Privacy Policy

Get in touch

We are very pleased that you are interested in our organization. The protection of your personal data is of particular importance to our management. You can use our websites without disclosing any personal data. However, if you wish to use specific services via our websites, including other internet presences, applications, and our social media pages, we may need to process your personal data. If we wish to process data about you and cannot rely on any other legal basis, we will always ask for your consent first (e.g., via a cookie banner).

When handling your personal data (such as name, address, email, or telephone number), we always comply with applicable data protection laws. With this privacy policy, we inform you about which data we process. In this privacy policy, you will also learn about your rights as a data subject.

We have implemented various technical and organizational measures to protect your data on our websites as effectively as possible. Nevertheless, there are always risks on the internet, and complete protection is not possible. Therefore, you are welcome to transmit your personal data to us via other channels, for example by telephone, if you prefer.

This privacy policy serves not only to fulfill the obligations under the GDPR and to comply with the laws of the member states of the European Union (EU) and the European Economic Area (EEA). This privacy policy is also intended to ensure compliance with legal requirements, such as those from Great Britain (UK-GDPR), the Swiss Federal Act on Data Protection and the Swiss Data Protection Ordinance (FADP, DPO), the California Consumer Privacy Act (CCPA/CPRA), China's Personal Information Protection Law (PIPL), the Delaware Personal Data Privacy Act (DPDPA), the Tennessee Information Protection Act (TIPA), the Minnesota Consumer Data Privacy Act (MCDPA), the Iowa Act Relating to Consumer Data Protection (ICDPA), the Maryland Online Data Privacy Act (MODPA), the Nebraska Data Privacy Act (NDPA), the New Hampshire Consumer Data Privacy Law (SB255), the New Jersey Data Privacy Law (SB332), the South Carolina Consumer Privacy Bill (House Bill 4696), and other global data protection regulations, and should be interpreted accordingly. The following privacy policy is to be interpreted for each country, state, or federal state in such a way that the terms and legal bases used correspond to the terms and legal bases used in the respective state or federal state.

For the sake of readability, our websites, publications, communications, and this privacy policy do not use gender-specific language (male, female, diverse, etc.). All terms used apply equally to all genders.

For suggestions for improvement regarding the text in this privacy policy, or if you require an external data protection officer, please contact the author of the texts: Prof. Dr. h.c. Heiko Jonny Maniero, LL.B., LL.M. mult., M.L.E..

1. Definitions

In our privacy policy, we use specific terms from various data protection laws. We want our policy to be easy to understand, and therefore we explain these terms in advance.

The following definitions are to be interpreted or expanded, where necessary, based on the jurisprudence of the General Court of the European Union (EGC), the Court of Justice of the European Union (CJEU), the Swiss Federal Supreme Court (BGE), the Supreme Court of the United Kingdom (UKSC), or based on national data protection laws or the national jurisprudence of a state or federal state, including but not limited to California, including case law, also under common law, if this is required for the application of the law in an individual case.

In this privacy policy, we use, among others, the following terms:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person, or who must be considered as such under national data protection laws or the national jurisprudence of a state or federal state, including case law, also under common law.

b) Data subject

Data subject is any identified or identifiable natural person whose personal data is processed by the controller, a processor, an international organization, or any other data recipient, as well as persons who must be considered as such under national data protection laws or the national jurisprudence of a state or federal state, including case law, also under common law.

c) Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

f) Pseudonymization

Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g) Controller

The controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor

A processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

i) Recipient

A recipient is a natural or legal person, public authority, agency, or another body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

j) Third party

A third party is a natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.

k) Consent

Consent is any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

2. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and the European Economic Area, British data protection laws, Swiss data protection laws (FADP, DPO), Californian data protection laws (CCPA/CPRA), Chinese data protection law (PIPL), as well as international laws and other provisions with a data protection character is:

Placeholder Company Name

Placeholder Company Adress

Placeholder Company Phone Number

Placeholder Company Email

3. Name and contact details of the Data Protection Officer

Prof. Dr. h.c. Heiko Jonny Maniero

Franz-Joseph-Str. 11

80801 Munich

Germany

Phone: +49 (0)178 - 6264376

Email: info@dg-datenschutz.de

Collection of general data and information

Our websites collect a series of general data and information each time a data subject or an automated system accesses the websites. This general data and information is stored in the server's log files. The data collected may include (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our websites (so-called referrers), (4) the sub-websites accessed via an accessing system on our websites, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the internet service provider of the accessing system, and (8) other similar data and information that serve to prevent threats in the event of attacks on our information technology systems.

When using this general data and information, we do not draw any conclusions about the data subject. Rather, this information is required to (1) deliver the content of our websites correctly, (2) optimize the content of our websites and the advertising for them, (3) ensure the long-term functionality of our information technology systems and the technology of our websites, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack. We therefore analyze this anonymously collected data and information statistically and also with the aim of increasing data protection and data security in our company, in order to ultimately ensure an optimal level of protection for the personal data we process. The server log file data is stored separately from all personal data provided by a data subject.

The purpose of the processing is to prevent threats and ensure IT security, as well as the aforementioned purposes. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is, in particular, the protection of our information technology systems. The log files are deleted once the stated purposes have been achieved.

4. Contact options via the website and other data transmissions and your consent

Our websites contain information that enables quick electronic contact with our company as well as direct communication with us, which also includes a general address for so-called electronic mail (e-mail address) and, if applicable, a telephone number. If a data subject contacts us by e-mail, via a contact form, via an input form, or otherwise, the personal data transmitted by the data subject will be stored automatically. Such personal data transmitted on a voluntary basis by a data subject to us will be processed for the purposes of handling or contacting the data subject.

For the transmission, storage, and processing of your contact details and inquiries, and for contacting you, we obtain your consent in accordance with Art. 6 (1) (a) GDPR and Art. 49 (1) (a) GDPR as follows:

By submitting your personal data, you voluntarily consent to the processing of the personal data you have entered or transmitted for the purposes of handling your request and for contacting you. By submitting your data to us, you also voluntarily provide express consent pursuant to Art. 49 (1) (a) GDPR for data transfers to third countries to and by the companies mentioned in this privacy policy and for the stated purposes, in particular for such transfers to third countries for which there is no adequacy decision by the EU/EEA, as well as to companies or other entities that are not subject to an existing adequacy decision based on self-certification or other accession criteria, and in which or for which there are significant risks and no appropriate safeguards for the protection of your personal data (e.g., due to Section 702 FISA, Executive Order EO12333, and the Cloud Act in the USA). When providing your voluntary and express consent, you were aware that there may not be an adequate level of data protection in third countries and that your data subject rights may not be enforceable. You may revoke your data protection consent at any time with effect for the future. The revocation of consent does not affect the lawfulness of processing based on consent before its revocation. With a single action (entering and submitting), you provide multiple consents. These include consents under EU/EEA data protection law as well as those under the CCPA/CPRA, ePrivacy and telemedia law, and other international legal provisions that are required, among other things, as a legal basis for planned further processing of your personal data. By your action, you also confirm that you have read and taken note of this privacy policy.

5. Routine erasure and restriction of personal data

We process and store personal data for the period necessary to achieve the purpose of processing, or as provided for by the European legislator or another legislator in laws or regulations to which we are subject, or as long as a legal basis for processing exists.

If the purpose of processing no longer applies, or if a storage period prescribed by the European legislator or another competent legislator expires, or if the legal basis for processing ceases to apply, the personal data will be routinely restricted or erased in accordance with legal requirements.

6. Rights of the data subject under the GDPR

a) Right of confirmation

Every data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed.

If a data subject wishes to exercise this right, they may contact us at any time.

b) Right of access

Every data subject has the right to obtain from the controller at any time free information about their stored personal data and a copy of this data. Furthermore, the European legislator has granted the data subject access to the following information:

the purposes of the processing,
the categories of personal data concerned,
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations,
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing,
the existence of the right to lodge a complaint with a supervisory authority,
where the personal data is not collected from the data subject: all available information as to the source of the data,
the existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) GDPR and—at least in these cases—meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Furthermore, the data subject has the right to obtain information as to whether personal data has been transferred to a third country or an international organization. Where this is the case, the data subject also has the right to obtain information about the appropriate safeguards in connection with the transfer.

If a data subject wishes to exercise this right, they may contact us at any time.

c) Right to rectification

Every data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If a data subject wishes to exercise this right, they may contact us at any time.

d) Right to erasure (right to be forgotten)

Every data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, provided that one of the following reasons applies and as far as processing is not necessary:

The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
The data subject withdraws consent on which the processing is based according to point (a) of Art. 6 (1) GDPR, or point (a) of Art. 9 (2) GDPR, and where there is no other legal ground for the processing.
The data subject objects to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) GDPR.
The personal data have been unlawfully processed.
The erasure of personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
The personal data were collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.

If one of the aforementioned reasons applies and a data subject wishes to request the erasure of personal data stored by us, they may contact us at any time.

If we have made personal data public and our organization as the controller is obliged to erase the personal data pursuant to Art. 17 (1) GDPR, we shall take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform other controllers processing the published personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required.

e) Right to restriction of processing

Every data subject has the right to obtain from the controller the restriction of processing if one of the following conditions applies:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful, the data subject opposes the erasure of the personal data, and requests the restriction of their use instead.
The controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise, or defense of legal claims.
The data subject has objected to the processing pursuant to Art. 21 (1) GDPR, and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

If one of the aforementioned conditions is met and a data subject wishes to request the restriction of personal data stored by us, they may contact us at any time.

f) Right to data portability

Every data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, provided that the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising their right to data portability pursuant to Article 20(1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

If a data subject wishes to exercise this right, they may contact us at any time.

g) Right to object

Every data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

If we process personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to us regarding processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, the data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

If a data subject wishes to exercise this right, they may contact us at any time. Furthermore, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject is free to exercise their right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling

Every data subject has the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning them or similarly significantly affects them, provided that the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is based on the data subject's explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) it is made with the data subject's explicit consent, we shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision.

If a data subject wishes to exercise this right, they may contact us at any time.

i) Right to withdraw consent under data protection law

Every data subject has the right to withdraw their consent to the processing of personal data at any time.

If a data subject wishes to exercise this right, they may contact us at any time.

7. General purpose of processing, categories of processed data, and categories of recipients

The general purpose of processing personal data is the handling of all processes concerning the controller, customers, prospective customers, business partners, or other contractual or pre-contractual relationships between the aforementioned groups (in the broadest sense) or legal obligations of the controller. This general purpose applies if no more specific purposes are stated for a concrete processing operation.

The categories of personal data processed by us are customer data, prospective customer data, employee data (including applicant data), and supplier data. The categories of recipients of personal data are public authorities, external bodies, internal processing, intra-group processing, and other bodies.

A list of our processors and data recipients in third countries, as well as any international organizations, is either published on our website or can be requested from us free of charge.

8. Legal bases for processing

Article 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations necessary for the supply of goods or the provision of any other service or consideration, the processing is based on Article 6(1)(b) GDPR. The same applies to such processing operations that are necessary for carrying out pre-contractual measures, for example in cases of inquiries regarding our products or services. If we are subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Article 6(1)(c) GDPR.

In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured in our facility and their name, age, health insurance data, or other vital information had to be passed on to a doctor, hospital, or other third party. In that case, the processing would be based on Art. 6 (1) (d) GDPR.

If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the legal basis is Art. 6 (1) (e) GDPR.

Finally, processing operations could be based on Art. 6 (1) (f) GDPR. This legal basis is used for processing operations that are not covered by any of the aforementioned legal bases if the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests, fundamental rights, and freedoms of the data subject. Such processing operations are permitted to us in particular because they have been specifically mentioned by the European legislator. The legislator took the view that a legitimate interest could be assumed, for example, if the data subject is a client of the controller (Recital 47, sentence 2 GDPR).

9. Legitimate interests in processing pursued by the controller or a third party and direct marketing

If the processing of personal data is based on Art. 6 (1) (f) GDPR and no more specific legitimate interests are stated, our legitimate interest is the conduct of our business activities for the benefit of the well-being of our staff and our shareholders.

We may send you direct marketing regarding our own goods or services that are similar to the goods or services you have requested, commissioned, or purchased. You may object to this direct marketing at any time (e.g., via email). You will incur no costs other than the transmission costs at the basic rates. The processing of personal data for direct marketing purposes is based on Art. 6 (1) (f) GDPR. Our legitimate interest is direct marketing.

Our messages and newsletters may also constitute communication for direct marketing purposes within the meaning of Art. 13 (2) of the EU Directive 2002/58 (ePrivacy Directive) and the national law resulting from this directive, provided that we have received your electronic and other contact information in connection with the sale of a service or product, which includes the creation of a free user account that allows you, among other things, to access free content on our websites and publications (newsletters, etc.), provided that we are advertising similar products or services via direct marketing, such that direct marketing is permissible even without consent (cf. CJEU, judgment of 13.11.2025, case C 654/23). You may refuse the use of your contact information for such purposes at any time free of charge.

10. Period for which the personal data will be stored

The criterion for the duration of the storage of personal data is the respective statutory retention period. If there is no statutory retention period, the criterion is the contractual or internal retention period. After the period has expired, the corresponding data is routinely deleted, provided it is no longer required for the fulfillment or initiation of a contract. This applies in particular to all processing operations for which no more specific criteria have been established.

11. Statutory or contractual provisions for the provision of personal data; necessity for the conclusion of the contract; obligation of the data subject to provide the personal data; possible consequences of failure to provide

We would like to clarify that the provision of personal data is partly required by law (e.g., tax regulations) or can also result from contractual provisions (e.g., information on the contractual partner). Sometimes, it may be necessary for the conclusion of a contract that a data subject provides us with personal data, which must subsequently be processed by us. For example, the data subject is obliged to provide us with personal data when our organization enters into a contract with them. Failure to provide the personal data would result in the contract with the data subject not being concluded. Before providing personal data, the data subject must contact us. We will clarify to the data subject on a case-by-case basis whether the provision of personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data, and what the consequences of not providing the personal data would be.

12. Existence of automated decision-making

As a responsible company, we generally refrain from automated decision-making or profiling. If we do carry out automated decision-making or profiling in exceptional cases, we will inform the data subject either separately or via a sub-section of our privacy policy (here on our website). In such cases, the following applies:

Automated decision-making, including profiling, may occur if it is (1) necessary for entering into, or performance of, a contract between the data subject and us, or (2) authorized by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) based on the data subject's explicit consent.

In the cases referred to in Art. 22 (2) (a) and (c) GDPR, we take appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject. In these cases, you have the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

Meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject, will be provided in this privacy policy where applicable.

13. Recipients in a third country and appropriate or adequate safeguards, and how to obtain a copy of them or where they are available.

In accordance with Art. 46 (1) GDPR, the controller or a processor may only transfer personal data to a third country if the controller or processor has provided appropriate safeguards and provided that enforceable rights and effective legal remedies are available to the data subjects. Appropriate safeguards can be provided by Standard Contractual Clauses without the need for specific authorization from a supervisory authority, Art. 46 (2) (c) GDPR.

Before the first transfer of personal data, we agree on EU Standard Contractual Clauses or other appropriate safeguards with all recipients in third countries, or the transfers are based on adequacy decisions. Consequently, it is ensured that appropriate safeguards, enforceable rights, and effective legal remedies are guaranteed for all processing of personal data. Every data subject can obtain a copy of the Standard Contractual Clauses or adequacy decisions from us. In addition, the Standard Contractual Clauses and adequacy decisions are available in the Official Journal of the European Union.

Art. 45 (3) GDPR authorizes the European Commission to decide, by means of an implementing act, that a non-EU country ensures an adequate level of protection. This means a level of protection for personal data that is essentially equivalent to the level of protection within the EU. Adequacy decisions mean that personal data can flow from the EU (as well as from Norway, Liechtenstein, and Iceland) to a third country without further obstacles. Similar provisions apply to the United Kingdom, Switzerland, and several other countries.

In all cases where the European Commission, or a government or competent authority of another country, has decided that a third country ensures an adequate level of protection and/or a valid framework exists (e.g., EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework), all transfers by us to members of such frameworks (e.g., self-certified entities) are based exclusively on the entity's membership in the respective framework or on the respective adequacy decisions. If we or one of our group companies are a member of such a framework, all transfers to us or our group company are based exclusively on the respective company's membership in that framework. If we or one of our group companies are based in a third country with an adequate level of protection, all transfers to us or our group company are based exclusively on the respective adequacy decisions.

Every data subject can obtain a copy of the frameworks from us. In addition, the frameworks are also available in the Official Journal of the European Union, in published legal materials, or on the websites of data protection supervisory authorities or other authorities or institutions.

14. Right to lodge a complaint with a data protection supervisory authority

As the controller, we are required to inform the data subject of their right to lodge a complaint with a supervisory authority. The right to lodge a complaint is governed by Art. 77 (1) GDPR. Under this provision, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, without prejudice to any other administrative or judicial remedy, if the data subject considers that the processing of personal data relating to them infringes the General Data Protection Regulation. The right to lodge a complaint has been limited by the EU legislator solely to the extent that it can only be exercised against a single supervisory authority (Recital 141, sentence 1 GDPR). This regulation is intended to avoid double complaints regarding the same matter by the same data subject. If a data subject wishes to lodge a complaint against us, we therefore ask that only one supervisory authority be contacted.

15. Data protection for applications and the application process

We collect and process the personal data of applicants during the application process. Processing may also be carried out electronically. This is particularly the case if an applicant submits relevant application documents to us electronically, for example by email or via a web form on our website or third-party websites.

For applicant data, the purpose of data processing is to review the application as part of the application process. We process all data provided by you for this purpose. Based on the data submitted during the application, we determine whether you will be invited to an interview (part of the selection process). In the case of suitable applicants, we will then process certain additional personal data provided by you, particularly during the interview, which is essential for our selection decision.

The legal bases for data processing are Art. 6 (1) (b) GDPR, Art. 9 (2) (b) and (h) GDPR, Art. 88 (1) GDPR, and national legislation.

If we do not enter into an employment contract with an applicant, the application documents will be deleted no later than six months after the rejection decision has been communicated, provided that no other legitimate interests of the controller prevent such deletion. Other legitimate interests in this sense include, for example, the burden of proof in legal proceedings.

16. Cookies, external connections, advertising IDs, and your consent

We use cookies, advertising IDs, and external connections on our websites to improve the user experience and to optimize our advertising and existing processes. Cookies are small text files that are stored by your browser on your computer or system and contain information to identify you more quickly during a visit. Almost all modern websites use cookies, advertising IDs, and/or external connections.

Cookies have a so-called cookie ID. This ID is unique to each cookie and helps distinguish your browser from others. This allows us to tailor our service to your needs and provide you with a personalized user experience. Cookies also make using websites easier for you. For example, you do not have to log in again every time you visit an online shop or website if a cookie has remembered your data. You can disable the use of cookies in your browser at any time or delete stored cookies. Please note that if cookies are disabled, you may not be able to use all the functions on our websites.

Advertising IDs are linked to your hardware. This ID is unique to each device and helps distinguish your devices from others. This allows us to tailor our service to your needs and provide you with a personalized user experience.

External connections are established to load and store external content and cookies, and also serve to optimize the user experience, advertising, and our processes. The legal basis for storing and reading our cookies, advertising IDs, and establishing external connections is the aforementioned legitimate interests (Art. 6 (1) (f) GDPR), unless you have provided separate consent in accordance with Art. 6 (1) (a) GDPR and/or Art. 49 (1) (1) (a) GDPR.

The following applies to all cookies, advertising IDs, and external connections integrated into a cookie banner:

By clicking the consent button in our cookie banner, you voluntarily consent to the setting or activation of the respective cookies and external connections, as well as to the transmission of advertising IDs and operating system advertising IDs, such as AdIDs (Android), IDFAs (Apple), or the Windows Advertising ID (consent pursuant to Art. 6 (1) (a) GDPR), the functions of which are explained in more detail in this privacy policy or in the documents or external links linked below and are therefore known to you. By clicking the consent button, you also voluntarily provide explicit consent pursuant to Art. 49 (1) (1) (a) GDPR for personalized advertising, advertising ID transmissions, and other data transfers to third countries to and by the companies and for the purposes mentioned in this privacy policy, particularly for such transfers to third countries for which there is no EU/EEA adequacy decision, and to companies or other entities that do not fall under an existing adequacy decision based on self-certification or other accession criteria, and in which or for which there are significant risks and no suitable safeguards for the protection of your personal data (e.g., due to Section 702 FISA, Executive Order EO12333, and the Cloud Act in the USA). When giving your voluntary and explicit consent, you were aware that there may not be an adequate level of data protection in third countries and that your data subject rights may not be enforceable. You can revoke your data protection consent at any time with effect for the future, e.g., by changing your cookie settings or deleting your cookies. The revocation of consent does not affect the lawfulness of processing based on consent before its revocation. With a single action (clicking the consent button), you provide multiple consents. These include consents under EU/EEA data protection law as well as under CCPA/CPRA, ePrivacy, and telemedia law, and other international legal provisions, which are necessary, among other things, for storing and reading information and serve as the legal basis for planned further processing of the read data. Your consent includes, in particular, explicit consent to all downstream data processing by third-party providers, which may also take place in insecure third countries, especially for personalized and targeted advertising, by all companies mentioned in our privacy policy, as well as their sub-processors and controllers who receive or are transmitted data from these third-party providers or us within a data processing chain. You are aware that you can refuse your consent by clicking the other button or, if applicable, make individual settings. By your action, you also confirm that you have read and taken note of this privacy policy.

For all cookies and external connections integrated into our cookie banner, the legal bases include not only those listed in other sections of this privacy policy but also consent pursuant to Art. 6 (1) (a) GDPR and/or explicit consent pursuant to Art. 49 (1) (1) (a) GDPR.

17. Data protection provisions regarding the use of Calendly

Calendly offers user-friendly online scheduling software that allows us to organize meetings and appointments efficiently. The platform helps us compare the availability of all participants, send automatic reminders, and integrate meeting scheduling directly into our calendars. Calendly significantly improves the coordination of internal and external meetings and helps save time and increase productivity.

When using Calendly, personal data such as names, email addresses, and calendar information are processed. This data allows us to automate appointment scheduling, send personalized invitations, and maximize the efficiency of our appointment coordination.

The operating company of the service and thus the recipient of the personal data is: Calendly, Inc., 115 E Main St., Ste A1B, Buford, GA 30518, USA.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of the processing is to optimize appointment scheduling and improve organizational efficiency. The processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest being the simplification and increased efficiency of scheduling processes for internal and external meetings.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the service provider or statutory or contractual retention periods. The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obligated to provide us or the service provider with personal data. However, failure to provide such data may result in you being unable to use our services or those of the service provider.

Further information and the applicable data protection provisions of Calendly, LLC can be found at https://calendly.com.

18. Data protection provisions regarding the use of Facebook Connect

We use Facebook Connect to allow users to easily register or log in to our website using their Facebook credentials. The service facilitates access by automating login processes and transferring profile information. During use, personal data may be processed—particularly data that users make available via Facebook or that is transmitted technically. Data processed includes, among other things, name, email address, profile picture, language settings, Facebook ID, IP address, browser data, device data, and login timestamps.

Processing is carried out automatically via Meta's systems. As soon as users log in with Facebook, Facebook provides us with an authenticated connection and confirms their identity as well as the shared profile information. Data transmission is encrypted. Meta uses this information for authentication, to improve user security, and to analyze login behavior. We only receive the data that was requested as authorization.

The operating company of the service and thus the recipient of the personal data is: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For data subjects in the EU and the EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as the contact point and representative pursuant to Art. 27 GDPR. The representative under national law in Great Britain is: Meta Platforms Technologies UK Ltd, 10 Brock Street, Regent's Place, London, NW1 3FG, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of the processing is to optimize the login process. The processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest being the effective login to our systems and websites.

Further information and the applicable data protection provisions can be found at https://facebook.com.

19. Data protection provisions regarding the use of Google Chrome

We use the Google Chrome web browser to access web-based applications, display internet content, and integrate browser-based corporate services. Google Chrome is provided by Google and offers numerous features, including synchronization via Google accounts, integration with other Google services, automated form filling, voice control, and the use of extensions and security technologies. The use of Google Chrome may involve the processing of personal data, particularly when the browser is linked to a Google account or when users voluntarily enable synchronization services and extensions. Processed data includes IP addresses, search queries, browser history, installed extensions, location data, language settings, and technical device information.

When a user is signed in to a Google account, Chrome activities such as browsing history, bookmarks, passwords, and other browser settings can be synchronized across devices and stored on Google servers. Furthermore, if this feature is enabled, Chrome collects diagnostic data and usage statistics to improve the browser's stability, security, and performance. Personal information is also processed locally or on servers when forms are automatically filled (e.g., addresses or credit card details). Chrome may also use third-party tools such as Safe Browsing or translation services, which also trigger data processing operations.

The operating company of the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact point and representative pursuant to Art. 27 GDPR. The representative under national law in Great Britain is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative pursuant to Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for processing: The processing serves the secure, stable, and personalized use of the web browser, the synchronization of user preferences, the improvement of browser performance, protection against malicious content, and integration with other Google services. Processing is carried out on the basis of Art. 6 (1) (b) GDPR, i.e., for the performance of a contract to which the data subject is a party, and Art. 6 (1) (f) GDPR. The legitimate interest lies in the secure provision of internet functions, technical stability, user-friendliness, and the integration of services to optimize the online experience.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the service's operating company or statutory or contractual retention periods. The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obligated to provide us or the service's operating company with personal data. However, if you do not provide it, our services or those of the operating company may not be available for use.

Further information and the applicable data protection provisions of Google Chrome can be accessed at https://policies.google.com/privacy.

20. Data protection provisions regarding the deployment and use of JavaScript and JavaScript frameworks

On our website, we use JavaScript or JavaScript frameworks as a client-side programming language or JS framework for the dynamic display of content and for interaction within the browser. JavaScript enables, among other things, the display of pop-ups, the loading of dynamic content, the tracking of user behavior, the submission of forms, and communication with third-party providers via APIs. JavaScript is not an independent software product with an external operating company, but rather a scripting language integrated by default in web browsers that is executed on our websites.

The JavaScript-based source code is hosted on our own IT infrastructure and executed by the web browser. We are the operating company of the service.

Furthermore, as part of our web development, we may use various open-source JavaScript libraries or frameworks, such as Vue JS, Angular JS, or comparable projects. These serve the structured, modular expansion of our website's functionality, particularly for client-side validation, optimizing user guidance, reducing loading times, and asynchronous data processing. As far as technically possible, we host these components locally on our own IT infrastructure so that no data is transmitted to third parties. In certain cases, however, individual components may be integrated via external sources such as Content Delivery Networks (CDNs). This may result in connections being established with third-party servers, where IP addresses, technical metadata, or usage parameters are processed.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of the processing is to enable interactive functions, dynamic content, easier development, client-side validation, and improved user guidance. Processing is carried out on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in the simplified development and provision of a functional and user-friendly website.

The criteria for determining the duration for which personal data is processed are based on the respective purpose of the interaction, in particular the duration of the session or the storage of client-side information (e.g., in connection with cookies or local storage). The provision of personal data is required for the use of interactive website functions.

21. Data protection provisions regarding the deployment and use of Trustpilot

We use the review platform Trustpilot to give customers the opportunity to publicly share their experiences with our products and services. Trustpilot serves as an independent platform for collecting, displaying, and managing user reviews and contributes to transparency and building trust in customer interactions. As part of this usage, personal data may be processed, particularly when users submit reviews, receive review request emails, or when Trustpilot services are integrated into our website. Data processed includes, among other things, name or username, email address, IP address, review content, timestamps, technical usage data, and, where applicable, connection data with our customer management system.

Processing is carried out automatically via Trustpilot's systems. Users can submit a review either directly on the platform or via an invitation link received after a transaction. Reviews are displayed publicly on Trustpilot and linked to profile information. Companies can respond to reviews or have them commented on within the scope of moderation guidelines. Trustpilot processes data both to provide the review service and to improve platform functionality, fraud detection, and quality assurance. Integrating widgets or interfaces into our website may also lead to data exchange with Trustpilot.

The operating company of the service and thus the recipient of the personal data is: Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark. The representative under national law in Great Britain is: Trustpilot Ltd., 5th Floor, The Minster Building, 21 Mincing Lane, London, EC3R 7AG, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of the processing is the execution and publication of customer reviews, contacting users for review purposes, increasing transparency, improving service quality, and managing our reputation. Processing is carried out on the basis of Art. 6 (1) (a) GDPR when reviews are submitted voluntarily based on consent, as well as Art. 6 (1) (f) GDPR. The legitimate interest lies in the public presentation of our service quality, the receipt of customer feedback, building trust with potential new customers, and active reputation management.

Further information and the applicable data protection provisions of Trustpilot can be accessed at https://www.trustpilot.com/.

22. Data protection provisions regarding the deployment and use of Webflow

Webflow is an innovative design and development platform that allows users to visually create professional websites without needing to write code. Webflow offers a wide range of features for web design, including responsive layouts, CMS, e-commerce, and hosting services, to meet the needs of designers, developers, and businesses of all sizes.

When using Webflow services, personal data such as names, email addresses, payment information, and professional details are processed. Additionally, usage data, such as information about created websites, interaction data, and access statistics, may be collected. This data is necessary to provide the services, manage user accounts, improve support, and offer personalized experiences.

The operating company of the service and thus the recipient of the personal data is: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. For data subjects in the EU and the EEA, Webflow B.V., Zomerstraat 17-A, NL-5397 GH Lith, Netherlands, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: Webflow Europe UK Ltd., Birchin Court, 5th Floor, 19–25 Birchin Lane, London, EC3V 9DU, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of data processing is the use of the web design and development platform. The processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the data subject is a party, as well as on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of an efficient platform, the optimization of the user experience, and the utilization of effective customer support.

The service provider is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The service provider may be a certified member of one or more Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Webflow can be viewed at https://webflow.com.

23. Data protection provisions regarding the use of Amazon CloudFront

Amazon CloudFront is a global content delivery network. CloudFront accelerates the distribution of static and dynamic web content, such as .html, .css, .js files, and multimedia content, to users by distributing content across a worldwide network of data centers. This improves the loading speeds of websites and applications, reduces latency, and increases security through integration with other Amazon Web Services such as Amazon S3, Elastic Load Balancing, and Amazon EC2.

When using Amazon CloudFront, data such as IP addresses, device information, request URLs, and timestamps may be processed to efficiently serve user requests and ensure security.

The operating company of the service and thus the recipient of the personal data is: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA. For data subjects in the EU and EEA, Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, acts as the contact point and representative within the meaning of Art. 27 GDPR. The representative under national law in the UK is: Amazon Web Services UK Ltd., 1 Principal Place, Worship Street, London, EC2A 2FA, United Kingdom. The representative under Art. 14 of the Swiss Federal Act on Data Protection (FADP) in Switzerland is: Amazon Web Services Switzerland GmbH, Mythenquai 10, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of using Amazon CloudFront is the efficient delivery of web content, the improvement of website and application performance, and IT security. The processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest being the provision and use of a fast, reliable, and secure online experience for users.

The service provider is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. Amazon Web Services may be a certified member of one or more Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Amazon CloudFront can be accessed at https://aws.amazon.com.

24. Data protection provisions regarding the use of BootstrapCDN

We use BootstrapCDN to optimize the loading times of our websites and ensure a consistent design. By providing Bootstrap, a widely used frontend library, via a content delivery network, we can ensure that our websites load quickly and efficiently, resulting in an improved user experience. BootstrapCDN also allows us to access the latest versions of Bootstrap without having to manually update them on our servers.

When using BootstrapCDN, data such as the IP addresses of our website visitors is collected in order to process the request for Bootstrap resources. This information is used to optimize the service and ensure that content is delivered efficiently to end users.

The operating company of the service and thus the recipient of the personal data is: Volentio JSD Limited, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of the processing is to optimize loading times and improve the user experience on our website. The processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest being the efficient and secure provision of web content.

The company may have entered into one of the EU standard contractual clauses with us. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of BootstrapCDN can be accessed at https://www.bootstrapcdn.com.

25. Data protection provisions regarding the use of Cloudflare

Cloudflare offers a wide range of services to improve the security, performance, and reliability of websites and web applications. Core features include DDoS protection, a web application firewall, content delivery network services, secure DNS services, and more. By using Cloudflare, we can protect our online presence from cyberattacks, improve our website's loading speed, and ensure the general availability of our services.

When using Cloudflare services, data such as IP addresses, system configurations, and network traffic information are processed. This information is necessary to defend against threats, optimize data traffic, and provide insights into website usage.

The operating company of the service and therefore the recipient of the personal data is: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. For data subjects in the EU and the EEA, Cloudflare Netherlands B.V., Keizersgracht 62, 1015CS Amsterdam, Netherlands, acts as the contact point and representative pursuant to Article 27 of the GDPR. The representative under national law in Great Britain is: Cloudflare, Ltd., County Hall/The Riverside Building, Belvedere Road, London, SE1 7PB, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of the processing is to use services for securing and optimizing websites and web applications. Processing is based on Article 6(1)(f) of the GDPR, with the legitimate interest being the assurance of the security, performance, and reliability of our online presence.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operating company of the service or statutory or contractual retention periods. The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obligated to provide us or the operating company of the service with personal data. However, failure to do so may mean that you are unable to use our services or those of the operating company of the service.

Further information and the applicable data protection provisions of Cloudflare, Inc. can be accessed at https://www.cloudflare.com.

26. Data protection provisions regarding the deployment and use of jsDelivr

jsDelivr is a public, free Content Delivery Network that allows developers to efficiently host and deliver web libraries, jQuery plugins, CSS frameworks, fonts, and other JavaScript resources. By using jsDelivr, web developers can improve their website loading times by ensuring that these resources are loaded from servers that are geographically closer to the end users.

When using jsDelivr, data such as user IP addresses, type of requested resources, time of access, and browser information are processed. This data is collected primarily for service provision, performance optimization, and security purposes. jsDelivr employs data protection and security measures to protect the collected data, with a particular focus on compliance with the General Data Protection Regulation and other data protection laws.

The service provider and thus the recipient of the personal data is: Volentio JSD Limited, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of processing is the efficient delivery of web content via the CDN. Processing is based on legitimate interests in accordance with Art. 6 (1) (f) GDPR, namely the optimization of website loading times, the improvement of the user experience, and the assurance of service security.

Further information and the applicable data protection provisions of jsDelivr can be viewed at https://www.jsdelivr.com.

27. Data protection provisions regarding the deployment and use of Hotjar

Hotjar is an analysis and feedback tool that provides web developers and marketing staff with insights into the behavior of website visitors. Through a combination of visitor recordings, surveys, and feedback, Hotjar helps our company understand how users interact with our website, where improvements are needed, and how the overall user experience can be optimized.

When using Hotjar, personal data such as IP addresses, user behavior (clicks, mouse movements, scrolling behavior), device and browser information, as well as responses to surveys and feedback that may contain personal data, are processed. This data helps to analyze website usage and collect direct user feedback.

The service provider and thus the recipient of the personal data is: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta. The representative under national law in Great Britain is: Hotjar UK Limited, 10 Devonshire Square, London, EC2M 4YP, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of processing is to analyze user behavior on websites and to collect user feedback in order to improve the user experience. Processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest being the optimization of the website and the improvement of user satisfaction.

Further information and the applicable data protection provisions of Hotjar can be viewed at https://www.hotjar.com.

28. Data protection provisions regarding the deployment and use of jQuery

jQuery is a widely used JavaScript library that web developers use to simplify and accelerate HTML document management, event handling, animation, and Ajax interactions. The use of jQuery on our website serves to create a smoother and more interactive user experience. When visiting our website, jQuery may be used to collect certain data, such as information about user behavior and interactions on the page.

This data processing is indirect and is primarily aimed at improving website performance and usability. jQuery itself, as a client-side library, does not store or process personal data on its own servers. jQuery is executed in the user's browser and can be used for dynamic content updates, which may also involve transmitting data to external servers.

The service provider and thus the recipient of the personal data is: The jQuery Foundation, c/o OpenJS Foundation, 1 Letterman Drive, Suite D4700, San Francisco, CA 94129, USA.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of using jQuery is to improve the user experience on our website through an efficient interaction experience. Processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest being the provision and use of a functional, user-friendly, and visually appealing website.

The privacy policy for jQuery is available at https://jquery.com/.

29. Privacy policy regarding the use and application of Google Analytics

Google Analytics is a tool from Google LLC that provides website and app operators with detailed statistics on traffic and user behavior. It enables the collection and analysis of data on website visits, user interactions, and conversion rates, which helps operators understand and optimize their online presence. Google Analytics uses cookies to collect information about user behavior, including page views, time spent on the page, and the paths users take on the website.

When using Google Analytics, personal data such as IP addresses, browser information, and interaction data are processed. This data helps website operators measure the performance of their website, improve the user experience, and develop targeted marketing strategies.

The operating company of the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of processing is the analysis and optimization of websites, apps, and advertising. Processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest lying in improving the website, increasing user-friendliness, and the effectiveness of online marketing.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more of the Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable privacy policy for Google Analytics can be viewed at https://policies.google.com/privacy.

30. Privacy policy regarding the use and application of Google Ads

Google Ads, formerly known as Google AdWords, is an online advertising program from Google LLC that allows companies to run targeted ads to increase their visibility on the internet. Google Ads offers various ad formats, including search ads, display ads, YouTube video ads, and more, which allow companies to reach potential customers on Google search results pages, partner websites, and other platforms within the Google network.

When using Google Ads, personal data such as IP addresses, cookies, and other identifiers derived from interaction with advertisements are processed. This data helps measure the effectiveness of advertising campaigns, target audiences precisely, and personalize advertisements based on user interests and behavior.

The operating company of the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of processing is the analysis and optimization of online advertising campaigns. Processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest lying in the effective design and delivery of advertising campaigns that are relevant to both advertisers and users.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more of the Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable privacy policy for Google Ads can be viewed at https://policies.google.com/privacy.

31. Privacy policy regarding the use and application of Google Ads Conversion Tracking

Google Ads Conversion Tracking helps us measure the effectiveness of our advertising campaigns by recording which users perform a desired action on our website, such as a purchase or registration, after clicking on an ad. By using this tool, personal data such as IP addresses, click information, and page views are processed. This data is used to evaluate and optimize the success of Google Ads campaigns by providing insights into which ads and keywords lead to conversions. Google Ads Conversion Tracking helps us use our marketing budget more efficiently and plan targeted advertising measures to maximize return on investment (ROI).

The operating company of the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for processing: The purpose of processing is to measure and optimize advertising campaigns and improve marketing ROI. Processing is based on Art. 6 (1) (f) GDPR, with the legitimate interest lying in the optimization of advertising measures and efficient budget utilization.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more of the Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable privacy policy can be found at https://ads.google.com/.

32. Privacy policy regarding the use and application of Google Tag Manager

Google Tag Manager is a tag management system from Google LLC that allows website and app operators to easily implement and manage tags for web analytics and marketing optimization tools without having to change the source code of their websites or apps. Tags are small snippets of code used to analyze website data, understand user behavior, and monitor the efficiency of online marketing campaigns. Google Tag Manager supports the integration of a wide range of tags, including Google Analytics, Google Ads, and many third-party tags.

The service allows users to manage and trigger tags that can collect data. The processing and storage of this data is performed by the respective tags and not by Google Tag Manager.

The operating company of the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed, as well as the legal basis for the processing: The purpose of using Google Tag Manager is to simplify tag implementation and tag management. Processing is based on Art. 6 (1) (f) GDPR, where the legitimate interest lies in the optimization and increased efficiency of tag management and the associated web analytics and marketing activities.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Google Tag Manager can be viewed at https://policies.google.com/privacy.

33. Data protection provisions regarding the use and application of Instagram

Instagram is a widely used social network that allows users to share photos and videos, post stories, and interact with followers and friends. Instagram offers a variety of features, including direct messaging, IGTV for longer videos, Instagram Live for real-time broadcasts, and an Explore page to find new content and users.

When using Instagram, personal data such as names, email addresses, phone numbers, user content (photos, videos, comments, etc.), location data, usage information, and in some cases payment information are processed. This data helps to provide the service, ensure the security of the platform, offer personalized advertising, and improve the user experience.

The operating company of the service and thus the recipient of the personal data is: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For data subjects in the EU and the EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as the contact point and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: Meta Platforms Technologies UK Ltd, 10 Brock Street, Regent's Place, London, NW1 3FG, United Kingdom.

Purposes for which personal data are to be processed, as well as the legal basis for the processing: The purpose of the processing lies in the use and optimization of social networking functions. Processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the data subject is a party, as well as on Art. 6 (1) (f) GDPR, where the legitimate interest lies in improving and personalizing the user experience, providing customer support, ensuring the security and integrity of the platform, as well as in the use of the platform and marketing.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Instagram can be viewed at https:// instagram.com.

34. Data protection provisions regarding the use and application of LinkedIn

LinkedIn is a social network for professional contacts and career development. The platform allows users to create a professional profile, connect with colleagues, business partners, and potential employers, share professional experience and skills, and stay informed about industry news. LinkedIn also offers tools for companies and recruiters to search for talent, post job advertisements, and build a brand presence.

When using LinkedIn, personal data such as names, email addresses, professional titles and experience, educational background, skills, interests, and platform usage data are processed. This information is necessary to provide and use the service, create networking opportunities, present personalized content and job offers, and ensure the security of user data.

The operating company of the service and thus the recipient of the personal data is: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Purposes for which personal data are to be processed, as well as the legal basis for the processing: The purpose of the processing lies in the use and optimization of network and career services. Processing is based on the user's consent (Art. 6 (1) (a) GDPR), the performance of a contract (Art. 6 (1) (b) GDPR) to which the data subject is a party, as well as on legitimate interests (Art. 6 (1) (f) GDPR), such as marketing and recruitment.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may be a certified member of one or more Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of the LinkedIn Corporation can be viewed at https://www.linkedin.com.

35. Data protection provisions regarding the use and application of TikTok

TikTok, a platform for short video clips that enjoys great popularity worldwide, allows users to create, share, and discover creative content. On TikTok, users can dance, sing, showcase art, or participate in trends, thereby interacting with a global community.

When using TikTok, personal data such as names, email addresses, telephone numbers, dates of birth, profile information, user content (videos, comments), location data, and information from social networks are processed. This data is required to provide the services, personalize the platform, enable user interactions, and improve support.

The operating company of the service and thus the recipient of the personal data is: TikTok Pte. Ltd., 1 Raffles Quay, No. 26-10, South Tower, 048583, Singapore. For data subjects in the EU and the EEA, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the data processing is the use of the video platform. The processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the data subject is a party, as well as on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of a global platform for advertising and the increase of our market presence.

Further information and the applicable data protection provisions of TikTok can be viewed at https://www.tiktok.com.

36. Data protection provisions regarding the deployment and use of YouTube

YouTube is a platform for sharing and watching videos, used by individuals, artists, companies, and media organizations to publish a wide variety of content such as music videos, vlogs, educational material, and much more. YouTube offers users the ability to upload, share, and comment on videos and to interact with a broad community.

When using YouTube, personal data such as IP addresses, user interactions (e.g., videos watched, comments), location data (if enabled for services), and information from linked Google accounts are processed. This information is required to offer personalized content and advertising, enable user interactions, keep the platform secure, and improve the user experience.

The operating company of the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in Great Britain is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the data processing is the use of video-sharing services. The processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the data subject is a party, as well as on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of an efficient video platform, the improvement of the user experience, the use of personalized advertising, and the use of embedded videos on our website.

Further information and the applicable data protection provisions of YouTube can be viewed at https://policies.google.com.

37. Data protection provisions regarding the deployment and use of Stripe

Stripe is a technology company that offers powerful and flexible tools for e-commerce, including payment processing, billing, and financial management solutions. Stripe enables businesses of all sizes to accept and process online payments, manage subscriptions, and perform fraud prevention. The platform is known for reducing the complexity of financial transactions and making them more secure and user-friendly.

When using Stripe services, personal data such as names, addresses, email addresses, telephone numbers, bank and payment information, and transaction data are processed. This information is necessary to provide payment services, prevent fraud, offer customer support, and fulfill legal requirements.

The operating company of the service and thus the recipient of the personal data is: Stripe, Inc., 354 Oyster Point Boulevard, San Francisco, CA 94080, USA. For data subjects in the EU and the EEA, Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, acts as the contact person and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Stripe Payments UK Ltd., 9th Floor, 107 Cheapside, London, EC2V 6DN, United Kingdom.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the data processing is the use of payment processing via Stripe. The processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the data subject is a party, as well as on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the improvement of our services, fraud prevention, the use of efficient payment applications, and compliance with legal requirements.

The operating company of the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards as mentioned in Art. 46 (2) GDPR. The operating company of the service may have concluded one of the EU standard contracts with us. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the statutory or contractual retention periods. The provision of personal data is required by law or contract, or is necessary for the conclusion of a contract. While you are not obligated to provide us with personal data for this processing, failure to do so may mean that you are unable to use our services.

Further information and the applicable data protection provisions of Stripe can be viewed at https://stripe.com.

‍

Placeholder Company Website