:cookiefirst.com/legal/privacy-policy/; Data stored (on the service provider's server): The user's IP address, date and time of consent, browser information, the URL from which the consent was sent, an anonymous, random and encrypted key value; the user's consent status.

 

Links to other websites, liability, copyrights, objection to advertising

Links to other websites

We occasionally link to third-party websites. Although we carefully select these third parties, we cannot guarantee or assume liability for the accuracy or completeness of their content or the data security of their websites. The respective provider or operator of the linked pages is always responsible for their content. The linked pages were checked for possible legal violations at the time the links were created. No illegal content was apparent at that time. This privacy policy also does not apply to linked third-party websites.

 

Liability

The content of our website has been created with the utmost care. However, we cannot guarantee the accuracy, completeness, or timeliness of the content. We are not obligated to monitor transmitted or stored information from third parties or to investigate circumstances that indicate illegal activity. Obligations to remove or block the use of information under general law remain unaffected. However, liability in this respect is only possible from the point at which we become aware of a specific legal violation. Upon notification of such legal violations, we will remove the offending content immediately.

 

Copyrights

The content and works created by the website operators on these pages are subject to German copyright law. Reproduction, processing, distribution, and any form of exploitation beyond the limits of copyright law require the written consent of the respective copyright holder (usually the author or creator). Downloads and copies of this page are not permitted for either private or commercial use. Insofar as the content on this page was not created by the operator, the copyrights of third parties are respected. In particular, third-party content is identified as such. Should you nevertheless become aware of a copyright infringement, please inform us accordingly. Upon notification of legal violations, we will remove such content immediately.

 

Advertising contradiction

The use of contact details published within the scope of the legal notice requirements or the information obligations stipulated by the General Data Protection Regulation (GDPR) by third parties for sending unsolicited advertising and informational materials is hereby expressly prohibited. The same applies to advertising telephone calls, calls for the purpose of market and opinion research, and calls for customer satisfaction surveys. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails, as well as in the case of unsolicited advertising telephone calls.
The place of jurisdiction is Bergisch Gladbach.

 

Business Services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as "contractual partners") within the framework of contractual and similar legal relationships as well as related measures and in the context of communication with the contractual partners (or pre-contractually), e.g. to answer inquiries.

We process this data to fulfill our contractual obligations, to secure our rights and for the purposes of the administrative tasks associated with this information as well as the business organization. We only pass on the data of the contractual partners to third parties within the framework of applicable law to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations or with the consent of the persons concerned (e.g. to telecommunications, transport and other auxiliary services involved as well Subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). The contractual partners will be informed about other forms of processing, e.g. for marketing purposes, within the scope of this data protection declaration.

Which data for the aforementioned purposes are necessary, we inform the contracting parties before or in the context of the data collection, eg in on-line forms, by special marking (eg colors) and / or symbols (eg asterisk), or in person with.

We delete the data after expiration of legal warranty and comparable obligations, ie, basically after the expiration of 4 years, unless the data are stored in a customer account, eg, as long as they have to be kept for legal reasons of archiving (eg for Tax purposes usually 10 years). Data that has been disclosed to us as part of an order by the contractor, we delete according to the specifications of the contract, in principle after the end of the contract.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

 

AccountContractual partners can create an account within our online service (e.g., customer or user account, hereinafter referred to as "customer account"). If registration of a customer account is required, contractual partners will be informed of this, as well as the information required for registration. Customer accounts are not public and cannot be indexed by search engines. During registration, as well as subsequent logins and use of the customer account, we store the customers' IP addresses along with the access times in order to verify the registration and prevent any misuse of the customer account.

When customers cancel their customer account, the data relating to the customer account is deleted, subject to retention being required by law. It is up to the customer to save their data upon termination of the customer account.

 

Shop and e-commerce: We process the data of our customers in order to enable them to select, purchase or order the selected products, goods and related services, as well as their payment and delivery or execution. If necessary for the execution of an order, we use service providers, in particular postal, forwarding and shipping companies, to carry out the delivery or execution for our customers. We use the services of banks and payment service providers to process payment transactions. The information required is marked as such in the context of the order or comparable purchase process and includes the information required for delivery or provision and billing as well as contact information in order to be able to hold any consultation.

 

Education and training servicesWe process the data of participants in our educational and training programs (collectively referred to as "trainees and apprentices") in order to provide them with our training services. The data processed, its nature, scope, purpose, and the necessity of its processing are determined by the underlying contractual and training relationship. Processing activities also include performance assessment and the evaluation of our services and those of our instructors.

If it is necessary for our contract performance, to protect vital interests or legally required, or if the trainees have given their consent, we will disclose or transmit the trainees' data to third parties or agents, such as authorities or in the field of IT, office or similar services, in compliance with professional regulations.

 

ConsultingWe process the data of our tourism service providers, clients, customers, prospective clients, and other principals or contractual partners (collectively referred to as "clients") in order to provide them with our consulting services. The data processed, its nature, scope, purpose, and the necessity of its processing are determined by the underlying contractual and client relationship.

Provided it is necessary for the performance of our contract, to protect vital interests or is required by law, or if the client has given their consent, we will disclose or transmit the client's data to third parties or agents, such as authorities, subcontractors or in the field of IT, office or similar services, in compliance with professional regulations.

 

Publication activityWe process the data of our contact partners, interviewees, and other individuals who are the subject of our publishing, editorial, journalistic, and related activities. In this context, we refer to the applicability of the protections of freedom of expression and of the press pursuant to Article 85 GDPR in conjunction with the respective national laws. This processing serves the purpose of fulfilling our commissioned activities and, moreover, is based in particular on the public interest in information and media offerings.

 

Travel-related servicesWe process the data of our customers and prospective customers (collectively referred to as "customers") in accordance with the underlying contractual relationship. We may also process information about the characteristics and circumstances of individuals or their property if this is necessary within the scope of the contractual relationship. This may include, for example, information about personal circumstances, movable property, and financial situation.

As part of our engagement, it may be necessary for us to process special categories of data within the meaning of Article 9(1) GDPR, in particular information concerning a person's health. This processing is carried out to protect the health interests of our clients and otherwise only with their consent.

If required for the performance of the contract or by law, or with the customer's consent or based on our legitimate interests, we disclose or transmit customer data, e.g., to service providers involved in the provision of travel services.

 

Events and eventsWe process the data of participants in the events and similar activities we offer or organize (hereinafter referred to collectively as "participants" and "events") to enable them to participate in the events and to use the services or actions associated with participation.

If we process health-related data, religious, political or other special categories of data in this context, this is done within the bounds of transparency (e.g. at themed events or for the purpose of health care, safety or with the consent of the data subjects).

The required information is marked as such during the order, purchase, or similar contract process and includes the data necessary for service provision and invoicing, as well as contact information to allow for any necessary follow-up. If we obtain access to information from end customers, employees, or other individuals, we process this information in accordance with legal and contractual requirements.

• Processed data types: Inventory data (eg names, addresses), payment data (eg bank details, invoices, payment history), contact data (eg e-mail, telephone numbers), contract data (eg subject matter, duration, customer category), usage data (eg visited websites, interest in content, access times) , Meta / communication data (eg device information, IP addresses).
• Affected people: Interested parties, business and contractual partners, customers, pupils/students/participants.
• Purposes of processing: Provision of contractual services and customer service, contact requests and communication, office and organizational procedures, administration and answering of inquiries, security measures.
• Legal basis: Performance of the contract and pre-contractual inquiries (Art. 6 para 1 S. 1 lit. DSGVO), Legal Obligation (Art. 6 Abs. 1 S. 1 lit.C DSGVO), Legitimate Interests (Art. 6 para. 1 S 1 lit. f DSGVO).

 

Provision of the online offer and web hosting

To provide our online offer safely and efficiently, we use the services of one or more web hosting providers whose servers (or servers managed by them) can access the online offer. For these purposes, we may use infrastructure and platform services, computing capacity, storage and database services, as well as security and technical maintenance services.

The data processed in the provision of the hosting offer may include all information relating to the use and communication of the users of our online offer. This includes, on a regular basis, the IP address necessary to deliver the content of online content to browsers, and all submissions made within our online offer or web pages.

 

Collection of access data and log files: We ourselves (or our web hosting provider) collect data for each access to the server (so-called server log files). The server logfiles can contain the address and name of the retrieved web pages and files, the date and time of retrieval, transferred data volumes, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP address. Addresses and the requesting provider belong.

The server log files can be used for security purposes, for example, to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and second, to ensure the utilization of the servers and their stability.

• Processed data types: Content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Affected people: Users (eg website visitors, users of online services).
• Purposes of processing: Providing our online offer and user-friendliness.
• Legal basis: Justified interests (Art. 6 para. 1 S. 1 lit. f.DSGVO).

 

Deployed services and service providers:

• neusta destination.one GmbH: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Service provider: neusta destination.one GmbH, Münchener Straße 1, 86899 Landsberg am Lech, Germany; Website: https://www.neusta-ds.de/; Data protection: https://www. neusta-ds.de/datenschutz; Data processing agreement: concluded with the provider.

 

Special notes on applications (apps)

We process the data of users of our application to the extent necessary to provide users with the application and its functionalities, to monitor its security, and to further develop it. We may also contact users in accordance with legal requirements if communication is necessary for the administration or use of the application. For further information regarding the processing of user data, please refer to the data protection information in this privacy policy.

 

Legal basis: The processing of data required to provide the functionality of the application serves to fulfill contractual obligations. This also applies if the provision of the functions requires user authorization (e.g. approval of device functions). If the processing of data is not required to provide the functionality of the application, but serves the security of the application or our business interests (e.g. collection of data for the purposes of optimizing the application or security purposes), it is carried out on the basis of our legitimate interests. If users are expressly asked for their consent to the processing of their data, the data covered by the consent is processed on the basis of the consent.

 

commercial useWe process the data of users of our application, registered users, and any test users (hereinafter collectively referred to as "users"), in order to provide them with our contractual services and, based on legitimate interests, to ensure the security of our application and to further develop it. The required information is marked as such during the conclusion of a usage, order, or similar contract and may include the information necessary for service provision and any billing, as well as contact information to facilitate any necessary follow-up.

 

Storage of a universal and unique identifier (UUID)The application stores a so-called universally unique identifier (UUID) for the purposes of analyzing application usage and functionality, as well as storing user settings. This identifier is generated during the installation of the application (but is not linked to the device, i.e., it is not a device identifier in this sense), remains stored between the start of the application and its updates, and is deleted when users remove the application from their device.

 

Processing of location dataWhen you use our application, location data collected by your device or otherwise entered by you will be processed. Using this location data requires your permission, which you can revoke at any time. Location data is used solely to provide the functionality of our application, as described to you and in accordance with its typical and expected operation.

 

No location history or movement profiles: The location data is only used selectively and is not processed to create a location history or movement profile of the devices used or their users.

• Processed data types: Inventory data (e.g. names, addresses), meta/communication data (e.g. device information, IP addresses), payment data (e.g. bank details, invoices, payment history), contract data (e.g. subject of contract, term, customer category), location data (information on the geographic position of a device or person).
• Affected people: Users (eg website visitors, users of online services).
• Purposes of processing: Provision of contractual services and customer service.
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR), performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

 

Contact and request management

When contacting us (e.g. via contact form, e-mail, telephone or via social media) and in the context of existing user and business relationships, the details of the requesting person are processed to the extent necessary to answer the contact request and any requested measures.

The answering of the contact inquiries as well as the management of contact and inquiry data within the framework of contractual or pre-contractual relationships takes place to fulfill our contractual obligations or to answer (pre)contractual inquiries and otherwise on the basis of the legitimate interests in answering the inquiries and maintenance of User or Business Relationships.

• Processed data types: Inventory data (e.g. names, addresses), contact data (e.g. email, telephone numbers), content data (e.g. entries in online forms).
• Affected people: Communication partner.
• Purposes of processing: Contact requests and communication.
• Legal basis: Performance of the contract and pre-contractual inquiries (Art. 6 para. 1 S. 1 lit. DSGVO), entitled interests (Art. 6 para. 1 S. 1 lit. f.DSGVO).

 

Communication via messenger

We use messengers for communication purposes and therefore ask you to observe the following information on the functionality of the messenger, on encryption, on the use of the communication metadata and on your options for objection.

You can also contact us in alternative ways, eg via telephone or e-mail. Please use the contact options communicated to you or the contact options specified within our on-line offer.

In the case of end-to-end content encryption (ie, the content of your message and attachments), we point out that the communication content (ie, the content of the message and attached images) is encrypted end-to-end. This means that the content of the messages is not visible, even by the messenger providers themselves. You should always use a recent version of Encrypted Messenger to ensure encryption of message content.

However, we also point out to our communication partners that messenger providers are not able to see the content, but can find out that and when communication partners communicate with us, as well as technical information about the device used by the communication partners and, depending on the settings of their device, also location information ( so-called metadata) are processed.

 

Notes on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. In addition, if we do not ask for your consent and you contact us, for example, we use Messenger in relation to our contractual partners and in the context of contract initiation as a contractual measure and in the case of other interested parties and communication partners on the basis of our legitimate interests fast and efficient communication and meeting the needs of our communication partner for communication via messenger. Furthermore, we would like to point out that we will not transmit the contact details provided to us to the messenger for the first time without your consent.

 

Revocation, opposition and cancellation: You can revoke your consent at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we will delete the messages according to our general deletion policy (ie, as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise, as soon as we can assume that we have answered any information from the communication partners, if no reference to a previous conversation is to be expected and the deletion does not conflict with statutory retention requirements.

 

Reservation of reference to other means of communication: Finally, we would like to point out that, for reasons of your security, we reserve the right not to answer inquiries via Messenger. This is the case, if, for example, internal contract matters require special secrecy or a response via messenger does not meet the formal requirements. In such cases, we refer you to more appropriate communication channels.

• Processed data types: Contact details (e.g. email, telephone numbers), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), content data (e.g. entries in online forms).
• Affected people: Communication partner.
• Purposes of processing: Contact requests and communication, direct marketing (eg by e-mail or by post).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate Interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

 

Deployed services and service providers:

• Instagram: Messaging via the social network Instagram; Service provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: www.instagram.com; Data protection: https://instagram.com/about/legal/privacy
• Facebook Messenger: Facebook Messenger with end-to-end encryption (Facebook Messenger's end-to-end encryption requires activation if it is not enabled by default); Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: www.facebook.com; Data protection: https://www.facebook.com/about/privacy; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries):  https://www.facebook.com/legal/EU_data_transfer_addendum; Order processing contract: https://www.facebook.com/legal/terms/dataprocessing.
• Microsoft Teams: Microsoft Teams - Messenger; Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://products.office.com; Data protection: https://privacy.microsoft.com/de-de/privacystatement, Safety instructions: https://www.microsoft.com/de-de/trustcenter; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

 

Video conferences, online meetings, webinars and

Screen sharing

We use third-party platforms and applications (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as “conferences”). We comply with legal requirements when selecting conference platforms and their services.

 

Data processed by conference platforms: When you participate in a conference, the conference platforms process the following personal data of the participants. The scope of this processing depends on which data is required for a specific conference (e.g., login credentials or full names) and which optional information participants provide. In addition to processing data for the purpose of conducting the conference, the conference platforms may also process participant data for security purposes or service optimization. The processed data includes personal information (first name, last name), contact information (email address, telephone number), login credentials (access codes or passwords), profile pictures, information about professional position/function, the IP address of the internet connection, information about the participants' devices, their operating system, browser and its technical and language settings, information about the content of the communication, i.e., chat entries as well as audio and video data, and the use of other available functions (e.g., surveys). Communication content is encrypted to the extent technically provided by the conference providers. If participants are registered as users on the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

 

Logging and recordings: If text entries, participation results (e.g. from surveys) as well as video or audio recordings are recorded, this will be communicated transparently to the participants in advance and they will be asked for their consent, if necessary.

 

Data protection measures of the participants: Please refer to the conference platforms' data protection notices for details of how your data is processed by them and select the security and data protection settings that are best for you in the settings of the conference platforms. Please also ensure that data and personal privacy are protected in the background of your recording for the duration of a video conference (e.g. by informing roommates, locking doors and using the function to blur the background, if technically possible). Links to the conference rooms and access data must not be passed on to unauthorized third parties.

 

Notes on legal bases: If, in addition to the conference platforms, we also process user data and ask users for their consent to use the conference platforms or certain functions (e.g. consent to a recording of conferences), the legal basis for processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g. in participant lists, in the case of processing discussion results, etc.). In addition, user data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

• Processed data types: Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta / communication data (e.g. device information, IP Addresses).
• Affected people: Communication partners, users (eg website visitors, users of online services).
• Purposes of processing: Provision of contractual services and customer service, handling contact requests and communication, office and organizational procedures.
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR), performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

 

Deployed services and service providers:

• Cisco WebEx: Conference software; Service provider: Webex Communications Deutschland GmbH, Hansaallee 249, c/o Cisco Systems GmbH, 40549 Düsseldorf, Parent company: Cisco Systems, Inc., 170 West Tasman Dr., San Jose, CA 95134, USA; Website: https://www.webex.com/de; Data protection: https://www.cisco.com/c/de_de/about/legal/privacy-full.html.
• Microsoft Teams: Messenger and conference software; Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: products.office.com; Data protection: https://privacy.microsoft.com/de-de/privacystatement, Safety instructions: https://www.microsoft.com/de-de/trustcenter; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.
• TeamViewer: Conference software; Service provider: TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany; Website: https://www.teamviewer.com/de; Data protection: https://www.teamviewer.com/de/datenschutzerklaerung/.
• Zoom: Video conferencing, web conferencing and webinars; Service provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; Website: zoom. us; Data protection: https://zoom.us/docs/de-de/privacy-and-legal.html; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries): https://zoom.us/docs/de-de/privacy-and-legal.html (Referred to as Global DPA); Data Processing Agreement: https://zoom.us/docs/de-de/privacy-and-legal.html (referred to as Global DPA).

 

Application process

The application process requires that applicants provide us with the data required for their assessment and selection. The information required can be found in the job description or, in the case of online forms, from the information provided there.

In principle, the information required includes personal information such as name, address, a contact option and evidence of the qualifications required for a position. In response to inquiries, we will also be happy to provide you with information that is required.

If available, applicants can submit their applications to us using an online form. The data is transmitted to us using state-of-the-art encryption. Applicants can also submit their applications via email. However, please note that emails are generally not encrypted when sent over the internet. While emails are usually encrypted during transmission, they are not encrypted on the servers from which they are sent and received. Therefore, we cannot assume any responsibility for the security of the application during transmission between the sender and its receipt on our server.

For the purposes of candidate sourcing, application submission and candidate selection, we may, in compliance with legal requirements, use applicant management or recruitment software and platforms as well as services from third-party providers.

Applicants are welcome to contact us about how to submit their application or to send us the application by post.

 

Processing of special categories of data: Insofar as special categories of personal data within the meaning of Article 9(1) GDPR (e.g., health data, such as information on severe disability or ethnic origin) are requested from applicants during the application process so that the controller or the data subject can exercise their rights and fulfill their obligations under employment law and social security and social protection law, this data is processed in accordance with Article 9(2)(b) GDPR. In the case of protecting the vital interests of the applicants or other persons, processing is carried out in accordance with Article 9(2)(c) GDPR, or for purposes of preventive or occupational medicine, for assessing the employee's fitness for work, for medical diagnosis, for the provision of health or social care or treatment, or for the management of health or social care systems and services.

Social sector pursuant to Art. 9 para. 2 lit. h. GDPR. In the case of disclosure of special categories of data based on voluntary consent, their processing is based on Art. 9 para. 2 lit. a. GDPR.

 

Deletion of data: If the application is successful, we can process the data provided by the applicants for the purposes of the employment relationship. Otherwise, if the application for a job offer is unsuccessful, the applicant's data will be deleted. The applicant's data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. The deletion takes place, subject to a justified revocation of the applicants, at the latest after the expiry of a period of six months, so that we can answer any follow-up questions about the application and meet our obligations to provide evidence from the regulations on equal treatment of applicants. Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

 

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to be included in the talent pool is voluntary, has no impact on the ongoing application process, and that they can withdraw their consent at any time for the future.

Duration of data storage in the applicant pool in months: 12 months.

• Processed data types: Applicant data (e.g. personal details, postal and contact addresses, the documents relating to the application and the information contained therein, such as cover letters, CVs, references and other information about the person or qualifications provided voluntarily by applicants with regard to a specific position).
• Affected people: Applicants.
• Purposes of processing: Application process (justification and any subsequent implementation as well as possible subsequent termination of the employment relationship).
• Legal basis: Application procedures as a pre-contractual or contractual relationship (Art. 9 para. 2 lit. b GDPR).

 

Cloud services

We use software services accessible via the Internet and running on the servers of their providers (so-called "cloud services", also referred to as "Software as a Service") for the following purposes: document storage and management, calendar management, email sending, spreadsheets and presentations, exchange of documents, content and information with specific recipients or publication of web pages, forms or other content and information, as well as chats and participation in audio and video conferences.

In this context, personal data can be processed and stored on the provider's servers, insofar as they are part of communication processes with us or otherwise processed by us, as set out in this data protection declaration. This data can include, in particular, master data and contact details of the users, data on transactions, contracts, other processes and their content. The cloud service providers also process usage data and metadata, which they use for security purposes and for service optimization.

If we use the cloud services to provide forms or other documents and content for other users or publicly accessible websites, the providers can place cookies on the users' devices for the purposes of web analysis or to change user settings (e.g. in the case of media control) remember, save.

Notes on legal bases: If we ask for consent to the use of cloud services, the legal basis for processing is consent. Furthermore, their use can be part of our (pre) contractual services, provided that the use of cloud services has been agreed in this context. Otherwise, user data will be processed on the basis of our legitimate interests (ie, interest in efficient and secure administrative and collaboration processes)

• Processed data types: Inventory data (e.g. names, addresses), contact data (e.g. email, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected people: Customers, employees (e.g. employees, applicants, former employees), interested parties, communication partners.
• Purposes of processing: Office and organizational procedures.
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR), performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Deployed services and service providers:

• Microsoft Cloud Services: Cloud storage, cloud infrastructure services, and cloud-based application software; service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; website: https://microsoft.com/de-de; Data protection: https://privacy.microsoft.com/de-de/privacystatement, Safety instructions: https://www.microsoft.com/de-de/trustcenter; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

 

Newsletters and Electronic Communications

We only send newsletters, emails, and other electronic notifications (hereinafter "newsletters") with the recipient's consent or where legally permitted. If the content of the newsletter is specifically described during the registration process, this description is decisive for the user's consent. Otherwise, our newsletters contain information about our services and our company.

To subscribe to our newsletters, it is generally sufficient to provide your e-mail address. However, we may ask you to provide a name for personal address in the newsletter, or other information as required for the purpose of the newsletter.

Double opt-in procedure: Subscription to our newsletter uses a double opt-in process. This means that after registering, you will receive an email asking you to confirm your subscription. This confirmation is necessary to prevent anyone from subscribing using someone else's email address. Newsletter subscriptions are logged to document the registration process in accordance with legal requirements. This includes recording the time of registration and confirmation, as well as the IP address. Changes to your data stored with the email service provider are also logged.

Deletion and limitation of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to be able to prove previously given consent. The processing of this data is limited to the purpose of defending against potential claims. An individual deletion request is possible at any time, provided that the prior existence of consent is confirmed. In cases where we are obligated to permanently respect objections, we reserve the right to store the email address solely for this purpose in a blocklist. The registration process is logged based on our legitimate interests for the purpose of documenting its proper execution. If we commission a service provider to send emails, this is done based on our legitimate interests in an efficient and secure delivery system.

Notes on legal bases: The sending of the newsletter is based on the consent of the recipient or, if consent is not required, on the basis of our legitimate interests in direct marketing, if and insofar as this is permitted by law, eg in the case of existing customer advertising. Insofar as we entrust a service provider with the sending of e-mails, this is done on the basis of our legitimate interests. The registration process is recorded on the basis of our legitimate interests in order to prove that it has been performed in accordance with the law.

Content: Information about us, our services, promotions and offers, trends in tourism and legal changes.

Measurement of open and click ratesThe newsletters contain a so-called "web beacon," i.e., a pixel-sized file that is retrieved from our server, or, if we use a mailing service provider, from their server, when the newsletter is opened. During this retrieval, technical information such as browser and system information, as well as your IP address and the time of retrieval, are collected.

This information is used to technically improve our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. This information is assigned to the individual newsletter recipients and stored in their profiles until they are deleted. The evaluations help us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

The measurement of the opening rates and click rates as well as the storage of the measurement results in the user profiles and their further processing are based on the consent of the user.

Unfortunately, a separate revocation of the performance measurement is not possible. In this case, the entire newsletter subscription must be canceled or objected to. In this case, the stored profile information will be deleted.

• Processed data types: Inventory data (eg names, addresses), contact data (eg e-mail, telephone numbers), meta / communication data (eg device information, IP addresses), usage data (eg visited websites, interest in content, access times).
• Affected people: Communication partner.
• Purposes of processing: Direct marketing (eg by e-mail or by post).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate Interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).
• Opposition possibility (opt-out): You can cancel the receipt of our newsletter at any time, ie revoke your consent, or object to further reception. You can find a link to cancel the newsletter either at the end of each newsletter or else you can use one of the above-mentioned contact options, preferrably e-mail.

 

Deployed services and service providers:

• mailingwork: Email marketing platform; Service provider: mailingwork GmbH, Birkenweg 7, 09569 Oederan, Germany; Website: https://mailingwork.de/; Data protection: https://mailingwork.de/datenschutz/.

 

 

Advertising communication via email, post, fax or telephone

We process personal data for the purposes of advertising communication, which can take place via various channels, such as e-mail, telephone, post or fax, in accordance with legal requirements.

The recipients have the right to revoke their consent at any time or to object to advertising communication at any time.

After revocation or objection, we can store the data required to prove consent for up to three years on the basis of our legitimate interests before we delete them. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the previous consent is confirmed at the same time.

• Processed data types: Inventory data (e.g. names, addresses), contact details (e.g. e-mail, telephone numbers).
• Affected people: Communication partner.
• Purposes of processing: Direct marketing (eg by e-mail or by post).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate Interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

 

Sweepstakes and competitions

We process personal data of participants in sweepstakes and competitions only in compliance with the relevant data protection regulations, insofar as the processing is contractually necessary for the provision, implementation and handling of the competition, the participants have consented to the processing or the processing serves our legitimate interests (e.g. in the Security of the competition or the protection of our interests against misuse through the possible collection of IP addresses when submitting competition entries).

If contributions by participants are published as part of the competition (e.g. in the context of a vote or presentation of the competition contributions or the winners or reporting on the competition), we point out that the names of the participants can also be published in this context. Participants can object to this at any time.

If the competition takes place within an online platform or social network (e.g., Facebook or Instagram, hereinafter referred to as "online platform"), the terms of use and privacy policies of the respective platforms also apply. In these cases, we would like to point out that we are responsible for the information provided by participants in connection with the competition and that any inquiries regarding the competition should be directed to us.

The data of the participants will be deleted as soon as the competition or the competition is over and the data is no longer required to inform the winners or because queries about the competition are to be expected. In principle, the data of the participants will be deleted no later than 6 months after the end of the competition. The winners' data can be retained for longer, for example to answer questions about the prizes or to be able to fulfill the prizes; In this case, the retention period depends on the type of profit and is, for example, up to three years for items or services, in order to be able to process warranty cases, for example. Furthermore, the data of the participants can be stored for a longer time, for example in the form of reporting on the competition in online and offline media.

If data was also collected for other purposes within the framework of the competition, its processing and storage period are based on the data protection information for this use (e.g. in the case of registering for the newsletter as part of a competition).

• Processed data types: Inventory data (e.g. names, addresses), content data (e.g. entries in online forms).
• Affected people: Sweepstakes and competition participants.
• Purposes of processing: Conducting sweepstakes and competitions.
• Legal basis: Fulfillment of the contract and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b GDPR).

 

Polls and surveys

The surveys and questionnaires we conduct (hereinafter referred to as "surveys") are evaluated anonymously. Personal data is only processed to the extent necessary for the provision and technical execution of the surveys (e.g., processing the IP address to display the survey in the user's browser or to enable resuming the survey using a temporary cookie (session cookie)) or if users have given their consent.

Notes on legal bases: If we ask participants for their consent to the processing of their data, this is the legal basis for the processing; otherwise, the processing of participants' data is based on our legitimate interests in conducting an objective survey.

• Processed data types: Contact data (e.g. email, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected people: Communication partner.
• Purposes of processing: Contact requests and communication, direct marketing (eg by e-mail or by post).  
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate Interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

 

Web analysis, monitoring and optimization

Web analytics (also known as "reach measurement") is used to evaluate visitor traffic to our online services and can include pseudonymous data on visitor behavior, interests, or demographic information such as age or gender. Reach analysis allows us, for example, to identify when our online services, their features, or content are most frequently used or encourage repeat visits. It also helps us understand which areas require optimization.

In addition to the web analysis, we can also use test methods, for example, to test and optimize different versions of our online offer or its components.

For these purposes, so-called user profiles can be created and stored in a file (a so-called "cookie") or similar methods can be used for the same purpose. This information can include, for example, viewed content, visited websites and elements used there, and technical information such as the browser used, the computer system used, and usage times. Depending on the provider, if users have consented to the collection of their location data, this may also be processed.

User IP addresses are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. Generally, no clear user data (such as email addresses or names) is stored for web analytics, A/B testing, and optimization; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is the consent. Otherwise, users' data will be processed based on our legitimate interests (ie interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (eg visited websites, interest in content, access times), meta / communication data (eg device information, IP addresses).
• Affected people: Users (eg website visitors, users of online services).
• Purposes of processing: Audience measurement (e.g. access statistics, recognition of returning visitors), profiles with user-related information (creation of user profiles).
• Safety measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate Interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Deployed services and service providers:

• Google Analytics: Reach measurement and web analysis; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com/intl/de/about/analytics/; Data protection: https://policies.google.com/privacy; Types of processing and processed data: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and standard contractual clauses for third-country data transfers: https://business.safety.google/adsprocessorterms.
• Google Tag Manager: Google Tag Manager is a solution that allows us to manage website tags via a single interface and thus integrate other services into our online offering (see further details in this privacy policy). The Tag Manager itself (which implements the tags) does not, for example, create user profiles or store cookies. Google only receives the user's IP address, which is necessary to run the Google Tag Manager. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Data protection: https://policies.google.com/privacy; Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and standard contractual clauses for third-country data transfers: https://business.safety.google/adsprocessorterms.

 

Visitor structure analysis

We use a script from emetriq GmbH to determine whether certain cookies are transmitted when you visit our website. From these cookies, we read certain statistical characteristics such as age, geographic information, and household size, which we use to analyze which user groups visit our website. The data is pseudonymized in your browser by immediately discarding the IP address after it is recorded and not storing it. Only then is the data transmitted to emetriq GmbH. The data is stored using an automatically and randomly generated cookie ID, IDFA, or AdID, which do not allow for any personal identification. The extracted characteristics have no direct link to an individual person. No analysis of your usage behavior on our website takes place. 

In addition to the option to change the cookie settings, you can also opt out of data processing via an opt-out cookie. https://www.emetriq.com/opt-out deactivate. 

Notes on legal bases: 

• Processed data types: Statistical characteristics (e.g. age, geographic information, household size).
• Affected people: Users (website visitors).
• Purposes of processing: Analysis of the structure of users who visit the website; definition of target group segments for optimized communication via the website.
• Safety measures: Pseudonymization; personal identification is not possible. Data collected via the script will be deleted no later than 180 days after collection.
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR).

Deployed services and service providers:

• emetriq: Structural analysis of website visitors; Service provider: emetriq GmbH, Vorsetzen 35, 20459 Hamburg, Germany, Website: https://www.emetriq.com; Data protection: https://www.emetriq.com/datenschutz

 

Online marketing

We process personal data for online marketing purposes, which may include in particular the marketing of advertising space or the display of advertising and other content (collectively referred to as "content") based on the potential interests of users, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (a "cookie") or similar methods are used to store user information relevant to displaying the aforementioned content. This information may include, for example, viewed content, visited websites, used online networks, as well as communication partners and technical information such as the browser used, the computer system used, and usage times. If users have consented to the collection of their location data, this data may also be processed.

The IP addresses of the users are also saved. However, we use available IP masking procedures (ie pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as e-mail addresses or names) are stored as part of the online marketing process, but pseudonyms. This means that we and the providers of the online marketing process do not know the actual identity of the users, only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or similar procedures. These cookies can later generally also on other websites that use the same online marketing method, read and analyzed for purposes of displaying content as well as be supplemented with other data and stored on the server of the online marketing process provider.

As an exception, clear data can be assigned to the profiles. This is the case if the users are, for example, members of a social network whose online marketing process we use and the network connects the profiles of the users with the aforementioned information. We ask you to note that users can make additional agreements with the providers, e.g. by giving their consent during registration.

We generally only receive access to aggregated information about the success of our advertisements. However, through conversion tracking, we can analyze which of our online marketing methods have led to a conversion, i.e., a contract signed with us. Conversion tracking is used solely to analyze the success of our marketing efforts. Unless otherwise stated, please assume that any cookies used are stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is the consent. Otherwise, users' data will be processed based on our legitimate interests (ie interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (eg visited websites, interest in content, access times), meta / communication data (eg device information, IP addresses).
• Affected people: Users (eg website visitors, users of online services).
• Purposes of processing: Marketing, profiles with user-related information (creating user profiles), conversion measurement (measuring the effectiveness of marketing measures).
• Safety measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate Interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).
• Opposition possibility (opt-out): We refer you to the privacy policies of the respective providers and the opt-out options provided by those providers. If no explicit opt-out option is specified, you can disable cookies in your browser settings. However, this may restrict the functionality of our website. We therefore also recommend the following opt-out options, which are offered for specific regions: a) Europe: www.youronlinechoices.eu, b) Canada: https://www.youradchoices.ca/choices, c) USA: https://www.aboutads.info/choices, d) Territorial: https://optout.aboutads.info.

Deployed services and service providers:

• Google Tag Manager: Google Tag Manager is a solution that allows us to manage website tags via a single interface and thus integrate other services into our online offering (see further details in this privacy policy). The Tag Manager itself (which implements the tags) does not, for example, create user profiles or store cookies. Google only receives the user's IP address, which is necessary to run the Google Tag Manager. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Data protection: https://policies.google.com/privacy; Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and standard contractual clauses for third-country data transfers: https://business.safety.google/adsprocessorterms.
• Google Analytics: Online marketing and web analytics; Service Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com/intl/de/about/analytics/; Data protection: https://policies.google.com/privacy; Opposition possibility (opt-out): opt-out plugin: tools.google.com/dlpage/gaoptout, Settings for the display of commercials: adssettings.google.com/authenticated; Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and standard contractual clauses for third-country data transfers: https://business.safety.google/adsprocessorterms.
• Google Ads and conversion measurement: We use the online marketing tool "Google Ads" to place ads in the Google advertising network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who are likely to be interested in them. We also measure the conversion rate of these ads. However, we only receive the anonymous total number of users who clicked on our ad and were redirected to a page with a "conversion tracking tag." We ourselves do not receive any information that could identify individual users. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Data protection: https://policies.google.com/privacy; Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products: Information on the services Data processing conditions between controllers and standard contractual clauses for third-country transfers of data: business.safety.google/adscontrollerterms.
• Twitter: Twitter Marketing and Advertising; Service Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Parent Company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Website: https://twitter.com/de; Data protection: https://www.facebook.com/about/privacy; Opposition possibility (opt-out): https://twitter.com/personalization.

 

Presence in social networks (social media)

We maintain an online presence within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data can be processed outside of the European Union. This can result in risks for the user because it could make it more difficult to enforce the users' rights, for example.

Furthermore, the data of the users within social networks is usually processed for market research and advertising purposes. For example, user profiles can be created on the basis of the user behavior and resulting user interests. The usage profiles can in turn be used, for example, to switch advertisements inside and outside the networks that are supposed to correspond to the interests of the users. For these purposes, cookies are usually stored on the computers of the users, in which the user behavior and the interests of the users are stored. Furthermore, in the usage profiles, data can also be stored independently of the devices used by the users (in particular if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the possibilities of opting out (opt-out), we refer to the privacy statements and information provided by the operators of the respective networks.

Also in the case of requests for information and the assertion of data subject rights, we point out that these can be claimed most effectively from the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, then you can contact us.

 

Facebook pages

We are jointly responsible with Facebook Ireland Ltd. for the collection (but not the further processing) of data from visitors to our Facebook page (so-called "fan page"). This data includes information about the types of content users view or interact with, or the actions they take (see "Things you and others do and provide" in the Facebook Data Policy). https://www.facebook.com/policies_center/), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see "Device Information" in the Facebook Data Policy: https://www.facebook.com/policies_center/)As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, known as "Page Insights," to page administrators so they can gain insights into how people interact with their pages and the content associated with them. We have a specific agreement with Facebook ("Information about Page Insights"). www.facebook.com/legal/terms/page_controller_addendum)This agreement specifically outlines the security measures Facebook must observe and commits Facebook to fulfilling data subject rights (meaning users can, for example, submit requests for information or deletion directly to Facebook). Users' rights (particularly the rights to access, deletion, objection, and lodging a complaint with the relevant supervisory authority) are not restricted by these agreements with Facebook. Further information can be found in the "Information about Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data).

• Processed data types: Contact data (e.g. email, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected people: Users (eg website visitors, users of online services).
• Purposes of processing: Contact requests and communication, feedback (e.g. collecting feedback via online form), marketing.
• Legal basis: Justified interests (Art. 6 para. 1 S. 1 lit. f.DSGVO).

 

Deployed services and service providers:

• Instagram: Social network; Service Providers: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; website: https://www.instagram.com; Data protection: https://instagram.com/about/legal/privacy.
• Facebook Pages: Profiles within the social network Facebook; Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com; Data protection: https://www.facebook.com/about/privacy; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Agreement on joint responsibility: https://www.facebook.com/legal/terms/information_about_page_insights_data.
• Pinterest: Social network; Service Provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; website: https://www.pinterest.com; Data protection: https://policy.pinterest.com/de/privacy-policy;  https://business.pinterest.com/de/pinterest-advertising-services-agreement/ (APPENDIX A: Pinterest Data Exchange Appendix).
• Twitter: Social network; Service Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, Parent Company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Data protection: twitter.com/de/privacy, (Settings) https://twitter.com/personalization.
• YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; Data protection: https://policies.google.com/privacy; Opposition possibility (opt-out): https://adssettings.google.com/authenticated.

 

Plugins and embedded functions as well as content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, graphics, videos or city maps (hereinafter uniformly referred to as "content" ).

Die Einbindung setzt immer voraus, dass die Drittanbieter dieser Inhalte die IP-Adresse der Nutzer verarbeiten, gives sie ohne die IP-Adresse die Inhalte nicht an deren Browser senden könnten. Die IP-Adresse ist damit für die Darstellung dieser Inhalte oder Funktionen erforderlich. Wir bemühen uns, nur solche Inhalte zu verwenden, deren jeweilige Anbieter die IP-Adresse lediglich zur Auslieferung der Inhalte verwenden. Drittanbieter können ferner sogenannte Pixel-Tags (unsichtbare Grafiken, auch als "Web Beacons" bezeichnet) für statistische oder Marketingzwecke verwenden. Durch die "Pixel-Tags" können Informationen, wie der Besucherverkehr auf den Seiten dieser Webseite, ausgewertet werden. Die pseudonymen Informationen können ferner in Cookies auf dem Gerät der Nutzer gespeichert werden und unter anderem technische Informationen zum Browser und zum Betriebssystem, zu verweisenden Webseiten, zur Besuchszeit sowie weitere Angaben zur Nutzung unserenden aldendendendendendendendendendenden allenden wenden alchemden wencheen wenn

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is the consent. Otherwise, users' data will be processed based on our legitimate interests (ie interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), inventory data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., entries in online forms).
• Affected people: Users (eg website visitors, users of online services).
• Purposes of processing: Provision of our online services and user-friendliness, performance of contractual services and customer service.
• Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR), consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), fulfillment of contracts and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit.b GDPR).

Deployed services and service providers:

• Google Fonts: We integrate fonts ("Google Fonts") from the provider Google, whereby user data is used solely for the purpose of displaying the fonts in the user's browser. This integration is based on our legitimate interests in the technically secure, maintenance-free, and efficient use of fonts, their uniform display, and in compliance with any applicable licensing restrictions. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://fonts.google.com/; Data protection: https://policies.google.com/privacy.
• OpenStreetMap: We integrate maps from the "OpenStreetMap" service, which are offered by the OpenStreetMap Foundation (OSMF) under the Open Data Commons Open Database License (ODbL). OpenStreetMap uses user data solely for displaying map features and temporarily storing selected settings. This data may include users' IP addresses and location data, which, however, are not collected without their consent (usually granted through their mobile device settings). Service provider: OpenStreetMap Foundation (OSMF); Website: https://www.openstreetmap.de; Data protection: https://wiki.openstreetmap.org/wiki/Privacy_Policy.
• YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; Website: www.youtube.com; Data protection: https://policies.google.com/privacy; Opt-out option: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of commercials: https://adssettings.google.com/authenticated
• YouTube videos: Video content; YouTube videos are embedded via a special domain (recognizable by the component "youtube-nocookie") in the so-called "enhanced privacy mode," which prevents the collection of cookies about user activity to personalize video playback. However, information about user interaction with the video (e.g., remembering the last playback position) may still be stored; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.youtube.com; Data protection: https://policies.google.com/privacy.

 

Management, organization and support tools

We use services, platforms, and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organizing, managing, planning, and delivering our services. We comply with legal requirements when selecting third-party providers and their services.

In this context, personal data can be processed and stored on the servers of third-party providers. This can affect various data that we process in accordance with this data protection declaration. This data can include, in particular, master data and contact details of the users, data on transactions, contracts, other processes and their content.

If users are referred to the third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party providers can process usage data and metadata for security purposes, for service optimization or for marketing purposes. We therefore ask you to observe the data protection information of the respective third party provider.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is the consent. Furthermore, their use may form part of our (pre-) contractual services, provided that the use of the third-party providers has been agreed within this framework. Otherwise, users' data will be processed based on our legitimate interests (ie interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta / communication data (e.g. device information, IP Addresses).
• Affected people: Communication partners, users (e.g. website visitors, users of online services), employees (e.g. employees, applicants, former employees), business and contractual partners.
• Purposes of processing: Contact requests and communication, reach measurement (e.g. access statistics, recognition of returning visitors), profiles with user-related information (creation of user profiles), feedback (e.g. collecting feedback via online form), office and organizational procedures.
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR), performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Deployed services and service providers:

• Basecamp: Project management tool; Service provider: Basecamp, LLC., 30 N. Racine Ave, Suite 200 Chicago, Illinois 60607, USA; Website: https://basecamp.com; Data protection: https://basecamp.com/about/policies.
• Bitly: URL shortening service and link management platform; Service provider: Bitly, Inc., 139 Fifth Avenue, 5th Floor, New York, NY 10010, USA; Website: https://bitly.com; Data protection: https://bitly.com/pages/privacy.
• Mentimeter: Creation of presentations and meetings with real-time feedback; Service provider: Mentimeter AB, Alströmergatan 22, SE-112 47 Stockholm, Sweden; Website: https://www.mentimeter.com; Data protection: https://www.mentimeter.com/policies.
• Miro: Online whiteboard and collaboration platform; Service provider: Realtimeboard Inc. dba Miro, 201 Spear Street Suite 1100, San Francisco, California 94105, USA; Website: https://miro.com/; Data protection: https://miro.com/legal/privacy-policy/.
• WeTransfer: Transfer of files over the internet; Service provider: WeTransfer BV, Oostelijke Handelskade 751, Amsterdam, 1019 BW, The Netherlands; Website: https://wetransfer.com; Data protection: https://wetransfer.com/legal/privacy.

 

 

Modification and update of the privacy policy

We ask you to regularly inform yourself about the content of our privacy policy. We will adjust the Privacy Policy as soon as the changes to the data processing we make require it. We will inform you as soon as the changes require your participation (eg consent) or other individual notification.

Sofern wir in dieser Datenschutzerklärung Adressen und Kontaktinformationen von Unternehmen und Organization in angeben, bitten wir zu beachten, dass die Adressen sich über die Zeit ändern können und bitten die Angaben vor Kontaktaufnahme zu prüfen.

 

Rights of data subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right at any time, for reasons that arise from your particular situation, against the processing of personal data relating to you, which pursuant to Art. 6 para. 1 lit. e or f DSGVO takes an objection; this also applies to profiling based on these provisions. If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail.
• Withdrawal with consent: You have the right to revoke your consent at any time.
• Right: You have the right to obtain confirmation as to whether or not data in question is being processed and to obtain information on such data, as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: You have the right, in accordance with the legal requirements, to demand the completion of the data concerning you or the correction of the incorrect data concerning you.
• Right to cancellation and limitation of processing: In accordance with the statutory provisions, you have the right to demand that data relating to you be deleted immediately, or alternatively to demand a restriction of the processing of data in accordance with the statutory provisions.
• Right to data portability: You have the right to receive data relating to you provided to us in accordance with the legal requirements in a structured, common and machine-readable format or to request their transmission to another person in charge.
• Complaint to the supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you usually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you believe that the processing of personal data relating to you infringes the GDPR.

 

Regulatory authority responsible for us:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Mailbox 20 04 44
40102 Düsseldorf
Telephone: +49 211 / 38424-0
poststelle@ldi.nrw.de 

 

Terminology and Definitions

This section provides an overview of the terminology used in this Privacy Policy. Many of the terms are taken from the law and defined above all in Art. 4 DSGVO. The legal definitions are binding. The following explanations, on the other hand, are intended above all to aid understanding. The terms are sorted alphabetically.

• IP masking: IP masking is a method in which the last octet, i.e., the last two numbers of an IP address, is deleted so that the IP address can no longer be used to uniquely identify a person. Therefore, IP masking is a means of pseudonymizing processing operations, particularly in online marketing.
• Conversion measurement: Conversion tracking (also known as "visit action analysis") is a method used to determine the effectiveness of marketing measures. This typically involves storing a cookie on users' devices within the websites where the marketing activities take place, and then retrieving it again on the target website. For example, this allows us to track whether the ads we placed on other websites were successful.
• Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Profiles with user-related information: The processing of "user-related profiles," or simply "profiling," encompasses any type of automated processing of personal data that involves using this personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this can include various information concerning demographics, behavior, and interests, such as interactions with websites and their content, etc.). Examples of such aspects include interests in specific content or products, click behavior on a website, or location. Cookies and web beacons are frequently used for profiling purposes.
• Audience measurement: The range measurement (also known as web analytics) serves to evaluate the flow of visitors to an online offer and may include the behavior or interests of visitors to certain information, such as content of websites. With the help of the range analysis, website owners can recognize, for example, at what time visitors visit their website and what content they are interested in. As a result, they can, for example, better adapt the contents of the website to the needs of their visitors. For purposes of reach analysis, pseudonymous cookies and web beacons are often used to detect returning visitors for more accurate analysis of how to use an online offer.
• Location data: Location data is created when a mobile device (or another device with the technical requirements for location determination) connects to a radio cell, a WLAN or similar technical intermediaries and functions of location determination. Location data are used to indicate the geographically determinable position on the earth at which the respective device is located. Location data can e.g. B. can be used to display map functions or other information dependent on a location.
• Responsible: The term "controller" refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, be it collection, analysis, storage, transmission, or erasure.

 

(Created with Datenschutz-Generator.de by RA Dr. med. Thomas Schwenke)