(04474) 50519-0 info@agmadata.com

Privacy Policy

Preamble

With the fol­low­ing pri­va­cy pol­i­cy we would like to inform you which types of your per­son­al data (here­inafter also abbre­vi­at­ed as “data”) we process for which pur­pos­es and in which scope. The pri­va­cy state­ment applies to all pro­cess­ing of per­son­al data car­ried out by us, both in the con­text of pro­vid­ing our ser­vices and in par­tic­u­lar on our web­sites, in mobile appli­ca­tions and with­in exter­nal online pres­ences, such as our social media pro­files (here­inafter col­lec­tive­ly referred to as “online ser­vices”).

The terms used are not gen­der-spe­cif­ic.

Last Update: 1. Sep­tem­ber 2023

Legal text by Dr. Schwenke - please click for further information.

Table of contents

Controller

agma­da­ta GmbH

Autho­rised Rep­re­sen­ta­tives:
Hel­mut Voß­mann (Geschäftsführer/CEO)

E‑mail address: info@agmadata.com

Phone: +49 4474 50519–0

Legal Notice: https://agmadata.com/en/about-agmadata/imprint/

Contact information of the data protection officer

Daten­schutz Nord GmbH, Tom Lukas
tlukas@datenschutz-nord.de

Relevant legal bases

Rel­e­vant legal bases accord­ing to the GDPR: In the fol­low­ing, you will find an overview of the legal basis of the GDPR on which we base the pro­cess­ing of per­son­al data. Please note that in addi­tion to the pro­vi­sions of the GDPR, nation­al data pro­tec­tion pro­vi­sions of your or our coun­try of res­i­dence or domi­cile may apply. If, in addi­tion, more spe­cif­ic legal bases are applic­a­ble in indi­vid­ual cas­es, we will inform you of these in the data pro­tec­tion dec­la­ra­tion.

  • Con­sent (Arti­cle 6 (1) (a) GDPR) — The data sub­ject has giv­en con­sent to the pro­cess­ing of his or her per­son­al data for one or more spe­cif­ic pur­pos­es.
  • Per­for­mance of a con­tract and pri­or requests (Arti­cle 6 (1) (b) GDPR) — Per­for­mance of a con­tract to which the data sub­ject is par­ty or in order to take steps at the request of the data sub­ject pri­or to enter­ing into a con­tract.
  • Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR) — Pro­cess­ing is nec­es­sary for the pur­pos­es of the legit­i­mate inter­ests pur­sued by the con­troller or by a third par­ty, except where such inter­ests are over­rid­den by the inter­ests or fun­da­men­tal rights and free­doms of the data sub­ject which require pro­tec­tion of per­son­al data.
  • Job appli­ca­tion process as a pre-con­trac­tu­al or con­trac­tu­al rela­tion­ship (Arti­cle 6 (1) (b) GDPR) — If spe­cial cat­e­gories of per­son­al data with­in the mean­ing of Arti­cle 9 (1) GDPR (e.g. health data, such as severe­ly hand­i­capped sta­tus or eth­nic ori­gin) are request­ed from appli­cants with­in the frame­work of the appli­ca­tion pro­ce­dure, so that the respon­si­ble per­son or the per­son con­cerned can car­ry out the oblig­a­tions and exer­cis­ing spe­cif­ic rights of the con­troller or of the data sub­ject in the field of employ­ment and social secu­ri­ty and social pro­tec­tion law, their pro­cess­ing shall be car­ried out in accor­dance with Arti­cle 9 (2)(b) GDPR , in the case of the pro­tec­tion of vital inter­ests of appli­cants or oth­er per­sons on the basis of Arti­cle 9 (2)© GDPR or for the pur­pos­es of pre­ven­tive health care or occu­pa­tion­al med­i­cine, for the assess­ment of the employ­ee’s abil­i­ty to work, for med­ical diag­nos­tics, care or treat­ment in the health or social sec­tor or for the admin­is­tra­tion of sys­tems and ser­vices in the health or social sec­tor in accor­dance with Arti­cle 9 (2)(d) GDPR. In the case of a com­mu­ni­ca­tion of spe­cial cat­e­gories of data based on vol­un­tary con­sent, their pro­cess­ing is car­ried out on the basis of Arti­cle 9 (2)(a) GDPR.
  • Health­care, occu­pa­tion­al and social secu­ri­ty pro­cess­ing of spe­cial cat­e­gories of per­son­al data (Arti­cle 9 (2)(h) GDPR).
  • Con­sent to pro­cess­ing of spe­cial cat­e­gories of per­son­al data (Arti­cle 9 (2)(a) GDPR).
  • Pro­cess­ing of spe­cial cat­e­gories of per­son­al data to pro­tect vital inter­ests (Arti­cle 9 (2)© GDPR).

Nation­al data pro­tec­tion reg­u­la­tions in Ger­many: In addi­tion to the data pro­tec­tion reg­u­la­tions of the GDPR, nation­al reg­u­la­tions apply to data pro­tec­tion in Ger­many. This includes in par­tic­u­lar the Law on Pro­tec­tion against Mis­use of Per­son­al Data in Data Pro­cess­ing (Fed­er­al Data Pro­tec­tion Act — BDSG). In par­tic­u­lar, the BDSG con­tains spe­cial pro­vi­sions on the right to access, the right to erase, the right to object, the pro­cess­ing of spe­cial cat­e­gories of per­son­al data, pro­cess­ing for oth­er pur­pos­es and trans­mis­sion as well as auto­mat­ed indi­vid­ual deci­sion-mak­ing, includ­ing pro­fil­ing. Fur­ther­more, data pro­tec­tion laws of the indi­vid­ual fed­er­al states may apply.

Ref­er­ence to the applic­a­bil­i­ty of the GDPR and the Swiss DPA: These pri­va­cy notices serve both to pro­vide infor­ma­tion in accor­dance with the Swiss Fed­er­al Act on Data Pro­tec­tion (Swiss DPA) and the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR).

Overview of processing operations

The fol­low­ing table sum­maris­es the types of data processed, the pur­pos­es for which they are processed and the con­cerned data sub­jects.

Categories of Processed Data

  • Inven­to­ry data.
  • Loca­tion data.
  • Con­tact data.
  • Con­tent data.
  • Usage data.
  • Meta, com­mu­ni­ca­tion and process data.
  • Job appli­cant details.

Categories of Data Subjects

  • Com­mu­ni­ca­tion part­ner.
  • Users.
  • Job appli­cants.

Purposes of Processing

  • Pro­vi­sion of con­trac­tu­al ser­vices and ful­fill­ment of con­trac­tu­al oblig­a­tions.
  • Con­tact requests and com­mu­ni­ca­tion.
  • Secu­ri­ty mea­sures.
  • Direct mar­ket­ing.
  • Web Ana­lyt­ics.
  • Man­ag­ing and respond­ing to inquiries.
  • Job Appli­ca­tion Process.
  • Feed­back.
  • Pro­files with user-relat­ed infor­ma­tion.
  • Pro­vi­sion of our online ser­vices and usabil­i­ty.
  • Infor­ma­tion tech­nol­o­gy infra­struc­ture.

Security Precautions

We take appro­pri­ate tech­ni­cal and organ­i­sa­tion­al mea­sures in accor­dance with the legal require­ments, tak­ing into account the state of the art, the costs of imple­men­ta­tion and the nature, scope, con­text and pur­pos­es of pro­cess­ing as well as the risk of vary­ing like­li­hood and sever­i­ty for the rights and free­doms of nat­ur­al per­sons, in order to ensure a lev­el of secu­ri­ty appro­pri­ate to the risk.

The mea­sures include, in par­tic­u­lar, safe­guard­ing the con­fi­den­tial­i­ty, integri­ty and avail­abil­i­ty of data by con­trol­ling phys­i­cal and elec­tron­ic access to the data as well as access to, input, trans­mis­sion, secur­ing and sep­a­ra­tion of the data. In addi­tion, we have estab­lished pro­ce­dures to ensure that data sub­jects’ rights are respect­ed, that data is erased, and that we are pre­pared to respond to data threats rapid­ly. Fur­ther­more, we take the pro­tec­tion of per­son­al data into account as ear­ly as the devel­op­ment or selec­tion of hard­ware, soft­ware and ser­vice providers, in accor­dance with the prin­ci­ple of pri­va­cy by design and pri­va­cy by default.

Mask­ing of the IP address: If IP address­es are processed by us or by the ser­vice providers and tech­nolo­gies used and the pro­cess­ing of a com­plete IP address is not nec­es­sary, the IP address is short­ened (also referred to as “IP mask­ing”). In this process, the last two dig­its or the last part of the IP address after a full stop are removed or replaced by wild­cards. The mask­ing of the IP address is intend­ed to pre­vent the iden­ti­fi­ca­tion of a per­son by means of their IP address or to make such iden­ti­fi­ca­tion sig­nif­i­cant­ly more dif­fi­cult.

TLS encryp­tion (https): To pro­tect your data trans­mit­ted via our online ser­vices, we use TLS encryp­tion. You can rec­og­nize such encrypt­ed con­nec­tions by the pre­fix https:// in the address bar of your brows­er.

Transmission of Personal Data

In the con­text of our pro­cess­ing of per­son­al data, it may hap­pen that the data is trans­ferred to oth­er places, com­pa­nies or per­sons or that it is dis­closed to them. Recip­i­ents of this data may include, for exam­ple, ser­vice providers com­mis­sioned with IT tasks or providers of ser­vices and con­tent that are embed­ded in a web­site. In such cas­es, the legal require­ments will be respect­ed and in par­tic­u­lar cor­re­spond­ing con­tracts or agree­ments, which serve the pro­tec­tion of your data, will be con­clud­ed with the recip­i­ents of your data.

International data transfers

If we process data in a third coun­try (i.e. out­side the Euro­pean Union (EU), the Euro­pean Eco­nom­ic Area (EEA)) or the pro­cess­ing takes place in the con­text of the use of third par­ty ser­vices or dis­clo­sure or trans­fer of data to oth­er per­sons, bod­ies or com­pa­nies, this will only take place in accor­dance with the legal require­ments.

Sub­ject to express con­sent or trans­fer required by con­tract or law, we process or have processed the data only in third coun­tries with a recog­nised lev­el of data pro­tec­tion, on the basis of spe­cial guar­an­tees, such as a con­trac­tu­al oblig­a­tion through so-called stan­dard pro­tec­tion claus­es of the EU Com­mis­sion or if cer­ti­fi­ca­tions or bind­ing inter­nal data pro­tec­tion reg­u­la­tions jus­ti­fy the pro­cess­ing (Arti­cle 44 to 49 GDPR, infor­ma­tion page of the EU Com­mis­sion: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).

Data Pro­cess­ing in Third Coun­tries: If we process data in a third coun­try (i.e., out­side the Euro­pean Union (EU) or the Euro­pean Eco­nom­ic Area (EEA)), or if the pro­cess­ing is done with­in the con­text of using third-par­ty ser­vices or the dis­clo­sure or trans­fer of data to oth­er indi­vid­u­als, enti­ties, or com­pa­nies, this is only done in accor­dance with legal require­ments. If the data pro­tec­tion lev­el in the third coun­try has been rec­og­nized by an ade­qua­cy deci­sion (Arti­cle 45 GDPR), this serves as the basis for data trans­fer. Oth­er­wise, data trans­fers only occur if the data pro­tec­tion lev­el is oth­er­wise ensured, espe­cial­ly through stan­dard con­trac­tu­al claus­es (Arti­cle 46 (2)© GDPR), explic­it con­sent, or in cas­es of con­trac­tu­al or legal­ly required trans­fers (Arti­cle 49 (1) GDPR). Fur­ther­more, we pro­vide you with the basis of third-coun­try trans­fers from indi­vid­ual third-coun­try providers, with ade­qua­cy deci­sions pri­mar­i­ly serv­ing as the foun­da­tion. “Infor­ma­tion regard­ing third-coun­try trans­fers and exist­ing ade­qua­cy deci­sions can be obtained from the infor­ma­tion pro­vid­ed by the EU Com­mis­sion: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en.

EU-US Trans-Atlantic Data Pri­va­cy Frame­work: With­in the con­text of the so-called “Data Pri­va­cy Frame­work” (DPF), the EU Com­mis­sion has also rec­og­nized the data pro­tec­tion lev­el for cer­tain com­pa­nies from the USA as secure with­in the ade­qua­cy deci­sion of 10th July 2023. The list of cer­ti­fied com­pa­nies as well as addi­tion­al infor­ma­tion about the DPF can be found on the web­site of the US Depart­ment of Com­merce at https://www.dataprivacyframework.gov/. We will inform you which of our ser­vice providers are cer­ti­fied under the Data Pri­va­cy Frame­work as part of our data pro­tec­tion notices.

Rights of Data Subjects

Rights of the Data Sub­jects under the GDPR: As data sub­ject, you are enti­tled to var­i­ous rights under the GDPR, which arise in par­tic­u­lar from Arti­cles 15 to 21 of the GDPR:

  • Right to Object: You have the right, on grounds aris­ing from your par­tic­u­lar sit­u­a­tion, to object at any time to the pro­cess­ing of your per­son­al data which is based on let­ter (e) or (f) of Arti­cle 6(1) GDPR, includ­ing pro­fil­ing based on those pro­vi­sions. Where per­son­al data are processed for direct mar­ket­ing pur­pos­es, you have the right to object at any time to the pro­cess­ing of the per­son­al data con­cern­ing you for the pur­pose of such mar­ket­ing, which includes pro­fil­ing to the extent that it is relat­ed to such direct mar­ket­ing.
  • Right of with­draw­al for con­sents: You have the right to revoke con­sents at any time.
  • Right of access: You have the right to request con­fir­ma­tion as to whether the data in ques­tion will be processed and to be informed of this data and to receive fur­ther infor­ma­tion and a copy of the data in accor­dance with the pro­vi­sions of the law.
  • Right to rec­ti­fi­ca­tion: You have the right, in accor­dance with the law, to request the com­ple­tion of the data con­cern­ing you or the rec­ti­fi­ca­tion of the incor­rect data con­cern­ing you.
  • Right to Era­sure and Right to Restric­tion of Pro­cess­ing: In accor­dance with the statu­to­ry pro­vi­sions, you have the right to demand that the rel­e­vant data be erased imme­di­ate­ly or, alter­na­tive­ly, to demand that the pro­cess­ing of the data be restrict­ed in accor­dance with the statu­to­ry pro­vi­sions.
  • Right to data porta­bil­i­ty: You have the right to receive data con­cern­ing you which you have pro­vid­ed to us in a struc­tured, com­mon and machine-read­able for­mat in accor­dance with the legal require­ments, or to request its trans­mis­sion to anoth­er con­troller.
  • Com­plaint to the super­vi­so­ry author­i­ty: In accor­dance with the law and with­out prej­u­dice to any oth­er admin­is­tra­tive or judi­cial rem­e­dy, you also have the right to lodge a com­plaint with a data pro­tec­tion super­vi­so­ry author­i­ty, in par­tic­u­lar a super­vi­so­ry author­i­ty in the Mem­ber State where you habit­u­al­ly reside, the super­vi­so­ry author­i­ty of your place of work or the place of the alleged infringe­ment, if you con­sid­er that the pro­cess­ing of per­son­al data con­cern­ing you infringes the GDPR.

Use of Cookies

Cook­ies are small text files or oth­er data records that store infor­ma­tion on end devices and read infor­ma­tion from the end devices. For exam­ple, to store the login sta­tus in a user account, the con­tents of a shop­ping cart in an e‑shop, the con­tents accessed or the func­tions used. Cook­ies can also be used for var­i­ous pur­pos­es, e.g. for pur­pos­es of func­tion­al­i­ty, secu­ri­ty and con­ve­nience of online offers as well as the cre­ation of analy­ses of vis­i­tor flows.

Infor­ma­tion on con­sent: We use cook­ies in accor­dance with the statu­to­ry pro­vi­sions. There­fore, we obtain pri­or con­sent from users, except when it is not required by law. In par­tic­u­lar, con­sent is not required if the stor­age and read­ing of infor­ma­tion, includ­ing cook­ies, is strict­ly nec­es­sary in order to pro­vide an infor­ma­tion soci­ety ser­vice explic­it­ly request­ed by the sub­scriber or user. Essen­tial cook­ies usu­al­ly include cook­ies with func­tions relat­ed to the dis­play and oper­abil­i­ty of the onli­ne­ser­vice, load bal­anc­ing, secu­ri­ty, stor­age of users’ pref­er­ences and choic­es or sim­i­lar pur­pos­es relat­ed to the pro­vi­sion of the main and sec­ondary func­tions of the onli­ne­ser­vice request­ed by users. The revo­ca­ble con­sent will be clear­ly com­mu­ni­cat­ed to the user and will con­tain the infor­ma­tion on the respec­tive cook­ie use.

Infor­ma­tion on legal bases under data pro­tec­tion law: The legal basis under data pro­tec­tion law on which we process users’ per­son­al data with the use of cook­ies depends on whether we ask users for con­sent. If users con­sent, the legal basis for pro­cess­ing their data is their declared con­sent. Oth­er­wise, the data processed with the help of cook­ies is processed on the basis of our legit­i­mate inter­ests (e.g. in a busi­ness oper­a­tion of our online ser­vices and improve­ment of its usabil­i­ty) or, if this is done in the con­text of the ful­fill­ment of our con­trac­tu­al oblig­a­tions, if the use of cook­ies is nec­es­sary to ful­fill our con­trac­tu­al oblig­a­tions. For which pur­pos­es the cook­ies are processed by us, we do clar­i­fy in the course of this pri­va­cy pol­i­cy or in the con­text of our con­sent and pro­cess­ing pro­ce­dures.

Reten­tion peri­od: With regard to the reten­tion peri­od, a dis­tinc­tion is drawn between the fol­low­ing types of cook­ies:

 

  • Tem­po­rary cook­ies (also known as “ses­sion cook­ies”): Tem­po­rary cook­ies are delet­ed at the lat­est after a user has left an online ser­vice and closed his or her end device (i.e. brows­er or mobile appli­ca­tion). 
  • Per­ma­nent cook­ies: Per­ma­nent cook­ies remain stored even after the ter­mi­nal device is closed. For exam­ple, the login sta­tus can be saved, or pre­ferred con­tent can be dis­played direct­ly when the user vis­its a web­site again. Like­wise, user data col­lect­ed with the help of cook­ies can be used for reach mea­sure­ment. Unless we pro­vide users with explic­it infor­ma­tion about the type and stor­age dura­tion of cook­ies (e.g., as part of obtain­ing con­sent), users should assume that cook­ies are per­ma­nent and that the stor­age peri­od can be up to two years.

Gen­er­al notes on revo­ca­tion and objec­tion (so-called “Opt-Out”): Users can revoke the con­sents they have giv­en at any time and object to the pro­cess­ing in accor­dance with legal require­ments. Users can restrict the use of cook­ies in their brows­er set­tings, among oth­er options (although this may also lim­it the func­tion­al­i­ty of our online offer­ing). A objec­tion to the use of cook­ies for online mar­ket­ing pur­pos­es can also be made through the web­sites https://optout.aboutads.info and https://www.youronlinechoices.com/.

  • Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR). Con­sent (Arti­cle 6 (1) (a) GDPR).

Fur­ther infor­ma­tion on pro­cess­ing meth­ods, pro­ce­dures and ser­vices used:

  • Pro­cess­ing Cook­ie Data on the Basis of Con­sent: We use a cook­ie man­age­ment solu­tion in which users’ con­sent to the use of cook­ies, or the pro­ce­dures and providers men­tioned in the cook­ie man­age­ment solu­tion, can be obtained, man­aged and revoked by the users. The dec­la­ra­tion of con­sent is stored so that it does not have to be retrieved again and the con­sent can be proven in accor­dance with the legal oblig­a­tion. Stor­age can take place serv­er-sided and/or in a cook­ie (so-called opt-out cook­ie or with the aid of com­pa­ra­ble tech­nolo­gies) in order to be able to assign the con­sent to a user or and/or his/her device. Sub­ject to indi­vid­ual details of the providers of cook­ie man­age­ment ser­vices, the fol­low­ing infor­ma­tion applies: The dura­tion of the stor­age of the con­sent can be up to two years. In this case, a pseu­do­ny­mous user iden­ti­fi­er is formed and stored with the date/time of con­sent, infor­ma­tion on the scope of the con­sent (e.g. which cat­e­gories of cook­ies and/or ser­vice providers) as well as the brows­er, sys­tem and used end device; Legal Basis: Con­sent (Arti­cle 6 (1) (a) GDPR).

Provision of online services and web hosting

We process user data in order to be able to pro­vide them with our online ser­vices. For this pur­pose, we process the IP address of the user, which is nec­es­sary to trans­mit the con­tent and func­tions of our online ser­vices to the user’s brows­er or ter­mi­nal device.

  • Processed data types: Usage data (e.g. web­sites vis­it­ed, inter­est in con­tent, access times). Meta, com­mu­ni­ca­tion and process data (e.g. IP address­es, time infor­ma­tion, iden­ti­fi­ca­tion num­bers, con­sent sta­tus).
  • Data sub­jects: Users (e.g. web­site vis­i­tors, users of online ser­vices).
  • Pur­pos­es of Pro­cess­ing: Pro­vi­sion of our online ser­vices and usabil­i­ty; Infor­ma­tion tech­nol­o­gy infra­struc­ture (Oper­a­tion and pro­vi­sion of infor­ma­tion sys­tems and tech­ni­cal devices, such as com­put­ers, servers, etc.).). Secu­ri­ty mea­sures.
  • Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR).

Fur­ther infor­ma­tion on pro­cess­ing meth­ods, pro­ce­dures and ser­vices used:

  • Col­lec­tion of Access Data and Log Files: The access to our online ser­vices is logged in the form of so-called “serv­er log files”. Serv­er log files may include the address and name of the web pages and files accessed, the date and time of access, data vol­umes trans­ferred, noti­fi­ca­tion of suc­cess­ful access, brows­er type and ver­sion, the user’s oper­at­ing sys­tem, refer­rer URL (the pre­vi­ous­ly vis­it­ed page) and, as a gen­er­al rule, IP address­es and the request­ing provider. The serv­er log files can be used for secu­ri­ty pur­pos­es, e.g. to avoid over­load­ing the servers (espe­cial­ly in the case of abu­sive attacks, so-called DDoS attacks) and to ensure the sta­bil­i­ty and opti­mal load bal­anc­ing of the servers; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR). Reten­tion peri­od: Log file infor­ma­tion is stored for a max­i­mum peri­od of 30 days and then delet­ed or anonymized. Data, the fur­ther stor­age of which is nec­es­sary for evi­dence pur­pos­es, are exclud­ed from dele­tion until the respec­tive inci­dent has been final­ly clar­i­fied.
  • ALL-INKL: Ser­vices in the field of the pro­vi­sion of infor­ma­tion tech­nol­o­gy infra­struc­ture and relat­ed ser­vices (e.g. stor­age space and/or com­put­ing capac­i­ties); Ser­vice provider: ALL-INKL.COM — Neue Medi­en Mün­nich, Inhab­er: René Mün­nich, Haupt­straße 68, 02742 Frieder­s­dorf, Ger­many; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR); Web­site: https://all-inkl.com/; Pri­va­cy Pol­i­cy: https://all-inkl.com/datenschutzinformationen/. Data Pro­cess­ing Agree­ment: Pro­vid­ed by the ser­vice provider.

Contact and Inquiry Management

When con­tact­ing us (e.g. via mail, con­tact form, e‑mail, tele­phone or via social media) as well as in the con­text of exist­ing user and busi­ness rela­tion­ships, the infor­ma­tion of the inquir­ing per­sons is processed to the extent nec­es­sary to respond to the con­tact requests and any request­ed mea­sures.

  • Processed data types: Con­tact data (e.g. e‑mail, tele­phone num­bers); Con­tent data (e.g. text input, pho­tographs, videos); Usage data (e.g. web­sites vis­it­ed, inter­est in con­tent, access times). Meta, com­mu­ni­ca­tion and process data (e.g. IP address­es, time infor­ma­tion, iden­ti­fi­ca­tion num­bers, con­sent sta­tus).
  • Data sub­jects: Com­mu­ni­ca­tion part­ner (Recip­i­ents of e‑mails, let­ters, etc.).
  • Pur­pos­es of Pro­cess­ing: Con­tact requests and com­mu­ni­ca­tion; Man­ag­ing and respond­ing to inquiries; Feed­back (e.g. col­lect­ing feed­back via online form). Pro­vi­sion of our online ser­vices and usabil­i­ty.
  • Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR). Per­for­mance of a con­tract and pri­or requests (Arti­cle 6 (1) (b) GDPR).

Fur­ther infor­ma­tion on pro­cess­ing meth­ods, pro­ce­dures and ser­vices used:

  • Con­tact form: When users con­tact us via our con­tact form, e‑mail or oth­er com­mu­ni­ca­tion chan­nels, we process the data pro­vid­ed to us in this con­text to process the com­mu­ni­cat­ed request; Legal Basis: Per­for­mance of a con­tract and pri­or requests (Arti­cle 6 (1) (b) GDPR), Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR).

Job Application Process

The appli­ca­tion process requires appli­cants to pro­vide us with the data nec­es­sary for their assess­ment and selec­tion. The infor­ma­tion required can be found in the job descrip­tion or, in the case of online forms, in the infor­ma­tion con­tained there­in.

In prin­ci­ple, the required infor­ma­tion includes per­son­al infor­ma­tion such as name, address, a con­tact option and proof of the qual­i­fi­ca­tions required for a par­tic­u­lar employ­ment. Upon request, we will be hap­py to pro­vide you with addi­tion­al infor­ma­tion.

If made avail­able, appli­cants can sub­mit their appli­ca­tions via an online form. The data will be trans­mit­ted to us encrypt­ed accord­ing to the state of the art. Appli­cants can also send us their appli­ca­tions by e‑mail. Please note, how­ev­er, that e‑mails on the Inter­net are gen­er­al­ly not sent in encrypt­ed form. As a rule, e‑mails are encrypt­ed dur­ing trans­port, but not on the servers from which they are sent and received. We can there­fore accept no respon­si­bil­i­ty for the trans­mis­sion path of the appli­ca­tion between the sender and the recep­tion on our serv­er. For the pur­pos­es of search­ing for appli­cants, sub­mit­ting appli­ca­tions and select­ing appli­cants, we may make use of the appli­cant man­age­ment and recruit­ment soft­ware, plat­forms and ser­vices of third-par­ty providers in com­pli­ance with legal require­ments. Appli­cants are wel­come to con­tact us about how to sub­mit their appli­ca­tion or send it to us by reg­u­lar mail.

Pro­cess­ing of spe­cial cat­e­gories of data: To the extent that spe­cial cat­e­gories of per­son­al data (Arti­cle 9(1) GDPR, e.g., health data, such as dis­abil­i­ty sta­tus or eth­nic ori­gin) are request­ed from appli­cants dur­ing the appli­ca­tion process, their pro­cess­ing is car­ried out so that the con­troller or the data sub­ject can exer­cise rights aris­ing from employ­ment law and the law of social secu­ri­ty and social pro­tec­tion, in the case of pro­tec­tion of vital inter­ests of the appli­cants or oth­er per­sons, or for pur­pos­es of pre­ven­tive or occu­pa­tion­al med­i­cine, for the assess­ment of the employ­ee’s work abil­i­ty, for med­ical diag­no­sis, for the pro­vi­sion or treat­ment in the health or social sec­tor, or for the man­age­ment of sys­tems and ser­vices in the health or social sec­tor.

Erea­sure of data: In the event of a suc­cess­ful appli­ca­tion, the data pro­vid­ed by the appli­cants may be fur­ther processed by us for the pur­pos­es of the employ­ment rela­tion­ship. Oth­er­wise, if the appli­ca­tion for a job offer is not suc­cess­ful, the appli­can­t’s data will be delet­ed. Appli­cants’ data will also be delet­ed if an appli­ca­tion is with­drawn, to which appli­cants are enti­tled at any time. Sub­ject to a jus­ti­fied revo­ca­tion by the appli­cant, the dele­tion will take place at the lat­est after the expiry of a peri­od of six months, so that we can answer any fol­low-up ques­tions regard­ing the appli­ca­tion and com­ply with our duty of proof under the reg­u­la­tions on equal treat­ment of appli­cants. Invoic­es for any reim­burse­ment of trav­el expens­es are archived in accor­dance with tax reg­u­la­tions.

Admis­sion to a tal­ent pool — Admis­sion to a tal­ent pool, if offered, is based on con­sent. Appli­cants are informed that their con­sent to be includ­ed in the tal­ent pool is vol­un­tary, has no influ­ence on the cur­rent appli­ca­tion process and that they can revoke their con­sent at any time for the future.

  • Processed data types: Inven­to­ry data (e.g. names, address­es); Con­tact data (e.g. e‑mail, tele­phone num­bers); Con­tent data (e.g. text input, pho­tographs, videos). Job appli­cant details (e.g. Per­son­al data, postal and con­tact address­es and the doc­u­ments per­tain­ing to the appli­ca­tion and the infor­ma­tion con­tained there­in, such as cov­er let­ter, cur­ricu­lum vitae, cer­tifi­cates, etc., as well as oth­er infor­ma­tion on the per­son or qual­i­fi­ca­tions of appli­cants pro­vid­ed with regard to a spe­cif­ic job or vol­un­tar­i­ly by appli­cants).
  • Data sub­jects: Job appli­cants.
  • Pur­pos­es of Pro­cess­ing: Job Appli­ca­tion Process (Estab­lish­ment and pos­si­ble lat­er exe­cu­tion as well as pos­si­ble lat­er ter­mi­na­tion of the employ­ment rela­tion­ship).
  • Legal Basis: Job appli­ca­tion process as a pre-con­trac­tu­al or con­trac­tu­al rela­tion­ship (Arti­cle 6 (1) (b) GDPR); Health­care, occu­pa­tion­al and social secu­ri­ty pro­cess­ing of spe­cial cat­e­gories of per­son­al data (Arti­cle 9 (2)(h) GDPR); Con­sent to pro­cess­ing of spe­cial cat­e­gories of per­son­al data (Arti­cle 9 (2)(a) GDPR). Pro­cess­ing of spe­cial cat­e­gories of per­son­al data to pro­tect vital inter­ests (Arti­cle 9 (2)© GDPR).

Newsletter and Electronic Communications

We send newslet­ters, e‑mails and oth­er elec­tron­ic com­mu­ni­ca­tions (here­inafter referred to as “newslet­ters”) only with the con­sent of the recip­i­ent or a legal per­mis­sion. Inso­far as the con­tents of the newslet­ter are specif­i­cal­ly described with­in the frame­work of reg­is­tra­tion, they are deci­sive for the con­sent of the user. Oth­er­wise, our newslet­ters con­tain infor­ma­tion about our ser­vices and us.

In order to sub­scribe to our newslet­ters, it is gen­er­al­ly suf­fi­cient to enter your e‑mail address. We may, how­ev­er, ask you to pro­vide a name for the pur­pose of con­tact­ing you per­son­al­ly in the newslet­ter or to pro­vide fur­ther infor­ma­tion if this is required for the pur­pos­es of the newslet­ter.

Dou­ble opt-in pro­ce­dure: The reg­is­tra­tion to our newslet­ter takes place in gen­er­al in a so-called Dou­ble-Opt-In pro­ce­dure. This means that you will receive an e‑mail after reg­is­tra­tion ask­ing you to con­firm your reg­is­tra­tion. This con­fir­ma­tion is nec­es­sary so that no one can reg­is­ter with exter­nal e‑mail address­es.

The reg­is­tra­tions for the newslet­ter are logged in order to be able to prove the reg­is­tra­tion process accord­ing to the legal require­ments. This includes stor­ing the login and con­fir­ma­tion times as well as the IP address. Like­wise the changes of your data stored with the dis­patch ser­vice provider are logged.

Dele­tion and restric­tion of pro­cess­ing: We may store the unsub­scribed email address­es for up to three years based on our legit­i­mate inter­ests before delet­ing them to pro­vide evi­dence of pri­or con­sent. The pro­cess­ing of these data is lim­it­ed to the pur­pose of a pos­si­ble defense against claims. An indi­vid­ual dele­tion request is pos­si­ble at any time, pro­vid­ed that the for­mer exis­tence of a con­sent is con­firmed at the same time. In the case of an oblig­a­tion to per­ma­nent­ly observe an objec­tion, we reserve the right to store the e‑mail address sole­ly for this pur­pose in a block­list.

The log­ging of the reg­is­tra­tion process takes place on the basis of our legit­i­mate inter­ests for the pur­pose of prov­ing its prop­er course. If we com­mis­sion a ser­vice provider to send e‑mails, this is done on the basis of our legit­i­mate inter­ests in an effi­cient and secure send­ing sys­tem.

Con­tents:

Infor­ma­tion about us, our ser­vices, pro­mo­tions and offers.

  • Processed data types: Inven­to­ry data (e.g. names, address­es); Con­tact data (e.g. e‑mail, tele­phone num­bers); Meta, com­mu­ni­ca­tion and process data (e.g. IP address­es, time infor­ma­tion, iden­ti­fi­ca­tion num­bers, con­sent sta­tus). Usage data (e.g. web­sites vis­it­ed, inter­est in con­tent, access times).
  • Data sub­jects: Com­mu­ni­ca­tion part­ner (Recip­i­ents of e‑mails, let­ters, etc.).
  • Pur­pos­es of Pro­cess­ing: Direct mar­ket­ing (e.g. by e‑mail or postal). Web Ana­lyt­ics (e.g. access sta­tis­tics, recog­ni­tion of return­ing vis­i­tors).
  • Legal Basis: Con­sent (Arti­cle 6 (1) (a) GDPR). Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR).
  • Opt-Out: You can can­cel the receipt of our newslet­ter at any time, i.e. revoke your con­sent or object to fur­ther receipt. You will find a link to can­cel the newslet­ter either at the end of each newslet­ter or you can oth­er­wise use one of the con­tact options list­ed above, prefer­ably e‑mail.

Fur­ther infor­ma­tion on pro­cess­ing meth­ods, pro­ce­dures and ser­vices used:

  • Mea­sure­ment of open­ing rates and click rates: The newslet­ters con­tain a so-called “web-bea­con”, i.e. a pix­el-sized file, which is retrieved from our serv­er when the newslet­ter is opened or, if we use a mail­ing ser­vice provider, from its serv­er. With­in the scope of this retrieval, tech­ni­cal infor­ma­tion such as infor­ma­tion about the brows­er and your sys­tem, as well as your IP address and time of retrieval are first col­lect­ed.

    This infor­ma­tion is used for the tech­ni­cal improve­ment of our newslet­ter on the basis of tech­ni­cal data or tar­get groups and their read­ing behav­iour on the basis of their retrieval points (which can be deter­mined with the help of the IP address) or access times. This analy­sis also includes deter­min­ing whether newslet­ters are opened, when they are opened and which links are clicked. This infor­ma­tion is assigned to the indi­vid­ual newslet­ter recip­i­ents and stored in their pro­files until the pro­files are delet­ed. The eval­u­a­tions serve us much more to rec­og­nize the read­ing habits of our users and to adapt our con­tent to them or to send dif­fer­ent con­tent accord­ing to the inter­ests of our users.

    The mea­sure­ment of open­ing rates and click rates as well as the stor­age of the mea­sure­ment results in the pro­files of the users and their fur­ther pro­cess­ing are based on the con­sent of the users.

    A sep­a­rate objec­tion to the per­for­mance mea­sure­ment is unfor­tu­nate­ly not pos­si­ble, in this case the entire newslet­ter sub­scrip­tion must be can­celled or object­ed to. In this case, the stored pro­file infor­ma­tion will be delet­ed;
    Legal Basis: Con­sent (Arti­cle 6 (1) (a) GDPR).

  • Bre­vo: E‑mail dis­patch and automa­tion ser­vices; Ser­vice provider: Send­in­blue GmbH, Köpenick­er Str. 126, 10179 Berlin, Ger­many; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR); Web­site: https://www.brevo.com/; Pri­va­cy Pol­i­cy: https://www.brevo.com/de/legal/privacypolicy/. Data Pro­cess­ing Agree­ment: Pro­vid­ed by the ser­vice provider.

Commercial communication by E‑Mail, Postal Mail, Fax or Telephone

We process per­son­al data for the pur­pos­es of pro­mo­tion­al com­mu­ni­ca­tion, which may be car­ried out via var­i­ous chan­nels, such as e‑mail, tele­phone, post or fax, in accor­dance with the legal require­ments.

The recip­i­ents have the right to with­draw their con­sent at any time or to object to the adver­tis­ing com­mu­ni­ca­tion at any time.

After revo­ca­tion or objec­tion, we store the data required to prove the past autho­riza­tion to con­tact or send up to three years from the end of the year of revo­ca­tion or objec­tion on the basis of our legit­i­mate inter­ests. The pro­cess­ing of this data is lim­it­ed to the pur­pose of a pos­si­ble defense against claims. Based on the legit­i­mate inter­est to per­ma­nent­ly observe the revo­ca­tion, respec­tive­ly objec­tion of the users, we fur­ther store the data nec­es­sary to avoid a renewed con­tact (e.g. depend­ing on the com­mu­ni­ca­tion chan­nel, the e‑mail address, tele­phone num­ber, name).

  • Processed data types: Inven­to­ry data (e.g. names, address­es). Con­tact data (e.g. e‑mail, tele­phone num­bers).
  • Data sub­jects: Com­mu­ni­ca­tion part­ner (Recip­i­ents of e‑mails, let­ters, etc.).
  • Pur­pos­es of Pro­cess­ing: Direct mar­ket­ing (e.g. by e‑mail or postal).
  • Legal Basis: Con­sent (Arti­cle 6 (1) (a) GDPR). Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR).

Web Analysis, Monitoring and Optimization

Web analy­sis is used to eval­u­ate the vis­i­tor traf­fic on our web­site and may include the behav­iour, inter­ests or demo­graph­ic infor­ma­tion of users, such as age or gen­der, as pseu­do­ny­mous val­ues. With the help of web analy­sis we can e.g. rec­og­nize, at which time our online ser­vices or their func­tions or con­tents are most fre­quent­ly used or request­ed for repeat­ed­ly, as well as which areas require opti­miza­tion.

In addi­tion to web analy­sis, we can also use test pro­ce­dures, e.g. to test and opti­mize dif­fer­ent ver­sions of our online ser­vices or their com­po­nents.

Unless oth­er­wise stat­ed below, pro­files, i.e. data aggre­gat­ed for a usage process, can be cre­at­ed for these pur­pos­es and infor­ma­tion can be stored in a brows­er or in a ter­mi­nal device and read from it. The infor­ma­tion col­lect­ed includes, in par­tic­u­lar, web­sites vis­it­ed and ele­ments used there as well as tech­ni­cal infor­ma­tion such as the brows­er used, the com­put­er sys­tem used and infor­ma­tion on usage times. If users have agreed to the col­lec­tion of their loca­tion data from us or from the providers of the ser­vices we use, loca­tion data may also be processed.

Unless oth­er­wise stat­ed below, pro­files, that is data sum­ma­rized for a usage process or user, may be cre­at­ed for these pur­pos­es and stored in a brows­er or ter­mi­nal device (so-called “cook­ies”) or sim­i­lar process­es may be used for the same pur­pose. The infor­ma­tion col­lect­ed includes, in par­tic­u­lar, web­sites vis­it­ed and ele­ments used there as well as tech­ni­cal infor­ma­tion such as the brows­er used, the com­put­er sys­tem used and infor­ma­tion on usage times. If users have con­sent­ed to the col­lec­tion of their loca­tion data or pro­files to us or to the providers of the ser­vices we use, these may also be processed, depend­ing on the provider.

The IP address­es of the users are also stored. How­ev­er, we use any exist­ing IP mask­ing pro­ce­dure (i.e. pseu­do­nymi­sa­tion by short­en­ing the IP address) to pro­tect the user. In gen­er­al, with­in the frame­work of web analy­sis, A/B test­ing and opti­mi­sa­tion, no user data (such as e‑mail address­es or names) is stored, but pseu­do­nyms. This means that we, as well as the providers of the soft­ware used, do not know the actu­al iden­ti­ty of the users, but only the infor­ma­tion stored in their pro­files for the pur­pos­es of the respec­tive process­es.

  • Processed data types: Usage data (e.g. web­sites vis­it­ed, inter­est in con­tent, access times). Meta, com­mu­ni­ca­tion and process data (e.g. IP address­es, time infor­ma­tion, iden­ti­fi­ca­tion num­bers, con­sent sta­tus).
  • Data sub­jects: Users (e.g. web­site vis­i­tors, users of online ser­vices).
  • Pur­pos­es of Pro­cess­ing: Web Ana­lyt­ics (e.g. access sta­tis­tics, recog­ni­tion of return­ing vis­i­tors); Pro­files with user-relat­ed infor­ma­tion (Cre­at­ing user pro­files). Pro­vi­sion of our online ser­vices and usabil­i­ty.
  • Secu­ri­ty mea­sures: IP Mask­ing (Pseu­do­nymiza­tion of the IP address).
  • Legal Basis: Con­sent (Arti­cle 6 (1) (a) GDPR). Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR).

Fur­ther infor­ma­tion on pro­cess­ing meth­ods, pro­ce­dures and ser­vices used:

  • Google Ana­lyt­ics 4: We use Google Ana­lyt­ics to per­form mea­sure­ment and analy­sis of the use of our online ser­vices by users based on a pseu­do­ny­mous user iden­ti­fi­ca­tion num­ber. This iden­ti­fi­ca­tion num­ber does not con­tain any unique data, such as names or email address­es. It is used to assign analy­sis infor­ma­tion to an end device in order to rec­og­nize which con­tent users have accessed with­in one or var­i­ous usage process­es, which search terms they have used, have accessed again or have inter­act­ed with our online ser­vices. Like­wise, the time of use and its dura­tion are stored, as well as the sources of users refer­ring to our online ser­vices and tech­ni­cal aspects of their end devices and browsers. In the process, pseu­do­ny­mous pro­files of users are cre­at­ed with infor­ma­tion from the use of var­i­ous devices, and cook­ies may be used. Google Ana­lyt­ics does not log or store indi­vid­ual IP address­es. Ana­lyt­ics does pro­vide coarse geo-loca­tion data by deriv­ing the fol­low­ing meta­da­ta from IP address­es: City (and the derived lat­i­tude, and lon­gi­tude of the city), Con­ti­nent, Coun­try, Region, Sub­con­ti­nent (and ID-based coun­ter­parts). For EU-based traf­fic, IP-address data is used sole­ly for geo-loca­tion data deriva­tion before being imme­di­ate­ly dis­card­ed. It is not logged, acces­si­ble, or used for any addi­tion­al use cas­es. When Ana­lyt­ics col­lects mea­sure­ment data, all IP lookups are per­formed on EU-based servers before for­ward­ing traf­fic to Ana­lyt­ics servers for pro­cess­ing; Ser­vice provider: Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR); Web­site: https://marketingplatform.google.com/intl/en/about/analytics/; Pri­va­cy Pol­i­cy: https://policies.google.com/privacy; Data Pro­cess­ing Agree­ment: https://business.safety.google/adsprocessorterms/; Basis for third coun­try trans­fer: EU-US Data Pri­va­cy Frame­work (DPF), Stan­dard Con­trac­tu­al Claus­es (https://business.safety.google/adsprocessorterms); Opt-Out: Opt-Out-Plu­g­in: https://tools.google.com/dlpage/gaoptout?hl=en, Set­tings for the Dis­play of Adver­tise­ments: https://adssettings.google.com/authenticated. Fur­ther Infor­ma­tion: https://privacy.google.com/businesses/adsservices (Types of pro­cess­ing and data processed).
  • Google Tag Man­ag­er: Google Tag Man­ag­er is a solu­tion with which we can man­age so-called web­site tags via an inter­face and thus inte­grate oth­er ser­vices into our online ser­vices (please refer to fur­ther details in this pri­va­cy pol­i­cy). With the Tag Man­ag­er itself (which imple­ments the tags), for exam­ple, no user pro­files are cre­at­ed or cook­ies are stored. Google only receives the IP address of the user, which is nec­es­sary to run the Google Tag Man­ag­er; Ser­vice provider: Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land; Legal Basis: Con­sent (Arti­cle 6 (1) (a) GDPR); Web­site: https://marketingplatform.google.com; Pri­va­cy Pol­i­cy: https://policies.google.com/privacy; Data Pro­cess­ing Agree­ment: https://business.safety.google/adsprocessorterms. Basis for third coun­try trans­fer: EU-US Data Pri­va­cy Frame­work (DPF), Stan­dard Con­trac­tu­al Claus­es (https://business.safety.google/adsprocessorterms).

Plugins and embedded functions and content

With­in our online ser­vices, we inte­grate func­tion­al and con­tent ele­ments that are obtained from the servers of their respec­tive providers (here­inafter referred to as “third-par­ty providers”). These may, for exam­ple, be graph­ics, videos or city maps (here­inafter uni­form­ly referred to as “Con­tent”).

The inte­gra­tion always pre­sup­pos­es that the third-par­ty providers of this con­tent process the IP address of the user, since they could not send the con­tent to their brows­er with­out the IP address. The IP address is there­fore required for the pre­sen­ta­tion of these con­tents or func­tions. We strive to use only those con­tents, whose respec­tive offer­ers use the IP address only for the dis­tri­b­u­tion of the con­tents. Third par­ties may also use so-called pix­el tags (invis­i­ble graph­ics, also known as “web bea­cons”) for sta­tis­ti­cal or mar­ket­ing pur­pos­es. The “pix­el tags” can be used to eval­u­ate infor­ma­tion such as vis­i­tor traf­fic on the pages of this web­site. The pseu­do­ny­mous infor­ma­tion may also be stored in cook­ies on the user’s device and may include tech­ni­cal infor­ma­tion about the brows­er and oper­at­ing sys­tem, refer­ring web­sites, vis­it times and oth­er infor­ma­tion about the use of our web­site, as well as may be linked to such infor­ma­tion from oth­er sources.

  • Processed data types: Usage data (e.g. web­sites vis­it­ed, inter­est in con­tent, access times); Meta, com­mu­ni­ca­tion and process data (e.g. IP address­es, time infor­ma­tion, iden­ti­fi­ca­tion num­bers, con­sent sta­tus); Inven­to­ry data (e.g. names, address­es); Con­tact data (e.g. e‑mail, tele­phone num­bers); Con­tent data (e.g. text input, pho­tographs, videos). Loca­tion data (Infor­ma­tion on the geo­graph­i­cal posi­tion of a device or per­son).
  • Data sub­jects: Users (e.g. web­site vis­i­tors, users of online ser­vices).
  • Pur­pos­es of Pro­cess­ing: Pro­vi­sion of our online ser­vices and usabil­i­ty. Pro­vi­sion of con­trac­tu­al ser­vices and ful­fill­ment of con­trac­tu­al oblig­a­tions.
  • Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR).

Fur­ther infor­ma­tion on pro­cess­ing meth­ods, pro­ce­dures and ser­vices used:

  • Google Fonts (from Google Serv­er): Obtain­ing fonts (and sym­bols) for the pur­pose of a tech­ni­cal­ly secure, main­te­nance-free and effi­cient use of fonts and sym­bols with regard to time­li­ness and load­ing times, their uni­form pre­sen­ta­tion and con­sid­er­a­tion of pos­si­ble restric­tions under licens­ing law. The provider of the fonts is informed of the user’s IP address so that the fonts can be made avail­able in the user’s brows­er. In addi­tion, tech­ni­cal data (lan­guage set­tings, screen res­o­lu­tion, oper­at­ing sys­tem, hard­ware used) are trans­mit­ted which are nec­es­sary for the pro­vi­sion of the fonts depend­ing on the devices used and the tech­ni­cal envi­ron­ment. This data may be processed on a serv­er of the provider of the fonts in the USA — When vis­it­ing our online ser­vices, users’ browsers send their brows­er HTTP requests to the Google Fonts Web API. The Google Fonts Web API pro­vides users with Google Fonts’ cas­cad­ing style sheets (CSS) and then with the fonts spec­i­fied in the CCS. These HTTP requests include (1) the IP address used by each user to access the Inter­net, (2) the request­ed URL on the Google serv­er, and (3) the HTTP head­ers, includ­ing the user agent describ­ing the brows­er and oper­at­ing sys­tem ver­sions of the web­site vis­i­tors, as well as the refer­ral URL (i.e., the web page where the Google font is to be dis­played). IP address­es are not logged or stored on Google servers and they are not ana­lyzed. The Google Fonts Web API logs details of HTTP requests (request­ed URL, user agent, and refer­ring URL). Access to this data is restrict­ed and strict­ly con­trolled. The request­ed URL iden­ti­fies the font fam­i­lies for which the user wants to load fonts. This data is logged so that Google can deter­mine how often a par­tic­u­lar font fam­i­ly is request­ed. With the Google Fonts Web API, the user agent must match the font that is gen­er­at­ed for the par­tic­u­lar brows­er type. The user agent is logged pri­mar­i­ly for debug­ging pur­pos­es and is used to gen­er­ate aggre­gate usage sta­tis­tics that mea­sure the pop­u­lar­i­ty of font fam­i­lies. These aggre­gate usage sta­tis­tics are pub­lished on Google Fonts’ Ana­lyt­ics page. Final­ly, the refer­ral URL is logged so that the data can be used for pro­duc­tion main­te­nance and to gen­er­ate an aggre­gate report on top inte­gra­tions based on the num­ber of font requests. Google says it does not use any of the infor­ma­tion col­lect­ed by Google Fonts to pro­file end users or serve tar­get­ed ads; Ser­vice provider: Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR); Web­site: https://fonts.google.com/; Pri­va­cy Pol­i­cy: https://policies.google.com/privacy; Basis for third coun­try trans­fer: EU-US Data Pri­va­cy Frame­work (DPF). Fur­ther Infor­ma­tion: https://developers.google.com/fonts/faq/privacy?hl=en.
  • Font Awe­some (Pro­vi­sion on own serv­er): Dis­play of fonts and sym­bols; Ser­vice provider: The Font Awe­some icons are host­ed on our serv­er, no data is trans­mit­ted to the provider of Font Awe­some; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR).
  • Google Maps: We inte­grate the maps of the ser­vice “Google Maps” from the provider Google. The data processed may include, in par­tic­u­lar, IP address­es and loca­tion data of users; Ser­vice provider: Google Cloud EMEA Lim­it­ed, 70 Sir John Rogerson’s Quay, Dublin 2, Ire­land; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR); Web­site: https://mapsplatform.google.com/; Pri­va­cy Pol­i­cy: https://policies.google.com/privacy. Basis for third coun­try trans­fer: EU-US Data Pri­va­cy Frame­work (DPF).
  • reCAPTCHA: We inte­grate the “reCAPTCHA” func­tion to be able to recog­nise whether entries (e.g. in online forms) are made by humans and not by auto­mat­i­cal­ly oper­at­ing machines (so-called “bots”). The data processed may include IP address­es, infor­ma­tion on oper­at­ing sys­tems, devices or browsers used, lan­guage set­tings, loca­tion, mouse move­ments, key­strokes, time spent on web­sites, pre­vi­ous­ly vis­it­ed web­sites, inter­ac­tions with ReCaptcha on oth­er web­sites, pos­si­bly cook­ies and results of man­u­al recog­ni­tion process­es (e.g. answer­ing ques­tions asked or select­ing objects in images). The data pro­cess­ing is based on our legit­i­mate inter­est to pro­tect our online ser­vices from abu­sive auto­mat­ed crawl­ing and spam; Ser­vice provider: Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land, , par­ent com­pa­ny: Google LLC, 1600 Amphithe­atre Park­way, Moun­tain View, CA 94043, USA; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR); Web­site: https://www.google.com/recaptcha/; Pri­va­cy Pol­i­cy: https://policies.google.com/privacy; Basis for third coun­try trans­fer: EU-US Data Pri­va­cy Frame­work (DPF). Opt-Out: Opt-Out-Plu­g­in: https://tools.google.com/dlpage/gaoptout?hl=en, Set­tings for the Dis­play of Adver­tise­ments: https://adssettings.google.com/authenticated.
  • YouTube videos: Video con­tents; Ser­vice provider: Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land, , par­ent com­pa­ny: Google LLC, 1600 Amphithe­atre Park­way, Moun­tain View, CA 94043, USA; Legal Basis: Legit­i­mate Inter­ests (Arti­cle 6 (1) (f) GDPR); Web­site: https://www.youtube.com; Pri­va­cy Pol­i­cy: https://policies.google.com/privacy; Basis for third coun­try trans­fer: EU-US Data Pri­va­cy Frame­work (DPF). Opt-Out: Opt-Out-Plu­g­in: https://tools.google.com/dlpage/gaoptout?hl=en, Set­tings for the Dis­play of Adver­tise­ments: https://adssettings.google.com/authenticated.

Changes and Updates to the Privacy Policy

We kind­ly ask you to inform your­self reg­u­lar­ly about the con­tents of our data pro­tec­tion dec­la­ra­tion. We will adjust the pri­va­cy pol­i­cy as changes in our data pro­cess­ing prac­tices make this nec­es­sary. We will inform you as soon as the changes require your coop­er­a­tion (e.g. con­sent) or oth­er indi­vid­ual noti­fi­ca­tion.

If we pro­vide address­es and con­tact infor­ma­tion of com­pa­nies and orga­ni­za­tions in this pri­va­cy pol­i­cy, we ask you to note that address­es may change over time and to ver­i­fy the infor­ma­tion before con­tact­ing us.

Terminology and Definitions

In this sec­tion, you will find an overview of the ter­mi­nol­o­gy used in this pri­va­cy pol­i­cy. Where the ter­mi­nol­o­gy is legal­ly defined, their legal def­i­n­i­tions apply. The fol­low­ing expla­na­tions, how­ev­er, are pri­mar­i­ly intend­ed to aid under­stand­ing.

  • Con­troller: “Con­troller” means the nat­ur­al or legal per­son, pub­lic author­i­ty, agency or oth­er body which, alone or joint­ly with oth­ers, deter­mines the pur­pos­es and means of the pro­cess­ing of per­son­al data.
  • Loca­tion data: Loca­tion data is cre­at­ed when a mobile device (or anoth­er device with the tech­ni­cal require­ments for a loca­tion deter­mi­na­tion) con­nects to a radio cell, a WLAN or sim­i­lar tech­ni­cal means and func­tions of loca­tion deter­mi­na­tion. Loca­tion data serve to indi­cate the geo­graph­i­cal­ly deter­minable posi­tion of the earth at which the respec­tive device is locat­ed. Loca­tion data can be used, for exam­ple, to dis­play map func­tions or oth­er infor­ma­tion depen­dent on a loca­tion.
  • Per­son­al Data: “per­son­al data” means any infor­ma­tion relat­ing to an iden­ti­fied or iden­ti­fi­able nat­ur­al per­son (“data sub­ject”); an iden­ti­fi­able nat­ur­al per­son is one who can be iden­ti­fied, direct­ly or indi­rect­ly, in par­tic­u­lar by ref­er­ence to an iden­ti­fi­er such as a name, an iden­ti­fi­ca­tion num­ber, loca­tion data, an online iden­ti­fi­er or to one or more fac­tors spe­cif­ic to the phys­i­cal, phys­i­o­log­i­cal, genet­ic, men­tal, eco­nom­ic, cul­tur­al or social iden­ti­ty of that nat­ur­al per­son.
  • Pro­cess­ing: The term “pro­cess­ing” cov­ers a wide range and prac­ti­cal­ly every han­dling of data, be it col­lec­tion, eval­u­a­tion, stor­age, trans­mis­sion or era­sure.
  • Pro­files with user-relat­ed infor­ma­tion: The pro­cess­ing of “pro­files with user-relat­ed infor­ma­tion”, or “pro­files” for short, includes any kind of auto­mat­ed pro­cess­ing of per­son­al data that con­sists of using these per­son­al data to analyse, eval­u­ate or pre­dict cer­tain per­son­al aspects relat­ing to a nat­ur­al per­son (depend­ing on the type of pro­fil­ing, this may include dif­fer­ent infor­ma­tion con­cern­ing demo­graph­ics, behav­iour and inter­ests, such as inter­ac­tion with web­sites and their con­tent, etc.) (e.g. inter­ests in cer­tain con­tent or prod­ucts, click behav­iour on a web­site or loca­tion). Cook­ies and web bea­cons are often used for pro­fil­ing pur­pos­es.
  • Web Ana­lyt­ics: Web Ana­lyt­ics serves the eval­u­a­tion of vis­i­tor traf­fic of online ser­vices and can deter­mine their behav­ior or inter­ests in cer­tain infor­ma­tion, such as con­tent of web­sites. With the help of web ana­lyt­ics, web­site own­ers, for exam­ple, can rec­og­nize at what time vis­i­tors vis­it their web­site and what con­tent they are inter­est­ed in. This allows them, for exam­ple, to opti­mize the con­tent of the web­site to bet­ter meet the needs of their vis­i­tors. For pur­pos­es of web ana­lyt­ics, pseu­do­ny­mous cook­ies and web bea­cons are fre­quent­ly used in order to recog­nise return­ing vis­i­tors and thus obtain more pre­cise analy­ses of the use of an online ser­vice.