Privacy Policy

Preamble

With the following privacy policy we would like to inform you which types of your personal data (hereinafter also abbreviated as "data") we process for which purposes and in which scope. The privacy statement applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online services").

The terms used are not gender-specific.

Last Update: 15. October 2026

Controller

MTRIX GmbH

Stadtkoppel 23a

21337 Lüneburg

Phone: +49 4131 / 60 66 8 – 0

E-Mail: info@mtrix.de

Authorized representatives: Malte Johann Michael Kahrs

E-Mail address: info@mtrix.de

Imprint: www.mtrix.de/impressum

Contact information of the Data Protection Officer

PROLIANCE GmbH / www.datenschutzexperte.de

Data Protection Officer

Leopoldstr. 21

80802 Munich

datenschutzbeauftragter@datenschutzexperte.de

Overview of processing operations

The following table summarises the types of data processed, the purposes for which they are processed and the concerned data subjects.

Special categories of data

Health data.
Religious or philosophical beliefs.
Union membership.

Purposes of processing

Provision of contractual services and fulfillment of contractual obligations.
Communication.
Security measures.
Direct marketing.
Reach measurement.
Tracking.
Office and organizational procedures.
Remarketing.
Conversion measurement.
Click tracking.
Target group formation.
Organizational and administrative procedures.
Application procedures.
Feedback.
Surveys and questionnaires.
Marketing.
Profiles with user-related information.
Registration procedures.
Provision of our online offerings and user-friendliness.
Assessment of creditworthiness.
Establishment and execution of employment relationships.
Information technology infrastructure.
Financial and payment management.
Public relations.
Sales promotion.
Business processes and economic procedures.
Artificial intelligence (AI).

Automated decisions in individual cases.

Credit report.

Relevant legal bases

Relevant legal bases according to the GDPR: In the following, you will find an overview of the legal basis of the GDPR on which we base the processing of personal data. Please note that in addition to the provisions of the GDPR, national data protection provisions of your or our country of residence or domicile may apply. If, in addition, more specific legal bases are applicable in individual cases, we will inform you of these in the data protection declaration.

Consent (Article 6 (1) (a) GDPR) - The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Performance of a contract and prior requests (Article 6 (1) (b) GDPR) - Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Compliance with a legal obligation (Article 6 (1) (c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate Interests (Article 6 (1) (f) GDPR) - the processing is necessary for the protection of the legitimate interests of the controller or a third party, provided that the interests, fundamental rights, and freedoms of the data subject, which require the protection of personal data, do not prevail.
Job application process as a pre-contractual or contractual relationship (Article 6 (1) (b) GDPR) - If special categories of personal data within the meaning of Article 9 (1) GDPR (e.g. health data, such as severely handicapped status or ethnic origin) are requested from applicants within the framework of the application procedure, so that the responsible person or the person concerned can carry out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, their processing shall be carried out in accordance with Article 9 (2)(b) GDPR , in the case of the protection of vital interests of applicants or other persons on the basis of Article 9 (2)(c) GDPR or for the purposes of preventive health care or occupational medicine, for the assessment of the employee's ability to work, for medical diagnostics, care or treatment in the health or social sector or for the administration of systems and services in the health or social sector in accordance with Article 9 (2)(d) GDPR. In the case of a communication of special categories of data based on voluntary consent, their processing is carried out on the basis of Article 9 (2)(a) GDPR.
Healthcare, occupational and social security processing of special categories of personal data (Article 9 (2)(h) GDPR) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations apply to data protection in Germany. This includes in particular the Federal Data Protection Act (BDSG). In particular, the BDSG contains special provisions on the right to access, the right to erase, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated individual decision-making, including profiling. Furthermore, data protection laws of the individual federal states may apply.

Relevant legal basis according to the Swiss Data Protection Act: We process your personal data in accordance with the Swiss Federal Act on Data Protection (“Swiss DPA”). Personal data must be processed lawfully, in good faith and proportionately (Art. 6 para. 1 and 2 Swiss DPA). It may only be collected for a specific purpose that is recognisable to the data subject and may only be processed in a manner compatible with that purpose (Art. 6 para. 3 FADP). Unlike the GDPR, the Swiss DPA does not generally require private controllers to base processing on a specific legal basis from a statutory list. Therefore, there is generally no obligation to state such a legal basis for each processing activity in the privacy policy.

Reference to the applicability of the GDPR and the Swiss DPA: This privacy policy is intended to provide information in accordance with both the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). Where references are made to concepts such as the processing of personal data, legitimate interests, or special categories of data, these references are to be understood in accordance with the applicable data protection laws. Within the scope of application of the Swiss FADP, the legal interpretation of these terms is determined exclusively by Swiss law.

Security Precautions

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, transmission, securing and separation of the data. In addition, we have established procedures to ensure that data subjects' rights are respected, that data is erased, and that we are prepared to respond to data threats rapidly. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and service providers, in accordance with the principle of privacy by design and privacy by default.

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services from unauthorized access, we employ TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information that is transferred between the website or app and the user's browser (or between two servers), thereby safeguarding the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions conform to the highest security standards. When a website is secured with an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is being securely and encryptedly transmitted.

Transmission of personal data

In the course of processing personal data, it may happen that this data is transmitted to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include service providers tasked with IT duties or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and particularly conclude relevant contracts or agreements that serve to protect your data with the recipients of your data.

Data Transfer within the Organization: We may transfer personal data to other departments or units within our organisation or grant them access to it. If the data is shared for administrative purposes, it is based on our legitimate business and economic interests or occurs if it is necessary to fulfil our contractual obligations or if the data subjects have given their consent or a legal permission exists.

International Data Transfers

Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or the disclosure or transfer of data to other individuals, entities, or companies (which becomes apparent either from the postal address of the respective provider or when explicitly mentioned in the privacy policy regarding data transfer to third countries), this is always done in accordance with legal requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has been recognized as a secure legal framework by the EU Commission's adequacy decision of July 10, 2023. Additionally, we have concluded Standard Contractual Clauses with the respective providers, which comply with the EU Commission's requirements and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary level of protection, while the Standard Contractual Clauses act as an additional security measure. Should any changes occur within the DPF framework, the Standard Contractual Clauses will serve as a reliable fallback option. This ensures that your data remains adequately protected even in the event of political or legal changes.

For individual service providers, we will inform you whether they are certified under the DPF and if Standard Contractual Clauses are in place. The list of certified companies and further information about the DPF can be found on the U.S. Department of Commerce's website at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, appropriate safeguards apply, particularly Standard Contractual Clauses, explicit consent, or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.
We will inform you which of our service providers are certified under the Data Privacy Framework as part of our data protection notices.

Disclosure of Personal Data Abroad: In accordance with the Swiss Data Protection Act (Swiss DPA), we only disclose personal data abroad when an appropriate level of protection for the affected persons is ensured (Art. 16 Swiss DPA). If the Federal Council has not determined an adequate level of protection (list of states: https://www.bj.admin.ch/de/schweizerische-anerkennung-von-staaten-die-einen-angemessenen-datenschutz-gewaehrleisten), we implement alternative security measures.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has been recognized as a secure legal framework by Switzerland's adequacy decision of September 15, 2024. Additionally, we have concluded Standard Data Protection Clauses with the respective providers, which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary level of protection, while the Standard Data Protection Clauses act as an additional security measure. Should any changes occur within the DPF framework, the Standard Data Protection Clauses will serve as a reliable fallback option. This ensures that your data remains adequately protected even in the event of political or legal changes.

For individual service providers, we will inform you whether they are certified under the DPF and if Standard Data Protection Clauses are in place. The list of certified companies and further information about the DPF can be found on the U.S. Department of Commerce's website at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, appropriate safeguards apply, including international agreements, specific guarantees, FDPIC-approved Standard Data Protection Clauses, or internal company data protection regulations previously recognized by the FDPIC or a competent data protection authority of another country.

Under Art. 16 of the Swiss DPA, exceptions can be made for the disclosure of data abroad if certain conditions are met, including the consent of the affected person, contract execution, public interest, protection of life or physical integrity, publicly made data, or data from a legally provided register. Such disclosures always comply with the legal requirements.
We will inform you which of our service providers are certified under the Data Privacy Framework as part of our privacy notices.

General Information on Data Retention and Deletion

We delete personal data that we process in accordance with legal regulations as soon as the underlying consents are revoked or no further legal bases for processing exist. This applies to cases where the original purpose of processing is no longer applicable or the data is no longer needed. Exceptions to this rule exist if statutory obligations or special interests require a longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data specifically applicable to certain processing processes.

In cases where multiple retention periods or deletion deadlines for a date are specified, the longest period always prevails.
Data that is no longer stored for its originally intended purpose but due to legal requirements or other reasons are processed exclusively for the reasons justifying their retention.

Data Retention and Deletion: The following general deadlines apply for the retention and archiving according to German law:

110 Years - Fiscal Code/Commercial Code - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet as well as the necessary work instructions and other organisational documents (Section 147 Paragraph 1 No. 1 in conjunction with Paragraph 3 of the German General Tax Code (AO), Section 257 Paragraph 1 No. 1 in conjunction with Paragraph 4 of the German Commercial Code (HGB)).
8 years - Accounting documents, such as invoices, booking and expense receipts (Section 147 Paragraph 1 No. 4 and 4a in conjunction with Paragraph 3 of the German General Tax Code (AO), Section 14b Paragraph 1 of the German VAT Act (UStG), Section 257 Paragraph 1 No. 4 in conjunction with Paragraph 4 of the German Commercial Code (HGB))
6 Years - Other business documents: received commercial or business letters, copies of dispatched commercial or business letters, and other documents to the extent that they are significant for taxation purposes, for example, hourly wage slips, operating accounting sheets, calculation documents, price tags, as well as payroll accounting documents, provided they are not already accounting vouchers and cash register tapes Section (Section 147 Paragraph 1 No. 2, 3, 5 in conjunction with Paragraph 3 of the German General Tax Code (AO), Section 257 Paragraph 1 No. 2 and 3 in conjunction with Paragraph 4 of the German Commercial Code (HGB)).
3 Years - Data required to consider potential warranty and compensation claims or similar contractual claims and rights, as well as to process related inquiries, based on previous business experiences and common industry practices, will be stored for the duration of the regular statutory limitation period of three years. This period begins at the end of the year in which the relevant contractual transaction took place or the contractual relationship ended in the case of ongoing contracts (Sections 195, 199 of the German Civil Code).

Data Retention and Deletion: The following general retention and archiving periods apply under Swiss law:

10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balances, accounting vouchers and invoices, as well as all necessary working instructions and other organizational documents (Article 958f of the Swiss Code of Obligations (OR)).
10 years - Data necessary to consider potential claims for damages or similar contractual claims and rights, as well as for the processing of related inquiries based on previous business experiences and usual industry practices, will be stored for the statutory limitation period of ten years, unless a shorter period of five years is applicable, which is relevant in certain cases (Articles 127, 130 OR). Claims for rent, lease, and interest on capital, as well as other periodic services, for the delivery of food, for board and lodging, for innkeeper debts, as well as for craftsmanship, small-scale sales of goods, medical care, professional services by lawyers, legal agents, procurators, and notaries, and from the employment relationship of employees, expire after five years (Article 128 OR).

Start of the period at the end of the year: If a period does not expressly start on a specific date and lasts at least one year, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event triggering the deadline is the time at which the termination or other termination of the legal relationship takes effect.

Rights of Data Subjects

Rights of the Data Subjects under the GDPR: As data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

Right to Object: You have the right, on grounds arising from your particular situation, to object at any time to the processing of your personal data which is based on letter (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right of withdrawal for consents: You have the right to revoke consents at any time.
Right of access: You have the right to request confirmation as to whether the data in question will be processed and to be informed of this data and to receive further information and a copy of the data in accordance with the provisions of the law.
Right to rectification: You have the right, in accordance with the law, to request the completion of the data concerning you or the rectification of the incorrect data concerning you.
Right to Erasure and Right to Restriction of Processing: In accordance with the statutory provisions, you have the right to demand that the relevant data be erased immediately or, alternatively, to demand that the processing of the data be restricted in accordance with the statutory provisions.
Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, common and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. In particular, you may lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Rights of the data subjects under the Swiss DPA:

As the data subject, you have the following rights in accordance with the provisions of the Swiss DPA:

Right to information: You have the right to request confirmation as to whether personal data concerning you are being processed, and to receive the information necessary for you to assert your rights under the Swiss DPA and to ensure transparent data processing.
Right to data release or transfer: You have the right to request the release of your personal data, which you have provided to us, in a common electronic format, as well as its transfer to another data controller, provided this does not require disproportionate effort.
Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
Right to object, deletion, and destruction: You have the right to object to the processing of your data, as well as to request that personal data concerning you be deleted or destroyed.

Business Services

We process personal data of our contractual and business partners, such as Customers, Clients, Prospective Customers, Suppliers and other cooperation partners (collectively referred to as "Contractual Partners"), for the initiation, execution and settlement of contractual relationships as well as comparable legal relationships. This also includes pre-contractual measures carried out at the request of the parties and communication related to the respective contractual relationship.

Processing serves in particular to fulfil our primary and secondary contractual obligations. This includes providing the agreed services, any update and information obligations, handling warranty claims and other service disruptions, processing revocations, terminations of continuing obligations, reversals, refunds as well as handling other contract-related statements and enquiries. Both one-off contracts and ongoing contractual relationships are covered.

In particular, we process master data such as name, address and where applicable company name; contact details such as email address and telephone number; contract and service data such as subject matter of the contract, duration of the contract, order or transaction number; usage and performance data; payment and billing data; as well as communication content and histories. Where necessary, we also process data disclosed or transmitted to us in connection with carrying out an assignment.

Furthermore, we process the data to safeguard our rights and to comply with legal obligations. This particularly includes commercial law and tax law retention requirements, documentation obligations as well as possible duties of proof or accountability. Processing may also take place on the basis of our legitimate interests in proper business management, internal administration, risk control and IT security as well as in protecting our business operations and Contractual Partners against misuse or threats to data, secrets or other legal assets. This may include involving external Service Providers such as IT- and telecommunications providers, transport- or logistics companies, payment service providers, banks, tax advisors or legal advisors or other vicarious agents insofar as this is required for executing contracts or fulfilling legal obligations.

Personal data will only be passed on to third parties if this is necessary for fulfilling a contract or conducting pre-contractual measures; safeguarding legitimate interests; or complying with statutory obligations. We will inform you separately within this privacy policy about any further processing activities—particularly those undertaken for marketing purposes.

Which specific data is required in each case will be communicated to Contractual Partners during collection—for example by appropriate labelling in online forms or during personal contact.

Data will be deleted once it is no longer required for these purposes provided there are no statutory retention requirements preventing deletion. Statutory retention periods—particularly under commercial- or tax law—may require longer storage periods. Data transmitted in connection with a specific assignment will be deleted after completion of that assignment and expiration of any applicable retention period unless further statutory or contractual storage obligations exist.

Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or phone numbers); Contract data (e.g. contract object, duration, customer category); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Service recipients and clients; Prospective customers. Business and contractual partners.
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; Security measures; Communication; Office and organisational procedures; Organisational and Administrative Procedures. Business processes and management procedures.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Compliance with a legal obligation (Article 6 (1) (c) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

Online shop, order forms, e-commerce and fulfilment of services: We process our customers' data to enable them to select, purchase, or order the chosen products, goods, and related services, as well as their payment and provision, delivery, or execution. If necessary for the execution of an order, we employ service providers, particularly postal services, freight carriers, and shipping companies to carry out delivery or execution for our customers. For processing payment transactions, we use the services of banks and payment service providers. The necessary information is marked as such within the ordering or comparable acquisition process and includes the details required for delivery or provision and billing as well as contact information to facilitate any necessary consultations; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).
Provision of software and platforms: We process the data of our Customers and users (hereinafter collectively referred to as "users") in order to provide them with our contractual services and on the basis of legitimate interests to ensure the security of our offer and to develop it further. The required details are identified as such within the context of the conclusion of the agreement, order or comparable contract and include the details required for the provision of services and invoicing as well as contact information in order to be able to hold any further consultations; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Compliance with a legal obligation (Article 6 (1) (c) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Consulting: We process the data of our clients as well as prospects and other commissioning parties or contractual partners (collectively referred to as "clients") in order to be able to provide our services to them. The processes that are part of and for the purposes of consulting include: contacting and communicating with clients, conducting needs and requirements analyses, planning and implementing consulting projects, documenting project progress and results, capturing and managing client-specific information and data, scheduling and organising appointments, providing consulting resources and materials, invoicing and payment management, post-processing and follow-up of consulting projects, quality assurance and feedback processes. The processed data, the nature, scope, purpose, and necessity of their processing are determined by the underlying contractual relationship with the client.
If it is necessary for our contract performance, for the protection of vital interests or legally required, or if there is consent from the clients, we disclose or transmit client data in compliance with professional legal requirements to third parties or agents such as authorities, subcontractors or in the field of IT, office or similar services; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).
IT services: We process the data of our clients as well as contractors to enable them to plan, implement, and support IT solutions and associated services. The required information is marked as such during the contract, project, or similar agreement phase and includes details necessary for service provision and billing, as well as contact information to facilitate any necessary consultations. Insofar as we gain access to information from end customers, employees, or other individuals, we process this in accordance with legal and contractual requirements.
Another process is customer relationship management (CRM), which includes recording and analyzing customer interactions and feedback to improve service quality and efficiently address individual customer needs. Additionally, the processing process includes technical support and troubleshooting, which involves capturing and processing support requests, bug fixes, and regular maintenance.

Processing processes include project management and documentation, which cover all phases from initial requirement analysis to project completion. This involves creating and managing project timelines, budgets, and resource allocations. Data processing also supports change management, where changes in the project flow are documented and tracked to ensure compliance and transparency.
Another process is customer relationship management (CRM), which involves recording and analyzing customer interactions and feedback to improve service quality and efficiently address individual customer needs. Additionally, the processing process encompasses technical support and trouble-shooting, which includes capturing and handling support requests, error resolutions, and regular maintenance.

Furthermore, reporting and performance analysis are conducted by capturing and evaluating performance metrics to assess the effectiveness of provided IT solutions continuously optimizing them. All these processes are aimed at ensuring high customer satisfaction and compliance with all relevant regulations; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Compliance with a legal obligation (Article 6 (1) (c) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Project and development services: WWe process the data of our customers and clients (hereinafter uniformly referred to as "customers") in order to enable them to select, acquire or commission the selected services or works as well as associated activities and to pay for and make available such services or works or to perform such services or works.

The required information is indicated as such within the framework of the conclusion of the agreement, order or equivalent contract and includes the information required for the provision of services and invoicing as well as contact information in order to be able to hold any consultations. Insofar as we gain access to the information of end customers, employees or other persons, we process it in accordance with the legal and contractual requirements; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).
Logistics services: We process the data of our customers and clients (uniformly referred to as "customers") for the planning, execution, and billing of transportation and logistics services. The necessary information is indicated as such at the time of order placement and includes the details required for service provision and billing, as well as contact information in order to be able to hold any consultations. Insofar as we gain access to information from end customers, employees, or other persons, we process it in accordance with legal and contractual requirements; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Compliance with a legal obligation (Article 6 (1) (c) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).

Business processes and procedures

Personal data of service recipients and clients - including customers, clients, or in specific cases, mandates, patients, or business partners as well as other third parties - are processed within the framework of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relations. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting, and project management.

The collected data is used to fulfil contractual obligations and make business processes efficient. This includes the execution of business transactions, the management of customer relationships, the optimisation of sales strategies, and ensuring internal invoicing and financial processes. Additionally, the data supports the protection of the rights of the controller and promotes administrative tasks as well as the organisation of the company.

Personal data may be transferred to third parties if necessary for fulfilling the mentioned purposes or legal obligations. After legal retention periods expire or when the purpose of processing no longer applies, the data will be deleted. This also includes data that must be stored for longer periods due to tax law and legal obligations to provide evidence.

Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Contract data (e.g. contract object, duration, customer category); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties). Log data (e.g. log files concerning logins or data retrieval or access times.).
Data subjects: Service recipients and clients; Customers; Prospective customers; Communication partner (Recipients of e-mails, letters, etc.); Business and contractual partners; Third parties. Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; Office and organisational procedures; Business processes and management procedures; Security measures; Provision of our online services and usability; Communication; Marketing; Sales promotion; Public relations; Financial and Payment Management. Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)).
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR). Compliance with a legal obligation (Article 6 (1) (c) GDPR).

Further information on processing methods, procedures and services used:

Customer management and customer relationship management (CRM): Processes required in the context of customer management and Customer Relationship Management (CRM) include customer acquisition in compliance with data protection regulations, measures to promote customer retention and loyalty, effective customer communication, complaint management and customer service with consideration of data protection, data management and analysis to support the customer relationship, management of CRM systems, secure account management, customer segmentation and targeting; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Contact management and contact maintenance: Processes required in the context of organizing, maintaining, and securing contact information (e.g., setting up and maintaining a central contact database, regular updates of contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, conducting backups and restorations of contact data, training employees in effective use of contact management software, regular review of communication history and adjustment of contact strategies); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Customer account: Customers can create an account within our online offer (e.g. customer or user account, "customer account" for short). If the registration of a customer account is required, customers will be informed of this as well as of the details required for registration. The customer accounts are not public and cannot be indexed by search engines. In the course of registration and subsequent registration and use of the customer account, we store the IP addresses of the contractual partners along with the access times, in order to be able to prove the registration and prevent any misuse of the customer account. If the customer account has been terminated, the customer account data will be deleted after the termination date, unless it is retained for purposes other than provision in the customer account or must be retained for legal reasons (e.g. internal storage of customer data, order transactions or invoices). It is the customers' responsibility to back up their data when terminating the customer Account; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
General payment transactions: Procedures required for carrying out payment transactions, monitoring bank accounts, and controlling payment flows (e.g., creation and verification of transfers, processing of direct debit transactions, checking of account statements, monitoring of incoming and outgoing payments, management of chargebacks, account reconciliation, cash management); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Accounting, accounts payable, accounts receivable: Procedures required for the collection, processing, and control of business transactions in the area of accounts payable and receivable accounting (e.g., creation and verification of incoming and outgoing invoices, monitoring and management of outstanding items, execution of payment transactions, handling of dunning processes, account reconciliation within the scope of receivables and payables, accounts payable accounting, and accounts receivable accounting); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Compliance with a legal obligation (Article 6 (1) (c) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Financial accounting and taxes: Procedures required for the collection, management, and control of finance-related business transactions as well as for the calculation, reporting, and payment of taxes (e.g., accounting and posting of business transactions, preparation of quarterly and annual financial statements, execution of payment transactions, handling of dunning processes, account reconciliation, tax consulting, preparation and submission of tax returns, management of tax affairs); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Compliance with a legal obligation (Article 6 (1) (c) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Purchasing: Processes required in the procurement of goods, raw materials, or services (e.g., selection and evaluation of suppliers, price negotiations, placement and monitoring of orders, inspection and control of deliveries, invoice verification, management of orders, inventory management, creation and maintenance of purchasing policies); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Sales: Procedures required for the planning, implementation, and control of measures for marketing and selling products or services (e.g., customer acquisition, preparation and tracking of offers, order processing, customer consultation and support, sales promotion, product training, sales controlling and analysis, management of distribution channels); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Marketing, advertising, and sales promotion: Processes required in the context of marketing, advertising, and sales promotion (e.g., market analysis and audience targeting, development of marketing strategies, planning and execution of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade show participation, customer loyalty programs, sales promotion measures, performance measurement and optimisation of marketing activities, budget management and cost control); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Public relations: Processes required in the context of public relations and public relations activities (e.g., development and implementation of communication strategies, planning and execution of PR campaigns, creation and distribution of press releases, maintenance of media contacts, monitoring and analysis of media response, organisation of press conferences and public events, crisis communication, creation of content for social media and corporate websites, management of corporate branding); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).

Providers and services used in the course of business operations

As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (in short, "services") in compliance with legal requirements. Their use is based on our interests in the proper, legal and economic management of our business operations and internal organization.

Types of processed data: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and email addresses or phone numbers); content data (e.g., textual or visual messages and posts as well as related information, such as authorship or creation time); contract data (e.g., subject matter of the contract, duration, customer category); usage data (e.g., page views and duration of visits, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Affected persons: Service recipients and clients; interested parties; business and contractual partners; employees (e.g., staff, applicants, temporary workers, and other employees). Communication partners.
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and economic procedures; conversion measurement (measuring the effectiveness of marketing measures); marketing; provision of our online offerings and user-friendliness. Communication.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

DATEV: Provision of cloud applications for accounting, payroll, document and data exchange, as well as collaboration with tax consulting and companies. Processing, storage, and transmission of data in data centers (servers) for the use of the respective applications; Service provider: DATEV eG, Paumgartnerstr. 6 - 14, 90429 Nuremberg, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.datev.de/web/de/mydatev/datev-cloud-anwendungen/; Privacy policy: https://www.datev.de/web/de/berufsgruppenuebergreifend/ueber-datev/datenschutz-und-compliance/datenschutz-und-unternehmenssicherheit. Data processing agreement: Provided by the service provider.
Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.
UPS: Logistics company that offers shipping and delivery services. We share certain personal data with UPS to enable the shipping and delivery of packages. This information may include the name, address, and contact details of the recipients; Service provider: UPS Europe SA, Ave Ariane 5, Brussels, B-1200, Belgium; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.ups.com/. Privacy policy: https://www.ups.com/de/de/support/shipping-support/legal-terms-conditions/privacy-notice.page.

Payment methods

Within the framework of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use other service providers for this purpose in addition to banks and credit institutions (collectively referred to as "payment service providers"). Payment transactions are carried out exclusively via encrypted connections in accordance with the state of the art, ensuring that the data entered is protected from unauthorized access during transmission.

The data processed by the payment service providers includes inventory data, such as the name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as the contract, total and recipient-related information. The information is required to carry out the transactions. However, the data entered is only processed by the payment service providers and stored with them. I.e. we do not receive any account or credit card related information, but only information with confirmation or negative information of the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. The purpose of this transmission is to check identity and creditworthiness. Please refer to the terms and conditions and data protection information of the payment service providers.
The terms and conditions and data protection information of the respective payment service providers apply to the payment transactions and can be accessed within the respective websites or transaction applications. We also refer to these for further information and the assertion of revocation, information and other data subject rights.

Processed types of data: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history); Contract data (e.g. contract object, duration, customer category); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties).
Data Subjects: Service recipients and clients; Business and contractual partners. Prospective customers.
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations. Business processes and management procedures.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Performance of a contract and prior requests (Article 6 (1) (b) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

PayPal: Payment-Service-Provider (technical integration of online-payment-methods) (e.g. PayPal, PayPal Plus, Braintree, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Website:https://www.paypal.com. Privacy Policy:https://www.paypal.com/de/legalhub/paypal/privacy-full.

Credit Assessment

Insofar as we make advance payments or enter into comparable economic risks (e.g. when ordering on account), we reserve the right to obtain identity and credit information from specialised service providers (credit agencies) for the purpose of assessing the credit risk on the basis of mathematical-statistical procedures in order to safeguard legitimate interests.

We process the information received from credit agencies on the statistical probability of non-payment as part of an appropriate discretionary decision on the establishment, execution and termination of the contractual relationship. In the event of a negative result of the credit assessment, we reserve the right to refuse payment on account or any other advance payment.

In accordance with the law, the decision as to whether we will provide goods or services prior to payment is made solely on the basis of an automated decision in the individual case, which our software makes on the basis of the information provided by the credit agency.

If we obtain the express consent of contractual partners, the legal basis for the credit information and the transmission of the customer's data to the credit agencies is consent. If no consent is obtained, the credit rating will be based on our legitimate interests in the security of our payment claims.

Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or phone numbers); Contract data (e.g. contract object, duration, customer category); Creditworthiness Data (e.g. received credit score, estimated default probability, risk classification based on this, historical payment behaviour). Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features).
Data subjects: Service recipients and clients; Prospective customers. Business and contractual partners.
Purposes of processing and legitimate interests: Assessment of creditworthiness.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Automated individual decision-making: Credit report (Decision based on a credit report).

Further information on processing methods, procedures and services used:

Verband der Vereine Creditreform e.V.: Credit agency; Service provider: Verband der Vereine Creditreform e.V., Hammfelddamm 13, 41460 Neuss, Germany; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website:https://www.creditreform.de/. Privacy Policy:https://www.creditreform.de/datenschutz.

Provision of online services and web hosting

We process user data in order to be able to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user's browser or terminal device.

Processed data types: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties); Log data (e.g. log files concerning logins or data retrieval or access times.). Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of our online services and usability; Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)). Security measures.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Provision of online offer on rented hosting space: For the provision of our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also referred to as a "web hoster"); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Collection of access data and log files: Access to our online service is logged in the form of so-called "server log files". Server log files may include the address and name of the accessed web pages and files, date and time of access, transferred data volumes, notification of successful retrieval, browser type along with version, the user's operating system, referrer URL (the previously visited page), and typically IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, known as DDoS attacks), and to ensure server load management and stability; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR). Retention period: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data, the further storage of which is necessary for evidence purposes, are excluded from deletion until the respective incident has been finally clarified.
Email sending and hosting: The web hosting services we use also include sending, receiving and storing e-mails. For these purposes, the addresses of the recipients and senders, as well as other information relating to the sending of e-mails (e.g. the providers involved) and the contents of the respective e-mails are processed. The above data may also be processed for SPAM detection purposes. Please note that e-mails on the Internet are generally not sent in encrypted form. As a rule, e-mails are encrypted during transport, but not on the servers from which they are sent and received (unless a so-called end-to-end encryption method is used). We can therefore accept no responsibility for the transmission path of e-mails between the sender and reception on our server; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Google Server Cloud: Hosting services for odoo.sh.

Use of cookies

The term "Cookies" refers to functions that store and read information on users' devices. Cookies can also be used for various purposes, such as functionality, security, and convenience of online services, as well as for creating analyses of visitor traffic. We use cookies in accordance with legal regulations. For this, we obtain the users' consent in advance when necessary. If consent is not required, we rely on our legitimate interests. This applies when storing and reading information is essential to provide explicitly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online services. Consent can be revoked at any time. We clearly inform about the scope and which cookies are used.

Notes on data protection legal bases: Whether we process personal data using cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their device (e.g., browser or mobile application).
Permanent cookies: Permanent cookies remain stored even after the device is closed. For example, the login status can be saved and preferred content can be displayed directly when the user revisits a website. Similarly, user data collected through cookies can be used for reach measurement. Unless we provide users with explicit information about the type and duration of cookie storage (e.g., as part of obtaining consent), they should assume that these are permanent and the storage duration can be up to two years.

General information on revocation and objection (opt-out): Users can revoke the consents they have given at any time and also declare an objection to the processing in accordance with legal requirements, including through the privacy settings of their browser.

Cookie settings/objection options:

Change cookie settings

Types of processed data: Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Data subjects: Users (e.g. website visitors, users of online services).
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further information on processing methods, procedures and services used:

Processing of cookie data based on consent: We use a consent management solution that obtains user consent for the use of cookies or for the procedures and providers mentioned in the consent management solution. This procedure serves to obtain, log, manage, and revoke consents, particularly regarding the use of cookies and similar technologies that are used to store, read, and process information on users' devices. As part of this procedure, user consents for the use of cookies and the associated processing of information, including the specific processing and providers mentioned in the consent management procedure, are obtained. Users also have the option to manage and revoke their consents. The consent declarations are stored to avoid repeated queries and to be able to provide proof of consent in accordance with legal requirements. The storage is done server-side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies to be able to assign the consent to a specific user or their device. If there are no specific details about the providers of consent management services, the following general notes apply: The duration of consent storage is up to two years. A pseudonymous user identifier is created, which is stored together with the time of consent, the details of the scope of consent (e.g., relevant categories of cookies and/or service providers), as well as information about the browser, the system, and the device used; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
Cookie Consent Manager CCM19: Storage and management of consents (consent to cookies and data processing), logging of user decisions, display of notices regarding data protection and cookies, enabling users to withdraw or adjust consents; Service provider: Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany; Website: https://www.ccm19.de/; Privacy policy: https://www.ccm19.de/datenschutzerklaerung.html. Further information: A pseudonymous user ID with the consent status is stored.

Registration, login, and user account

Users can create a user account. During registration, users are informed of the required mandatory information and processed for the purpose of providing the user account based on contractual obligations. The processed data includes, in particular, the login information (username, password, and an email address).

In the context of using our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests as well as those of the users in protection against abuse and other unauthorized use. This data is generally not shared with third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users can be informed via email about processes that are relevant to their user account, such as technical changes.

Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts as well as related information, such as authorship details or creation time); Usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Log data (e.g., log files regarding logins or data retrieval or access times).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures; organizational and administrative procedures. Provision of our online offerings and user-friendliness.
Retention and deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion". Deletion after termination.
Legal bases: Performance of a contract and prior requests (Article 6 (1) (b) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

Registration with real names: Due to the nature of our community, we ask users to use our service only with real names. That is, the use of pseudonyms is not permitted; Legal bases: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).
User profiles are not public: User profiles are not visible or accessible to the public.
Two-factor authentication: Two-factor authentication provides an additional layer of security for your user account and ensures that only you can access your account, even if someone else knows your password. For this purpose, you must perform an additional authentication measure in addition to your password (e.g., enter a code sent to a mobile device). We will inform you about the procedure we use; Legal bases: Fulfillment of the contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Single sign-on login

"Single sign-on" or "single sign-on login or "-authentication" refers to procedures that allow users to log in using a user account with a single sign-on provider (e.g., a social network), including our online offering. A prerequisite for single sign-on authentication is that users are registered with the respective single sign-on provider and enter the required access data in the designated online form, or are already logged in with the single sign-on provider and confirm the single sign-on login via a button.

Authentication takes place directly with the respective Single Sign-On provider. As part of such authentication, we receive a user ID with the information that the user is logged in under this user ID with the respective Single Sign-On provider and an ID (so-called "User Handle") that cannot be used by us for other purposes. Whether additional data is transmitted to us depends solely on the Single Sign-On method used, the chosen data releases during authentication, and also on which data users have released in the privacy or other settings of their user account with the Single Sign-On provider. Depending on the Single Sign-On provider and the user's choice, this can vary; typically, it is the email address and the username. The password entered during the Single Sign-On process with the Single Sign-On provider is neither visible to us nor stored by us.

Users are asked to note that their stored information with us can be automatically matched with their user account at the Single Sign-On provider, but this is not always possible or actually occurs. If, for example, users change their email addresses, they must manually change them in their user account with us.

We can use the Single Sign-On login, if agreed with the users, as part of or before the fulfillment of the contract, as long as the users have been asked to process it within the framework of consent, and otherwise we use it based on our legitimate interests and the interests of the users in an effective and secure login system.

If users decide that they no longer want to use the link of their user account with the Single Sign-On provider for the Single Sign-On process, they must revoke this connection within their user account with the Single Sign-On provider. If users want to delete their data with us, they must cancel their registration with us.

Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or phone numbers); usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures; registration procedures. Provision of our online offerings and user-friendliness.
Retention and deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion". Deletion after termination.
Legal bases: Performance of a contract and prior requests (Article 6 (1) (b) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

Auth0: Authentication services for user logins, provision of Single Sign-On features, management of identity information and application integrations; Service provider: Auth0, Inc, 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://auth0.com/; Privacy policy: https://www.okta.com/privacy-policy/. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
Microsoft Single Sign-On: Authentication services for user logins, provision of single sign-on features, management of identity information and application integrations; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.microsoft.com/de-de/security/business/identity-access/azure-active-directory-single-sign-on; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Further information: https://www.microsoft.com/de-de/trust-center.
OpenID Single Sign-On: Authentication services for user logins, provision of single sign-on features, management of identity information and application integrations; Service provider: OpenID Foundation, 2400 Camino Ramon, Suite 375, San Ramon, CA 94583, USA; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://openid.net; Privacy policy: https://openid.net/policies/. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).

Blogs and publication media

We use blogs or similar means of online communication and publication (hereinafter "publication medium"). The data of the readers will only be processed for the purposes of the publication medium to the extent necessary for its presentation and the communication between authors and readers or for security reasons. Furthermore, we refer to the information regarding the processing of visitors to our publication medium within the framework of this privacy notice.

Processed types of data: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts as well as the related information, such as details about authorship or time of creation); Usage data (e.g., page views and duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); Payment data (e.g., bank details, invoices, payment history). Contract data (e.g., subject matter of the contract, duration, customer category).
Affected persons: Users (e.g., website visitors, users of online services); recipients of services and clients; employees (e.g., staff, applicants, temporary workers, and other employees); interested parties. Business and contractual partners.
Purposes of processing and legitimate interests: Feedback (e.g. collecting feedback via online form); provision of our online services and user-friendliness; provision of contractual services and fulfillment of contractual obligations; conversion measurement (measuring the effectiveness of marketing measures). Marketing.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.

Contact and inquiry management

When contacting us (e.g. by mail, contact form, email, phone, or via social media) and in the context of existing user and business relationships, the information of the inquiring individuals is processed as far as necessary to respond to the contact inquiries and any requested actions.

Processed data types: Contact data (e.g. postal and email addresses or phone numbers); content data (e.g. textual or visual messages and posts as well as the related information, such as details about authorship or time of creation); meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, involved persons); inventory data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter of the contract, duration, customer category). Usage data (e.g. page views and duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).
Affected individuals: communication partners; service recipients and clients; employees (e.g. staff, applicants, temporary workers, and other employees); interested parties. Business and contractual partners.
Purposes of processing and legitimate interests: Communication; organizational and administrative procedures; feedback (e.g. collecting feedback via online form); provision of our online services and user-friendliness; provision of contractual services and fulfillment of contractual obligations; conversion measurement (measuring the effectiveness of marketing measures). Marketing.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further information on processing methods, procedures and services used:

Contact form: When contacting us via our contact form, by email, or other communication methods, we process the personal data you provide to respond to and address the respective concern. This usually includes information such as name, contact information, and any other information that may be provided and is necessary for appropriate processing. We use this data solely for the stated purpose of contacting and communicating; Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.

Artificial Intelligence (AI)

We use Artificial Intelligence (AI), whereby personal data is processed. The specific purposes and our interest in the use of AI are mentioned below. By AI, we understand according to the term "AI system" as defined in Article 3 No. 1 of the AI Regulation, a machine-supported system that is designed for a varying degree of autonomous operation, can be adaptable after its introduction, and produces results such as predictions, content, recommendations, or decisions from the received inputs, which can influence physical or virtual environments.

Our AI systems are used in strict compliance with legal requirements. These include both specific regulations for Artificial Intelligence and data protection provisions. In doing so, we particularly adhere to the principles of legality, transparency, fairness, human control, purpose limitation, data minimization, and integrity as well as confidentiality. We ensure that the processing of personal data always occurs on a legal basis. This can either be the consent of the affected individuals or a legal permission.

When using external AI systems, we carefully select their providers (hereinafter referred to as "AI providers"). In accordance with our legal obligations, we ensure that the AI providers comply with the applicable regulations. We also observe our obligations when using or operating the acquired AI services. The processing of personal data by us and the AI providers occurs solely on the basis of consent or legal authorization. We place particular emphasis on transparency, fairness, and the preservation of human control over AI-supported decision-making processes.

To protect the processed data, we implement appropriate and robust technical as well as organizational measures. These ensure the integrity and confidentiality of the processed data and minimize potential risks. Through regular reviews of the AI providers and their services, we ensure ongoing compliance with current legal and ethical standards.

Processed data types: Content data (e.g., textual or visual messages and posts as well as the information related to them, such as details about authorship or the time of creation); Usage data (e.g., page views and duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., postal and email addresses or phone numbers); Contract data (e.g., subject matter of the contract, duration, customer category). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Affected persons: Users (e.g., website visitors, users of online services); third parties; service recipients and clients; employees (e.g., staff, applicants, temporary workers, and other employees); interested parties. Business and contractual partners.
Purposes of processing and legitimate interests: Artificial Intelligence (AI); provision of contractual services and fulfillment of contractual obligations; conversion measurement (measuring the effectiveness of marketing measures); marketing; provision of our online offerings and user-friendliness; office and organizational procedures. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Google Gemini: AI-supported system developed to provide advanced speech and image processing functions. It uses machine learning to understand, generate natural language, and analyze images, thus offering versatile application possibilities in various fields; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://cloud.google.com/; Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/processorterms/?hl=de. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://business.safety.google/processorterms/?hl=de), Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://business.safety.google/processorterms/?hl=de).
Microsoft Copilot: Microsoft Copilot: Assistance in creating and editing texts, spreadsheets, and presentations, analyzing data, automating tasks, and integrating into Office applications. It processes content data (files, conversations, metadata) as well as employee eligibility credentials (Org-ID/Entra ID) for the purposes of efficiency and productivity improvements, cost efficiency, flexibility, mobility, and integration with M365. Chat histories are stored for up to 30 days, content until deleted by the user. Additionally, diagnostic data is collected for product stability and improvement; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-copilot/organizations; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.
Claude API: Interface access (so-called "API") to AI-based services designed to understand and generate natural language and related inputs, analyze information, and make predictions ("AI", i.e., "Artificial Intelligence", is to be understood in the applicable legal sense of the term). The provision of AI services includes the processing (including collection, storage, organization, and structuring) of personal data as part of a natural language-based machine learning process; conducting activities to verify or maintain the quality of the services; identifying and correcting errors that impair the existing intended functionality, as well as supporting the assurance of the security and integrity of the AI services; Service provider: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.anthropic.com/; Privacy policy: https://www.anthropic.com/legal/privacy; Data processing agreement: https://www.anthropic.com/legal/data-processing-addendum. Basis for third country transfers: EU/EEA - Standard contractual clauses (https://www.anthropic.com/legal/data-processing-addendum), Switzerland - Standard contractual clauses (https://www.anthropic.com/legal/data-processing-addendum).

Video conferences, online meetings, webinars, and screen sharing

We use platforms and applications from other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as "conference"). In selecting the conference platforms and their services, we comply with legal requirements.

Data processed by conference platforms: In the context of participating in a conference, the conference platforms process the personal data of the participants mentioned below. The scope of processing depends on which data is required for a specific conference (e.g., provision of access credentials or real names) and which optional information is provided by the participants. In addition to processing for the conduct of the conference, the participants' data may also be processed by the conference platforms for security purposes or service optimization. The processed data includes personal data (first name, last name), contact information (email address, phone number), access data (access codes or passwords), profile pictures, information about professional position/function, the IP address of the internet access, information about the participants' devices, their operating system, the browser and its technical and language settings, information about the content of communication processes, i.e., inputs in chats as well as audio and video data, as well as the use of other available functions (e.g., surveys). The content of communications is encrypted to the extent technically provided by the conference providers. If the participants are registered as users on the conference platforms, additional data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text inputs, participation results (e.g., from surveys), as well as video or audio recordings are logged, this will be transparently communicated to the participants in advance, and they will be asked for consent if necessary.

Data protection measures of the participants: Please note the details of the processing of your data by the conference platforms, their privacy notices, and select the optimal security and privacy settings for you within the settings of the conference platforms. Please also ensure data and personal protection during a video conference in the background of your recording (e.g., by informing housemates, locking doors, and using, as far as technically possible, the function to blur the background). Links to the conference rooms and access data must not be shared with unauthorized third parties.

Notes on legal bases: If we also process user data in addition to the conference platforms and ask users for their consent to use the conference platforms or certain functions (e.g., consent to a recording of conferences), the legal basis for processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g., in participant lists, in the case of processing conversation results, etc.). Otherwise, user data is processed based on our legitimate interests in efficient and secure communication with our communication partners.

Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts as well as related information, such as authorship details or creation time); Usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Image and/or video recordings (e.g., photographs or video recordings of a person); Audio recordings; Log data (e.g., log files regarding logins or data retrieval or access times.); Contract data (e.g., subject matter of the contract, duration, customer category). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Affected persons: Communication partners; users (e.g., website visitors, users of online services); depicted persons; service recipients and clients; interested parties. Participants.
Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; communication; office and organizational procedures. Provision of our online offerings and user-friendliness.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Microsoft Teams: Use for conducting online events, conferences, and communication with internal and external participants. Voice transmission, direct messaging, group communication, and collaboration features are used; processed are name, business contact details, work profile, participation, and content (audio/video, speech, chat, files, speech transcription) for purposes and out of interest in efficiency and productivity increases, cost efficiency, flexibility, mobility, improved communication, IT security, use of a central platform, and business transactions of Microsoft. Audio signals are generally not stored, except when recording is activated. Meeting and conference recordings are stored for 90 days by default, unless a different duration is specified. Chat and file contents are stored according to the guidelines set by the administrator or user; there is no automatic deletion by default. Channels must be renewed every 180 days, otherwise, content will be deleted. Additionally, system-generated log, diagnostic, and metadata are processed, and diagnostic data is collected for product stability, security, and improvement; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-teams/; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
TeamViewer: Conference and communication software; Service provider: TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.teamviewer.com/de/. Privacy policy: https://www.teamviewer.com/de/legal/privacy-and-cookies/.

Cloud services

We use software services accessible over the internet and executed on the servers of their providers (so-called "cloud services", also referred to as "software as a service") for the storage and management of content (e.g., document storage and management, exchange of documents, content, and information with specific recipients, or publication of content and information).

In this context, personal data may be processed and stored on the servers of the providers, as far as they are part of communication processes with us or otherwise processed by us, as outlined in this privacy policy. This data may include in particular master data and contact data of users, data on transactions, contracts, other processes, and their contents. The providers of the cloud services also process usage data and metadata, which they use for security purposes and service optimization.

If we provide forms or other documents and content for other users or publicly accessible websites with the help of cloud services, the providers may store cookies on the users' devices for the purposes of web analysis or to remember user settings (e.g., in the case of media control).

Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts as well as related information, such as authorship details or creation time); Usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Image and/or video recordings (e.g., photographs or video recordings of a person); Payment data (e.g., bank details, invoices, payment history); Contract data (e.g., subject matter of the contract, duration, customer category). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Affected persons: Interested parties; communication partners; business and contractual partners; service recipients and clients. Employees (e.g., staff, applicants, temporary workers, and other employees).
Purposes of processing and legitimate interests: Office and organizational procedures; IT infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); provision of contractual services and fulfillment of contractual obligations; conversion measurement (measuring the effectiveness of marketing measures); marketing. Providing our online offerings and user-friendliness.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Adobe Creative Cloud: Cloud storage, cloud infrastructure services, and cloud-based application software, including for photo editing, video editing, graphic design, web development; Service providers: Adobe Systems Software Ireland, 4-6, Riverwalk Drive, Citywest Business Campus, Brownsbarn, Dublin 24, D24 DCW0, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.adobe.com/de/creativecloud.html; Privacy policy: https://www.adobe.com/de/privacy.html; Data processing agreement: Provided by the service provider. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (Provided by the service provider).
Microsoft 365 and Microsoft Cloud Services: Provision of applications, protection of data and IT systems, as well as use of system-generated log, diagnostic, and metadata for contract execution by Microsoft. Contact data (name, email address), content data (files, comments, profiles), software setup and inventory data, device connectivity and configuration data, work interactions (badge swipe), and log and metadata are processed. The processing is carried out for the purposes of efficiency and productivity increases, cost efficiency, flexibility, mobility, improved communication, integration of Microsoft services, IT security, and business operations of Microsoft. Data retention is governed by the respective documents and company policies, with the Defender (protection of data and IT systems) up to 12 months, and print management 10 days. Additionally, diagnostic data is collected for product stability and improvement; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.microsoft.com/de-de; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement, Security notices: https://www.microsoft.com/de-de/trustcenter; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
Nextcloud (Hosting on own server): Cloud storage service, where the operation and storage of the processed data take place on a server managed by us; Service provider: Nextcloud GmbH, Hauptmannsreute 44a, 70192 Stuttgart, Germany; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://nextcloud.com/de/. Privacy policy: https://nextcloud.com/de/privacy/.
Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.

Newsletter and electronic notifications

We send newsletters, emails, and other electronic notifications (hereinafter "newsletters") solely with the consent of the recipients or based on a legal basis. If the contents of the newsletter are mentioned during the registration process, these contents are decisive for the users' consent. Normally, providing your email address is sufficient for signing up for our newsletter. However, to offer you a personalized service, we may ask for your name for personal addressing in the newsletter or for additional information if this is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We can store the unsubscribed email addresses for up to three years based on our legitimate interests before we delete them, in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of potential defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blocking list (so-called "blocklist").

The logging of the registration process is carried out based on our legitimate interests for the purpose of proving its proper course. If we engage a service provider to send emails, this is done based on our legitimate interests in an efficient and secure mailing system.

Contents:

Information about us, our services, promotions, and offers.

Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or phone numbers); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); payment data (e.g., bank details, invoices, payment history). Contract data (e.g., subject of the contract, duration, customer category).
Affected individuals: communication partners; service recipients and clients; employees (e.g. staff, applicants, temporary workers, and other employees); interested parties. Business and contractual partners.
Purposes of processing and legitimate interests: Direct marketing (e.g., via email or postal mail); provision of contractual services and fulfillment of contractual obligations; conversion measurement (measuring the effectiveness of marketing measures); marketing. Provision of our online offerings and user-friendliness.
Legal bases: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Right to object (Opt-Out): You can unsubscribe from our newsletter at any time, i.e., revoke your consents or object to further receipt. A link to unsubscribe from the newsletter can be found either at the end of each newsletter or you can use one of the contact options provided above, preferably email, for this purpose.

Further information on processing methods, procedures and services used:

Measurement of open and click rates: The newsletters contain a so-called "web beacon", i.e., a pixel-sized file that is retrieved from our or its server when the newsletter is opened, provided we use a mailing service provider. As part of this retrieval, both technical information, such as details about the browser and your system, as well as your IP address and the time of retrieval are collected. This information is used to technically improve our newsletters based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. This analysis also includes determining whether and when the newsletters are opened and which links are clicked. The collected information is assigned to individual newsletter recipients and stored in their profiles until deletion. Based on this, user profiles are created that store usage behavior and user characteristics. The measurement of open and click rates, as well as the storage of measurement results in the users' profiles and their further processing, is based on user consent. A separate revocation of the success measurement is unfortunately not possible; in this case, the entire newsletter subscription must be canceled or opposed. In this case, the stored profile information will be deleted; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
CleverReach: Sending of emails, managing recipient lists, creating and scheduling automated email campaigns; Service provider: CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.cleverreach.com; Privacy policy: https://www.cleverreach.com/de-de/datenschutz/. Data processing agreement: Provided by the service provider.
Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.

Promotional communication via email, mail, fax, or phone

We process personal data for the purposes of promotional communication, which can take place through various channels, such as email, phone, mail, or fax, in accordance with legal requirements.

Recipients have the right to revoke granted consents at any time or to object to promotional communication at any time free of charge via the contact options mentioned above.

After revocation or objection, we store the data necessary to prove the previous legitimacy for contact or sending for up to three years after the end of the year of revocation or objection based on our legitimate interests. The processing of this data is limited to the purpose of possible defense against claims. Based on the legitimate interest of permanently considering the revocation or objection of users, we also store the data necessary to avoid further contact (e.g., depending on the communication channel, the email address, phone number, name).

Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers). Content data (e.g., textual or visual messages and posts as well as the information related to them, such as details about authorship or time of creation).
Affected persons: Communication partners.
Purposes of processing and legitimate interests: Direct marketing (e.g., via email or postal mail); marketing. Sales promotion.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Surveys and questionnaires

We conduct surveys and questionnaires to collect information for the communicated survey or questionnaire purpose. The surveys and questionnaires we conduct (hereinafter referred to as "surveys") are evaluated anonymously. Personal data is processed only to the extent necessary for the provision and technical execution of the surveys (e.g., processing the IP address to display the survey in the user's browser or enabling a resumption of the survey using a cookie).

Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or phone numbers); content data (e.g., textual or visual messages and posts as well as related information, such as authorship or creation time); usage data (e.g., page views and duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); payment data (e.g., bank details, invoices, payment history); contract data (e.g., subject matter of the contract, duration, customer category). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Affected persons: Participants; service recipients and clients; employees (e.g., staff, applicants, temporary workers, and other employees); interested parties. Business and contractual partners.
Purposes of processing and legitimate interests: Feedback (e.g. collecting feedback via online form); surveys and questionnaires (e.g. surveys with input options, multiple-choice questions); provision of contractual services and fulfillment of contractual obligations; conversion measurement (measuring the effectiveness of marketing measures); marketing. Providing our online offering and user-friendliness.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.

Web analysis, monitoring, and optimization

Web analysis (also referred to as "reach measurement") serves to evaluate the visitor flows of our online offering and can include behavior, interests, or demographic information about the visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, determine when our online offering or its functions or content are used most frequently, or invite reuse. It is also possible for us to track which areas need optimization.

In addition to web analysis, we can also use testing methods to test and optimize different versions of our online offering or its components.

Unless otherwise specified below, profiles can be created for these purposes, meaning data compiled for a usage process, and information can be stored in a browser or on a device and then retrieved. The collected information includes, in particular, visited websites and the elements used there, as well as technical information, such as the browser used, the computer system used, and information on usage times. If users have consented to the collection of their location data with us or with the providers of the services we use, the processing of location data is also possible.

In addition, the IP addresses of users are stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) is stored in the context of web analysis, A/B testing, and optimization, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Processed data types: Usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); inventory data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and email addresses or phone numbers). Contract data (e.g., subject matter of the contract, duration, customer category).
Affected persons: Users (e.g., website visitors, users of online services); recipients of services and clients; employees (e.g., staff, applicants, temporary workers, and other employees); interested parties. Business and contractual partners.
Purposes of processing and legitimate interests: Reach measurement (e.g., access statistics, recognition of returning visitors); profiles with user-related information (creating user profiles); provision of our online offerings and user-friendliness; provision of contractual services and fulfillment of contractual obligations; conversion measurement (measuring the effectiveness of marketing measures). Marketing.
Retention and deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion". Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users' devices for a period of two years.).
Security measures: IP masking (pseudonymization of the IP address).
Legal bases: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

Google Analytics: We use Google Analytics to measure and analyze the use of our online services based on a pseudonymous user identification number. This identification number does not contain unique data, such as names or email addresses. It serves to assign analytical information to a device in order to recognize which content users have accessed within one or various usage processes, which search terms they have used, have accessed again, or interacted with our online services. The time of use and its duration are also stored, as well as the sources of users that refer to our online services and technical aspects of their devices and browsers.
Pseudonymous profiles of users are created with information from the use of various devices, where cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, the IP address data is used solely for this derivation of geolocation data before it is immediately deleted. They are not logged, are not accessible, and are not used for further purposes. When Google Analytics collects measurement data, all IP queries are conducted on EU-based servers before the traffic is forwarded for processing to Analytics servers; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://business.safety.google/adsprocessorterms), Switzerland - Data Privacy Framework (DPF), standard contractual clauses ( https://business.safety.google/adsprocessorterms); Right to object (Opt-Out): Opt-Out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (Types of processing and the data processed).
Google Tag Manager: We use Google Tag Manager, a software from Google that allows us to manage so-called website tags centrally through a user interface. Tags are small code elements on our website that serve to capture and analyze visitor activities. This technology helps us improve our website and the content offered on it. Google Tag Manager itself does not create user profiles, does not store cookies with user profiles, and does not conduct independent analyses. Its function is limited to simplifying and making more efficient the integration and management of tools and services that we use on our website. Nevertheless, when using Google Tag Manager, the users' IP address is transmitted to Google, which is necessary for technical reasons to implement the services we use. Cookies may also be set in this process. However, this data processing only occurs when services are integrated through the Tag Manager. For more detailed information about these services and their data processing, we refer to the further sections of this privacy policy; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Data processing agreement:
https://business.safety.google/adsprocessorterms. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms).
Google Tag Manager (Server-side use): The Google Tag Manager is an application that allows us to manage so-called website tags via an interface and thereby integrate other services into our online offerings (see also the further information in this privacy policy). The Tag Manager itself (which implements the tags) does not store user profiles or cookies. The integration of other services is done server-side. This means that user data is not transmitted directly from their device to the respective service or Google. In particular, the users' IP addresses are not transmitted to the other service. Instead, the data is first transmitted to our server, where the user records are assigned to our internal user identification number. The subsequent transmission of data from our server to the servers of the respective service providers occurs only in this pseudonymized form. The user identification number does not contain any unique data, such as names or email addresses; Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms//), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms//). Further information: https://business.safety.google/adsservices/ (Types of processing and the data processed).
Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.

Online marketing

We process personal data for the purpose of online marketing, which particularly includes the marketing of advertising space or the presentation of advertising and other content (collectively referred to as "content") based on potential user interests as well as measuring their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called "cookie") or similar methods are used, through which the relevant information about the user for the presentation of the aforementioned content is stored. This may include, for example, viewed content, visited websites, used online networks, but also communication partners and technical information, such as the browser used, the computer system used, as well as information on usage times and utilized functions. If users have consented to the collection of their location data, this can also be processed.

In addition, the IP addresses of users are stored. However, we use available IP masking methods (i.e., pseudonymization by shortening the IP address) for user protection. In general, no clear data of users (such as email addresses or names) are stored within the framework of the online marketing process, but rather pseudonyms. This means that neither we nor the providers of the online marketing processes know the actual user identity, but only the information stored in their profiles.

The statements in the profiles are usually stored in the cookies or by means of similar methods. These cookies can later generally also be read on other websites that use the same online marketing process, analyzed for the purpose of content presentation, supplemented with additional data, and stored on the server of the online marketing process provider.

As an exception, it is possible to assign clear data to profiles, primarily when users are, for example, members of a social network whose online marketing methods we use and the network connects user profiles with the aforementioned information. We ask you to note that users may make additional agreements with the providers, for instance, by consenting during registration.

We generally only have access to aggregated information about the success of our advertisements. However, we can check, as part of so-called conversion measurements, which of our online marketing methods have led to a so-called conversion, i.e., for example, to a contract conclusion with us. The conversion measurement is used solely for the success analysis of our marketing measures.

Unless otherwise specified, we ask you to assume that cookies used are stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is the permission. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this privacy policy.

Notes on revocation and objection:

We refer to the privacy notices of the respective providers and the opt-out options provided for the providers (so-called "Opt-Out"). If no explicit opt-out option has been provided, there is the possibility that you can disable cookies in your browser settings. However, this may limit the functionality of our online offerings. Therefore, we additionally recommend the following opt-out options, which are offered summarizingly for the respective areas:

a) Europe: https://youronlinechoices.eu/.

b) Canada: https://youradchoices.ca/.

c) USA: https://optout.aboutads.info/.

d) Cross-border: https://optout.aboutads.info.

Processed data types: Usage data (e.g., page views and duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Reach measurement (e.g., access statistics, recognition of returning visitors); tracking (e.g., interest-/behavior-based profiling, use of cookies); audience formation; marketing; profiles with user-related information (creating user profiles); conversion measurement (measuring the effectiveness of marketing measures); remarketing; provision of our online offerings and user-friendliness. Click tracking.
Retention and deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion". Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users' devices for a period of two years.).
Security measures: IP masking (pseudonymization of the IP address).
Legal bases: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

Google Ads and conversion measurement: Online marketing methods for the purpose of placing content and ads within the service provider's advertising network (e.g., in search results, in videos, on websites, etc.), so that they are displayed to users who have a presumed interest in the ads. Furthermore, we measure the conversion of the ads, i.e., whether users have taken the opportunity to interact with the ads and utilize the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Further information: Types of processing and the data processed: https://business.safety.google/adsservices/. Data processing conditions between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
Google Ads Remarketing: Google Remarketing, also known as retargeting, is a technology that allows users who use an online service to be included in a pseudonymous remarketing list, so that users can be shown ads on other online offerings based on their visit to the online service; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Further information: Types of processing and the data processed: https://business.safety.google/adsservices/. Data processing conditions between controllers and standard contractual clauses for third country data transfers: https://business.safety.google/adscontrollerterms.
Enhanced conversions for Google Ads: When users click on our Google ads and subsequently use the advertised service (so-called "conversion"), the data entered by the user, such as the email address, name, residential address, or phone number, may be transmitted to Google. The hash values are then matched with existing Google accounts of the users to better evaluate and improve the interaction of users with the ads (e.g., clicks or views) and thus their performance; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Website: https://support.google.com/google-ads/answer/9888656.
LinkedIn Insight Tag: Code that is loaded when a user visits our online offering and tracks the user's behavior and conversions, storing them in a profile (possible use cases: measuring campaign performance, optimizing ad delivery, building custom and similar audiences); Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://www.linkedin.com/legal/l/dpa; Basis for Third Country Transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/l/dpa), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/l/dpa). Right to Object (Opt-Out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
UTM Parameters: Analysis of sources and user actions based on an extension of referring web addresses with an additional parameter, the "UTM" parameter. For example, a UTM parameter "utm_source=platformX&utm_medium=video" can tell us that a person clicked the link on platform X within a video. The UTM parameters provide information about the source of the link, the medium used (e.g., Social Media, Website, Newsletter), the type of campaign, or the content of the campaign (e.g., Posting, Link, Image, and Video). With this information, we can check our visibility on the internet or the effectiveness of our campaigns; Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
LinkedIn Ads: Placement of ads within the LinkedIn platform and evaluation of ad results; Service Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://business.linkedin.com/de-de/marketing-solutions/ads; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://www.linkedin.com/legal/l/dpa; Basis for Third Country Transfers: EU/EFTA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://de.linkedin.com/legal/l/dpa), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://de.linkedin.com/legal/l/dpa); Right to Object (Opt-Out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Further Information: https://www.linkedin.com/legal/l/dpa.

Customer Reviews and Evaluation Procedures

We participate in review and evaluation procedures to assess, optimize, and promote our services. When users rate us through the involved review platforms or procedures or provide feedback in other ways, the General Terms and Conditions and the Privacy Notices of the providers also apply. As a rule, the evaluation also requires registration with the respective providers.

To ensure that the reviewers have actually used our services, we transmit the necessary data regarding the customer and the service used to the respective review platform with the consent of the customers (including name, email address, and order number or item number). This data is used solely to verify the authenticity of the user.

Processed Data Types: Contract data (e.g., subject matter of the contract, duration, customer category); usage data (e.g., page views and duration of visit, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Affected Persons: Service recipients and clients. Users (e.g., website visitors, users of online services).
Purposes of Processing and Legitimate Interests: Feedback (e.g. collecting feedback via online form). Marketing.
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Google Customer Reviews: Service for obtaining and/or displaying customer satisfaction and customer opinions; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.google.com/; Privacy policy: https://business.safety.google/privacy/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Further information: In the context of obtaining customer reviews, an identification number as well as the time for the transaction to be reviewed, for review requests sent directly to customers the customer's email address and their indication of the country of residence as well as the review data itself are processed; Further details on the types of processing and the data processed: https://business.safety.google/adsservices/. Data processing terms for Google advertising products: Information on the services data processing terms between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
kununu: Provision and display of employer reviews (employee reviews of companies), publication of reports on working conditions, management of user accounts, provision of a search function for company profiles; Service provider: kununu GmbH, Kurfürstenstr. 1, 80801 Munich, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.kununu.com/. Privacy policy: https://www.kununu.com/de/info/datenschutz.

Presences in social networks (Social Media)

We maintain online presences within social networks and process user data in this context to communicate with users active there or to provide information about us.

We would like to point out that user data may be processed outside the territory of the European Union. This may pose risks for users, as it could make the enforcement of user rights more difficult.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on user behavior and resulting interests. The latter may in turn be used to display advertisements within and outside the networks that presumably correspond to the interests of the users. Therefore, cookies are usually stored on users' computers, in which user behavior and interests are recorded. Additionally, data may also be stored in usage profiles independently of the devices used by the users (especially if they are members of the respective platforms and logged in there).

For a detailed presentation of the respective processing forms and the options for objection (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

In the case of information requests and the assertion of data subject rights, we would like to point out that these can be most effectively asserted with the providers. Only they have access to the user data and can take appropriate measures and provide information directly. If you still need assistance, you can contact us.

Processed data types: Contact data (e.g., postal and email addresses or phone numbers); content data (e.g., textual or visual messages and posts as well as the information related to them, such as details about authorship or the time of creation). Usage data (e.g., page views and duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Communication; feedback (e.g., collecting feedback via online form). Public relations.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

LinkedIn: Social network - We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of data from visitors that is used to create the "Page Insights" (statistics) of our LinkedIn profiles. This data includes information about the types of content that users view or interact with, as well as the actions they take. Additionally, details about the devices used are collected, such as IP addresses, operating system, browser type, language settings, and cookie data, as well as information from user profiles, such as job function, country, industry, hierarchy level, company size, and employment status. Privacy information regarding the processing of user data by LinkedIn can be found in LinkedIn's privacy notices: https://www.linkedin.com/legal/privacy-policy.
We have entered into a special agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum", https://legal.linkedin.com/pages-joint-controller-addendum), which specifically regulates the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of the affected individuals (i.e., users can direct requests for information or deletion directly to LinkedIn). The rights of users (especially the right to information, deletion, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. The joint responsibility is limited to the collection and transmission of data to LinkedIn Ireland Unlimited Company, a company based in the EU. The further processing of the data is solely the responsibility of LinkedIn Ireland Unlimited Company, particularly regarding the transmission of data to the parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/privacy-policy), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/privacy-policy). Right to object (Opt-Out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Vimeo: Platform for providing and delivering video content; Service provider: Vimeo Inc., 555 West 18th Street New York, New York 10011, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://vimeo.com; Privacy policy: https://vimeo.com/legal/terms/de/datenschutz/policy; Data processing agreement: https://vimeo.com/legal/enterprise-terms/dpa. Basis for third country transfers: EU/EEA - Standard Contractual Clauses (https://vimeo.com/legal/enterprise-terms/dpa), Switzerland - Standard Contractual Clauses (https://vimeo.com/legal/enterprise-terms/dpa).
YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Privacy policy: https://business.safety.google/privacy/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Right to object (Opt-Out): https://myadcenter.google.com/.
Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.xing.com/. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plug-ins and embedded functions as well as content

We integrate functional and content elements into our online offering that are sourced from the servers of their respective providers (hereinafter referred to as "third parties"). This may include, for example, graphics, videos, or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third parties of this content process the users' IP addresses, as they would not be able to send the content to their browsers without the IP address. The IP address is therefore necessary for the display of this content or functions. We strive to use only those contents whose respective providers apply the IP address solely for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the users' devices and may include technical information about the browser and operating system, referring websites, visit times, as well as further details about the use of our online offering, but can also be linked with such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is the permission. Otherwise, user data will be processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this privacy policy.

Processed data types: Usage data (e.g., page views and duration of stay, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons). Location data (information about the geographical position of a device or person).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; reach measurement (e.g., access statistics, recognition of returning visitors); tracking (e.g., interest-/behavior-based profiling, use of cookies); audience formation; marketing; provision of contractual services and fulfillment of contractual obligations. Profiles with user-related information (creating user profiles).
Retention and deletion: Deletion according to the information in the section "General Information on Data Storage and Deletion". Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users' devices for a period of two years.).
Legal bases: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).

Further information on processing methods, procedures and services used:

Integration of third-party software, scripts, or frameworks (e.g., jQuery): We integrate software into our online offering that we retrieve from servers of other providers (e.g., functional libraries that we use for the purpose of displaying or improving the user-friendliness of our online offering). In this process, the respective providers collect the users' IP addresses and may process them for the purposes of delivering the software to the users' browsers as well as for security purposes, and for evaluating and optimizing their offerings. - We integrate software into our online offering that we retrieve from servers of other providers (e.g., functional libraries that we use for the purpose of displaying or improving the user-friendliness of our online offering). In this process, the respective providers collect the users' IP addresses and may process them for the purposes of delivering the software to the users' browsers as well as for security purposes, and for evaluating and optimizing their offerings; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Google Fonts (provided on our own server): Providing font files for the purpose of a user-friendly display of our online offering; Service provider: The Google Fonts are hosted on our server, no data is transmitted to Google; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Google Fonts (retrieved from the Google server): Access to fonts (and symbols) for the purpose of a technically secure, maintenance-free, and efficient use of fonts and symbols with regard to timeliness and loading times, their uniform presentation, and consideration of possible licensing restrictions. The font provider is informed of the user's IP address so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for the provision of the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA - When visiting our online offering, users' browsers send their browser HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving the fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) from Google Fonts and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the User-Agent, which describes the browser and operating system versions of the website visitors, as well as the referrer URL (i.e., the webpage where the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, User-Agent, and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how often a particular font family is requested. In the Google Fonts Web API, the User-Agent must adjust the font that is generated for the respective browser type. The User-Agent is primarily logged and used for debugging to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the "Analytics" page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and an aggregated report on the top integrations based on the number of font requests can be generated. According to its own statements, Google does not use any of the information collected by Google Fonts to create profiles of end users or to serve targeted ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://fonts.google.com/; Privacy policy: https://business.safety.google/privacy/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Further information: https://fonts.google.com/faq?hl=de#privacy.
Font Awesome (provided on own server): Display of fonts and icons; Service provider: The Font Awesome Icons are hosted on our server, no data is transmitted to the provider of Font Awesome; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Google Maps: We integrate the maps of the "Google Maps" service from the provider Google. The processed data may include, in particular, IP addresses and location data of the users; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://business.safety.google/privacy/. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
Google Maps APIs and SDKs: Interfaces to Google’s map and location services, which allow for example the addition of address entries, location determinations, distance calculations, or the provision of supplementary information about locations and other places; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://business.safety.google/privacy/. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
LinkedIn plugins and content: LinkedIn plugins and content - This may include, for example, content such as images, videos, or texts and buttons that allow users to share content from this online offering within LinkedIn; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Data processing agreement: https://de.linkedin.com/legal/l/dpa; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://www.linkedin.com/legal/l/dpa), Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://www.linkedin.com/legal/l/dpa). Right to object (Opt-Out): https://www.linkedin.com/mypreferences/g/guest-retargeting-opt-out.
reCAPTCHA: We integrate the "reCAPTCHA" function to be able to recognize whether inputs (e.g., in online forms) are made by humans and not by automatically acting machines (so-called "bots"). The processed data may include IP addresses, information about operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, duration of stay on websites, previously visited websites, interactions with ReCaptcha on other websites, possibly cookies, as well as results from manual recognition processes (e.g., answering posed questions or selecting objects in images). Data processing is based on our legitimate interest in protecting our online offerings from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://cloud.google.com/security/products/recaptcha; Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://cloud.google.com/terms/data-processing-addendum. Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://cloud.google.com/terms/sccs/eu-c2p), Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://cloud.google.com/terms/sccs/eu-c2p).
YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.youtube.com; Privacy policy: https://business.safety.google/privacy/; Basis for third country transfers: EU/EWR - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Right to object (Opt-Out): Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff.
YouTube Videos: Within our online offering, videos are embedded that are stored on YouTube. The integration of these YouTube videos is done via a special domain using the component "youtube-nocookie" in the so-called "enhanced privacy mode". In the "enhanced privacy mode", only information that includes your IP address as well as details about the browser and your device can be stored on your device in cookies or through similar methods until the video starts, which YouTube needs for the output, control, and optimization of the video display. Once you play the videos, additional information for analyzing user behavior as well as for storage in the user profile and for personalizing content and ads may be processed by YouTube. The storage duration for the cookies can be up to two years; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://business.safety.google/privacy/; Basis for third country transfers: EU/EWR - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Further information: https://support.google.com/youtube/answer/171780?hl=de-DE#zippy=%2Cturn-on-privacy-enhanced-mode%2Cerweiterten-datenschutzmodus-aktivieren.
Xing plugins and buttons: Xing plugins and buttons - This may include, for example, content such as images, videos, or texts and buttons that allow users to share content from this online offering within Xing; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.xing.com. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Management, organization, and support tools

We use services, platforms, and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organization, administration, planning, and providing our services. When selecting third-party providers and their services, we comply with legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. Various data may be affected, which we process in accordance with this privacy policy. This data may include in particular master data and contact data of users, data on transactions, contracts, other processes, and their contents.

If users are referred to third-party providers or their software or platforms in the context of communication, business, or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask that you pay attention to the privacy notices of the respective third-party providers.

Processed data types: Content data (e.g., textual or visual messages and posts as well as the related information, such as details about authorship or creation time); Usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); Contract data (e.g., subject matter of the contract, duration, customer category); Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., postal and email addresses or phone numbers). Applicant data (e.g., personal information, postal and contact addresses, documents related to the application and the information contained therein, such as cover letters, resumes, certificates, as well as further information regarding a specific position or voluntarily provided by applicants about their person or qualifications).
Affected persons: Communication partners; users (e.g., website visitors, users of online services); business and contractual partners; service recipients and clients; employees (e.g., staff, applicants, temporary workers, and other employees); interested parties. Applicants.
Purposes of processing and legitimate interests: Communication; provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; conversion measurement (measuring the effectiveness of marketing measures); marketing; provision of our online offerings and user-friendliness. Application procedures (justification and any subsequent implementation as well as possible later termination of the employment relationship).
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

DocuSign: Electronic signature of documents, sending documents for signature, tracking the status of documents, storing signed documents; Service provider: DocuSign, Inc., 221 Main Street Suite 1000 San Francisco, CA 94105, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.docusign.com/; Privacy policy: https://www.docusign.com/privacy; Data processing agreement: https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment; Basis for third country transfers: EU/EEA - Standard contractual clauses (https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment), Switzerland - Standard contractual clauses (https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment). Further information: The processing as a processor and controller is also based on approved binding internal data protection regulations that ensure a level of data protection that meets the requirements of the GDPR (English: "Binding Corporate Rules", Art. 47 GDPR): https://www.docusign.com/trust/privacy/binding-corporate-rules.
WeTransfer: Transfer of files over the internet; Service provider: WeTransfer BV, Oostelijke Handelskade 751, Amsterdam, 1019 BW, Netherlands; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://wetransfer.com. Privacy policy: https://wetransfer.com/de-DE/explore/legal/privacy.
Odoo: Management of customer relationships, sales, purchasing, inventory, invoicing, and accounting; human resources management including recruitment, employee evaluations, and payroll; project management; manufacturing; website and e-commerce operations; Service provider: Odoo S.A. - Data Protection, Chaussée de Namur 40, 1367 Grand rosière, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.odoo.com/de_DE; Privacy policy: https://www.odoo.com/de_DE/privacy. Data processing agreement: Provided by the service provider.
Personio: Recruitment platform and applicant management services (job postings, applicant search, and application processes); Service provider: Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.personio.de/. Privacy Policy: https://www.personio.de/datenschutzerklaerung/.

Processing of data in the context of employment relationships

In the context of employment relationships, the processing of personal data is carried out with the aim of effectively establishing, executing, and terminating such relationships. This data processing supports various operational and administrative functions necessary for managing employee relations.

The data processing encompasses various aspects, ranging from contract initiation to contract termination. Included are the organization and management of daily working hours, the management of access rights and permissions, as well as the handling of personnel development measures and employee discussions. The processing also serves the billing and management of wage and salary payments, which represent critical aspects of contract execution.

Additionally, the data processing takes into account the legitimate interests of the responsible employer, such as ensuring workplace safety or collecting performance data for evaluating and optimizing operational processes. Furthermore, the data processing includes the disclosure of employee data in the context of external communication and publication processes, where this is necessary for operational or legal purposes.

The processing of this data is always carried out in compliance with the applicable legal framework, with the goal always being the creation and maintenance of a fair and efficient working environment. This also includes consideration of the data protection of the affected employees, the anonymization or deletion of data after the purpose of processing has been fulfilled or in accordance with legal retention periods.

Processed data types: Employee data (information about employees and other individuals in an employment relationship); Payment data (e.g., bank details, invoices, payment history); Contract data (e.g., subject matter of the contract, duration, customer category); Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts as well as the information related to them, such as authorship details or creation time); Social data (data that is subject to social confidentiality and is processed by social security agencies, social assistance providers, or pension authorities.); Log data (e.g., log files regarding logins or data retrieval or access times.); Performance and behavior data (e.g., performance and behavior aspects such as performance evaluations, feedback from supervisors, training participation, compliance with company policies, self-assessments, and behavior assessments.); Working time data (e.g., start of working hours, end of working hours, actual working time, target working time, break times, overtime, vacation days, special leave days, sick days, absences, home office days, business trips); Salary data (e.g., base salary, bonus payments, incentives, tax class information, allowances for night work/overtime, tax deductions, social security contributions, net payment amount); Usage data (e.g., page views and duration, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Image and/or video recordings (e.g., photographs or video recordings of a person). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
Special categories of personal data: health data; religious or philosophical beliefs. union membership.
Affected persons: employees (e.g. staff, applicants, temporary workers, and other employees). business and contractual partners.
Purposes of processing and legitimate interests: establishment and execution of employment relationships (processing of employee data in the context of establishing and executing employment relationships); business processes and economic procedures; provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; public relations. security measures.
Legal bases: fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). processing of special categories of personal data related to health care, profession, and social security (Art. 9 para. 2 lit. h) GDPR).

Further information on processing methods, procedures and services used:

Access management: procedures necessary for defining, managing, and controlling access rights and user roles within a system or organization (e.g. creation of permission profiles, role- and access-based control, review and approval of access requests, regular review of access rights, tracking and auditing of user activities, creation of security policies and procedures); Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Special categories of personal data: Special categories of personal data are processed in the context of the employment relationship or to fulfill legal obligations. The processed special categories of personal data include data concerning the health, union membership, or religious affiliation of employees. This data may be shared with health insurance companies or used to assess the work ability of employees or for occupational health management or for information provided to the tax office; Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Sources of processed data: Personal data is processed that was obtained in the context of the application and/or the employment relationship of the employees. Additionally, if legally required, personal data is collected from other sources. These may include tax authorities for tax-relevant information, the respective health insurance company for information on incapacity for work, third parties such as employment agencies, or publicly accessible sources such as professional social networks in the context of application processes; Legal bases: Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Purposes of data processing: The personal data of employees is primarily processed for the establishment, execution, and termination of the employment relationship. Furthermore, the processing of this data is necessary to fulfill legal obligations in the area of tax and social security law. In addition to these primary purposes, employee data is also used to meet regulatory and supervisory requirements, to optimize electronic data processing processes, and to compile internal or cross-company data, possibly including statistical data. Furthermore, employee data may be processed to assert legal claims and to defend against legal disputes; Legal bases: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Transmission of employee data: Employee data is only processed internally by those entities that require it to fulfill operational, contractual, and legal obligations.
The transfer of data to external recipients only occurs when this is legally required or when the affected employees have given their consent. Possible scenarios for this can include requests for information from authorities or in the presence of asset formation benefits. Furthermore, the responsible party may forward personal data to additional recipients as far as this is necessary to fulfill their contractual and legal obligations as an employer. These recipients may include: a) Banks b) Health insurance companies, pension insurance providers, providers of retirement benefits, and other social security agencies c) Authorities, courts (e.g., tax authorities, labor courts, other supervisory authorities in the context of fulfilling reporting and information obligations) d) Tax and legal advisors e) Third-party debtors in the case of wage and salary garnishments f) Other entities to which legally mandatory declarations must be made.
In addition, data may be shared with third parties if this is necessary for communication with business partners, suppliers, or other service providers. Examples of this include information in the sender area of emails or letterheads as well as creating profiles on external platforms; Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Transmission of employee data to third countries: The transmission of employee data to third countries, that is, countries outside the European Union (EU) and the European Economic Area (EEA), occurs only if this is necessary for the fulfillment of the employment relationship, is legally required, or if employees have given their consent. Employees will be informed about the details separately, as far as legally required; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Business trips and travel expense accounting: Procedures that are necessary for the planning, execution, and accounting of business trips (e.g., booking travel, organizing accommodations and transportation, managing travel expense advances, submitting and reviewing travel expense reports, controlling and recording incurred costs, complying with travel policies, handling travel expense management); Legal bases: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Payroll accounting and wage accounting: Procedures that are necessary for the calculation, payment, and documentation of wages, salaries, and other employee benefits (e.g., recording working hours, calculating deductions and bonuses, remitting taxes and social security contributions, creating payroll statements, maintaining payroll accounts, reporting to tax authorities and social security agencies); Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR).
Deletion of employee data: Employee data will be deleted according to German law when they are no longer necessary for the purpose for which they were collected, unless they must be retained or archived due to legal obligations or the interests of the employer. The following retention and archiving obligations are observed:
- General personnel files - General personnel files (such as employment contract, work reference, supplementary agreements) are retained for up to three years after the termination of the employment relationship (§ 195 BGB).
  Tax-relevant documents - Tax-relevant documents in the personnel file are retained for six years (§ 147 AO, § 257 HGB).
  Information on wages and working hours - Information on wages and working hours for (accident) insured individuals with wage proof is retained for five years (§ 165 I 1, IV 2 SGB VII).
- Payrolls including lists for special payments - Payrolls including lists for special payments, provided that a booking receipt is available, are retained for ten years (§ 147 AO, § 257 HGB).
- Wage lists for interim, final, and special payments - Wage lists for interim, final, and special payments are retained for six years (§ 147 AO, § 257 HGB).
- Documents for employee insurance - Documents for employee insurance, provided that booking receipts are available, are retained for ten years (§ 147 AO, § 257 HGB).
- Contribution statements to social security carriers - Contribution statements to social security carriers are kept for ten years (§ 165 SGB VII).
  Payroll accounts - Payroll accounts are kept for six years (§ 41 I 9 EStG).
- Applicant data - Are kept for a maximum of six months from the receipt of the rejection.
- Working time records (for more than 8 hours on weekdays) - Are kept for two years (§ 16 II Working Hours Act (ArbZG)).
- Application documents (after online job advertisement) - Are kept for three to a maximum of six months after receipt of the rejection (§ 26
- Federal Data Protection Act (BDSG) n.F., § 15 IV General Equal Treatment Act (AGG)).
- Sick leave certificates (AU) - Are kept for up to five years (§ 6 I Compensation for Expenses Act (AAG)).
- Documents on company pension schemes - Are kept for 30 years (§ 18a Act to Improve Company Pension Schemes (BetrAVG)).
- Sick data of employees - Are kept for twelve months after the onset of the illness, if the absences in one year do not exceed six weeks.
- Documents on maternity protection - Are kept for two years (§ 27 Abs. 5 MuSchG).
Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) GDPR), Legal obligation (Art. 6 Abs. 1 S. 1 lit. c) GDPR), Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) GDPR), Processing of special categories of personal data in relation to healthcare, profession, and social security (Art. 9 Abs. 2 lit. h) GDPR).
Personnel file management: Procedures necessary for the organization, updating, and management of employee data and documents (e.g., collection of personnel master data, storage of employment contracts, certificates, and attestations, updating of data in case of changes, compilation of documents for employee discussions, archiving of personnel files, compliance with data protection regulations); Legal bases: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR), Processing of special categories of personal data related to healthcare, profession, and social security (Art. 9 para. 2 lit. h) GDPR).
Employee development, performance evaluation, and employee discussions: Procedures necessary in the area of promoting and further developing employees as well as in assessing their performance and in the context of employee discussions (e.g., needs analysis for further training, planning and conducting training measures, creating performance evaluations, conducting goal-setting and feedback discussions, career planning and talent management, succession planning); Legal bases: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR), Processing of special categories of personal data related to healthcare, profession, and social security (Art. 9 para. 2 lit. h) GDPR).
Obligation to provide data: The responsible party informs the employees that providing their data is necessary. This is generally the case when the data is required for the establishment and execution of the employment relationship or when its collection is legally mandated. Providing data may also be necessary when employees assert claims or claims are due to the employees. The implementation of these measures or fulfillment of services is dependent on the provision of this data (for example, the provision of data for the purpose of receiving wages); Legal bases: Fulfillment of the contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Publication and disclosure of employee data: Employee data will only be published or disclosed to third parties if this is necessary for the performance of work tasks in accordance with the employment contract. This applies, for example, when employees are named as contact persons in correspondence, on the website, or in public registers after consultation or according to an agreed task description, or when the area of responsibility includes representative functions. This may also be the case when a presentation or communication with the public occurs in the context of task performance, such as image recordings in the context of public relations work. Otherwise, the publication of employee data will only occur with their consent or based on the legitimate interests of the employer, for example, in the case of stage or group photographs during a public event; Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Application process

The application process requires that applicants provide us with the necessary data for their assessment and selection. The information required is specified in the job description or, in the case of online forms, from the information provided there.

In principle, the required information includes personal details such as name, address, a contact option, and proof of the qualifications necessary for a position. Upon request, we are also happy to inform which details are needed.

If available, applicants can submit their applications via our online form, which is encrypted according to the latest technology. Alternatively, it is also possible to send applications to us by email. However, we would like to point out that emails are generally not sent encrypted over the internet. Although emails are usually encrypted during transport, this does not occur on the servers from which they are sent and received. Therefore, we cannot take responsibility for the security of the application during its transmission between the sender and our server.

For the purposes of applicant search, submission of applications, and selection of applicants, we may use applicant management or recruitment software and platforms and services from third parties, in compliance with legal requirements.

Applicants can feel free to contact us regarding the method of submitting the application or send the application to us by post.

Processing special categories of data: As far as special categories of personal data (Art. 9 para. 1 GDPR, e.g. health data, such as disability status or ethnic origin) are requested from or communicated by applicants in the context of the application process, their processing takes place so that the responsible party or the affected person can exercise the rights arising from labor law and social security and social protection law, and can fulfill their related obligations, in the case of protecting vital interests of the applicants or other persons or for purposes of health care or occupational medicine, for assessing the employee's ability to work, for medical diagnostics, for care or treatment in the health or social sector, or for managing systems and services in the health or social sector.

Deletion of data: The data provided by the applicants may be further processed by us for the purposes of the employment relationship in the case of a successful application. Otherwise, if the application for a job offer is unsuccessful, the applicants' data will be deleted. The applicants' data will also be deleted if an application is withdrawn, which the applicants are entitled to do at any time. The deletion will take place, subject to a legitimate revocation by the applicants, no later than after a period of six months, so that we can answer any follow-up questions regarding the application and fulfill our documentation obligations under the regulations for equal treatment of applicants. Invoices for any travel expense reimbursements will be archived in accordance with tax law requirements.

Inclusion in a pool of applicants: The inclusion in a candidate pool, if offered, is based on consent. Candidates are informed that their consent to be included in the talent pool is voluntary, has no impact on the ongoing application process, and that they can withdraw their consent at any time for the future.

Processed data types: Basic data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or visual messages and posts as well as the information related to them, such as authorship details or creation time). Applicant data (e.g., personal information, postal and contact addresses, application documents and the information contained therein, such as cover letters, resumes, certificates, as well as further information regarding a specific position or voluntarily provided by applicants about their person or qualifications).
Affected persons: Applicants.
Purposes of processing and legitimate interests: Application process (justification and any subsequent execution as well as possible later termination of the employment relationship).
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal bases: Application process as a pre-contractual or contractual relationship (Art. 6 para. 1 sentence 1 lit. b) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing methods, procedures and services used:

Personio: Recruitment platform and applicant management services (job postings, applicant search, and application processes); Service provider: Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.personio.de/. Privacy Policy: https://www.personio.de/datenschutzerklaerung/.

Definitions of terms

In this section, you will receive an overview of the terms used in this privacy policy. As far as the terms are legally defined, their legal definitions apply. The following explanations are primarily intended to aid understanding.

Employees: Employees are referred to as individuals who are in an employment relationship, whether as staff, employees, or in similar positions. An employment relationship is a legal relationship between an employer and an employee, established by an employment contract or an agreement. It includes the employer's obligation to pay the employee compensation while the employee provides their work performance. The employment relationship encompasses various phases, including the establishment, in which the employment contract is concluded, the execution, in which the employee performs their work activities, and the termination, when the employment relationship ends, whether through dismissal, a termination agreement, or otherwise. Employee data includes all information related to these individuals and is in the context of their employment. This includes aspects such as personal identification data, identification numbers, salary and bank data, working hours, vacation entitlements, health data, and performance evaluations.
Inventory data: Inventory data includes essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include personal and demographic information such as names, contact information (addresses, phone numbers, email addresses), birth dates, and specific identifiers (user IDs). Inventory data forms the basis for any formal interaction between individuals and services, facilities, or systems by enabling unique assignment and communication.
Credit report: Automated decisions are based on automatic data processing without human intervention (e.g., in the case of an automatic rejection of a purchase on account, an online loan application, or an online application process without any human involvement). Such automated decisions are only permissible under Art. 22 GDPR if the affected individuals consent, if they are necessary for the fulfillment of a contract, or if national laws allow these decisions.
Content data: Content data includes information generated during the creation, editing, and publication of content of all kinds. This category of data can include texts, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content but also includes metadata that provides information about the content itself, such as tags, descriptions, author information, and publication dates.
Click tracking: Clicktracking allows for an overview of user movements within an entire online offering. Since the results of these tests are more accurate when user interaction can be tracked over a certain period (e.g., so we can find out if a user likes to return), cookies are usually stored on users' computers for these testing purposes.
Contact details: Contact details are essential information that enables communication with individuals or organizations. They include, among other things, phone numbers, postal addresses, and email addresses, as well as communication means such as social media handles and instant messaging identifiers.
Conversion measurement: Conversion measurement (also referred to as "visit action evaluation") is a method used to determine the effectiveness of marketing measures. For this purpose, a cookie is usually stored on users' devices within the websites where the marketing measures take place and then retrieved again on the target website. For example, this allows us to track whether the ads we placed on other websites were successful.
Artificial Intelligence (AI): The purpose of processing data through Artificial Intelligence (AI) includes the automated analysis and processing of user data to recognize patterns, make predictions, and improve the efficiency and quality of our services. This involves the collection, cleaning, and structuring of data, the training and application of AI models, as well as the continuous review and optimization of results, and is carried out solely with the consent of users or based on legal permission grounds.
Performance and behavior data: Performance and behavior data refer to information related to how individuals perform tasks or behave in a specific context, such as in an educational, work, or social environment. This data can include metrics such as productivity, efficiency, quality of work, attendance, and compliance with policies or procedures. Behavioral data may encompass interactions with colleagues, communication styles, decision-making processes, and reactions to various situations. These types of data are often used for performance evaluations, training and development initiatives, as well as decision-making within organizations.
Meta, communication, and procedural data: Meta, communication, and procedural data are categories that contain information about how data is processed, transmitted, and managed. Metadata, also known as data about data, includes information that describes the context, origin, and structure of other data. It can include details about file size, creation date, the author of a document, and change histories. Communication data captures the exchange of information between users across various channels, such as email traffic, call logs, social media messages, and chat histories, including the involved parties, timestamps, and transmission paths. Procedural data describes the processes and workflows within systems or organizations, including workflow documentation, logs of transactions and activities, as well as audit logs used for tracking and verifying operations.
Usage data: Usage data refers to information that captures how users interact with digital products, services, or platforms. This data includes a wide range of information that shows how users utilize applications, which features they prefer, how long they stay on certain pages, and the paths they navigate through an application. Usage data can also include usage frequency, timestamps of activities, IP addresses, device information, and location data. They are particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. Furthermore, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings.
Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more specific characteristics that are an expression of the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Profiles with user-related information: The processing of "profiles with user-related information", or simply "profiles", includes any type of automated processing of personal data, which consists of using this personal data to analyze, evaluate, or predict certain personal aspects related to a natural person (depending on the type of profiling, this may involve different information regarding demographics, behavior, and interests, such as the interaction with websites and their content, etc.). For profiling purposes, cookies and web beacons are often used.
Log data: Log data is information about events or activities that have been recorded in a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details about the use or operation of a system. Log data is often used to analyze system issues, for security monitoring, or to create performance reports.
Reach measurement: Reach measurement (also referred to as web analytics) serves to evaluate the visitor flows of an online offering and can include the behavior or interests of visitors regarding specific information, such as content from websites. With the help of reach analysis, operators of online offerings can, for example, recognize when users visit their websites and which content they are interested in. This allows them to better tailor the content of the websites to the needs of their visitors.
Remarketing: "Remarketing" or "Retargeting" refers to when, for example, it is noted for advertising purposes which products a user has shown interest in on a website, in order to remind the user of these products on other websites, e.g., in advertisements.
Location data: Location data is generated when a mobile device (or another device with the technical capabilities for location determination) connects to a cell tower, a Wi-Fi network, or similar technical means and functions of location determination. Location data serves to indicate the geographical position on Earth where the respective device is located. Location data can be used, for example, to display map functions or other location-dependent information.
Tracking: "Tracking" refers to when the behavior of users can be traced across multiple online services. Typically, behavioral and interest information regarding the used online services is stored in cookies or on the servers of the providers of tracking technologies (so-called profiling). This information can then be used, for example, to show users advertisements that are likely to match their interests.
Controller: A "Controller" is defined as the natural or legal person, authority, institution, or other entity that alone or jointly with others determines the purposes and means of processing personal data.
Processing: "Processing" is any operation or set of operations performed with or without the help of automated procedures in connection with personal data. The term is broad and encompasses practically any handling of data, whether it is collecting, evaluating, storing, transmitting, or deleting.
Contract data: Contract data are specific information related to the formalization of an agreement between two or more parties. They document the terms under which services or products are provided, exchanged, or sold. This category of data is essential for the management and fulfillment of contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include start and end dates of the contract, the nature of the agreed services or products, price agreements, payment terms, termination rights, extension options, and special conditions or clauses. They serve as the legal basis for the relationship between the parties and are crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.
Payment data: Payment data include all information needed to process payment transactions between buyers and sellers. This data is critical for e-commerce, online banking, and any other form of financial transaction. They include details such as credit card numbers, bank account information, payment amounts, transaction data, verification numbers, and billing information. Payment data may also contain information about payment status, chargebacks, authorizations, and fees.
Target Group Formation: Target group formation (in English "Custom Audiences") refers to the process of defining target groups for advertising purposes, e.g., displaying advertisements. For example, based on a user's interest in certain products or topics on the internet, it can be inferred that this user is interested in advertisements for similar products or the online shop where they viewed the products. "Lookalike Audiences" (or similar target groups) refers to when content deemed suitable is shown to users whose profiles or interests presumably match those of the users for whom the profiles were created. For the purpose of forming Custom Audiences and Lookalike Audiences, cookies and web beacons are typically used.

Privacy Policy

Preamble

Controller

Contact information of the Data Protection Officer

Overview of processing operations

Categories of Processed Data

Special categories of data

Categories of affected persons

Purposes of processing

Automated decisions in individual cases.

Relevant legal bases

Security Precautions

Transmission of personal data

International Data Transfers

General Information on Data Retention and Deletion

Rights of Data Subjects

Business Services

Business processes and procedures

Providers and services used in the course of business operations

Payment methods

Credit Assessment

Provision of online services and web hosting

Use of cookies

Registration, login, and user account

Single sign-on login

Blogs and publication media

Contact and inquiry management

Artificial Intelligence (AI)

Video conferences, online meetings, webinars, and screen sharing

Cloud services

Newsletter and electronic notifications

Promotional communication via email, mail, fax, or phone

Surveys and questionnaires

Web analysis, monitoring, and optimization

Online marketing

Customer Reviews and Evaluation Procedures

Presences in social networks (Social Media)

Plug-ins and embedded functions as well as content

Management, organization, and support tools

Processing of data in the context of employment relationships

Application process

Definitions of terms

Support | MTRIX helps.

Payment options

Company

Follow us

Newsletter