Data Protection Declaration
As of: April 5, 2025
Table of Contents
- Controller
- Overview of Processing Activities
- Applicable Legal Bases
- Security Measures
- Transmission of Personal Data
- International data transfers
- Deletion of data
- Rights of Data Subjects
- Use of cookies
- Business services
- Use of Online Platforms for Offering and Sales Purposes
- Providers and Services Used in the Course of Business Operations
- Payment procedure
- Provision of the Online Offer and Web Hosting
- Registration, login and user account
- Community features
- Blogs and publication media
- Push notifications
- Newsletters and electronic notifications
- Advertising communication via email, post, fax or telephone
- Sweepstakes and competitions
- Surveys and polls
- Web analysis, monitoring and optimization
- Onlinemarketing
- Affiliate programs and affiliate links
- Customer reviews and rating processes
- Presences in social networks (social media)
- Plugins and embedded functions and content
- Management, organization and support tools
- Changes and updates to the privacy policy
- Definitions of terms
Controller
If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, correction, blocking, or deletion of data, or revoke any previously given consent, you may contact us via email or postal mail using the following contact details:
1001 SMILES – V.A.D.P.O.
Via Vincenzo Statella 75
96100 Syracuse
Italy
Contact
E-mail address:hallo@1001smiles.de
Responsible party within the meaning of the GDPR:
Vivien Arleta Di Pietro Ognissanti
Address as above
Impressum: https://1001smiles.de/impressum/
Overview of Processing Activities
The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects concerned.
Types of data processed
- Inventory data.
- Payment details.
- Contact details.
- Content data.
- Contract data.
- Usage data.
- Meta, communication and procedural data.
Categories of data subjects
- Customers
- Interested parties.
- Communication partner.
- Users.
- Sweepstakes and competition participants.
- Business and contractual partners.
- Participant.
Purposes of processing
- Provision of contractual services and fulfillment of contractual obligations.
- Contact requests and communication.
- Security Measures
- Direct marketing.
- Reach measurement.
- Tracking.
- Office and organizational procedures.
- Affiliate tracking.
- Managing and responding to inquiries.
- Conducting prize draws and competitions.
- Feedback.
- Marketing.
- Profiles with user-related information.
- Provision of our online services and user-friendliness.
- Information technology infrastructure.
Applicable Legal Bases
Applicable Legal Bases according to the GDPR: Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country or our country of residence or establishment. If, in specific cases, more specific legal bases are applicable, we will inform you of these in the privacy policy.
- Consent (Art. 6 para. 1 sentence 1 letter a) GDPR) The data subject has given their consent to the processing of their personal data for a specific purpose or purposes.
- Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR) The processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract.
- Legal obligation (Art. 6 para. 1 sentence 1 letter c) GDPR) The processing is necessary for compliance with a legal obligation to which the controller is subject.
- Legitimate interests (Art. 6 para. 1 sentence 1 letter f) GDPR) The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, outweigh those interests.
National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), which contains specific provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, data transfer, and automated decision-making, including profiling. Additionally, state-level data protection laws of the individual federal states may also apply.
National data protection regulations in Austria: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Austria. This includes, in particular, the Federal Act on the Protection of Natural Persons in the Processing of Personal Data (Data Protection Act – DSG). The Data Protection Act contains specific provisions regarding the right of access, the right to rectification or erasure, the processing of special categories of personal data, processing for other purposes, data transfer, and automated decision-making in individual cases.
Relevant legal bases under the Swiss Data Protection Act: If you are located in Switzerland, we process your data based on the Federal Data Protection Act (Swiss DPA). This also applies if our processing of your data otherwise affects you in Switzerland. The Swiss DPA does not require, as is the case with the GDPR, that a legal basis for processing personal data must be specified. We process personal data only when the processing is lawful, carried out in good faith, and is proportionate (Art. 6 para. 1 and 2 of the Swiss DPA). Furthermore, personal data is only collected for specific, identifiable purposes and is processed in a manner compatible with those purposes (Art. 6 para. 3 of the Swiss DPA).
Reference to the validity of GDPR and Swiss DSG: These privacy notices serve to provide information in accordance with both the Swiss Federal Data Protection Act (Swiss DPA) and the General Data Protection Regulation (GDPR). Therefore, please note that due to the broader geographical application and clarity, the terms used in the GDPR are applied. Specifically, instead of the terms "processing" of "personal data," "overriding interest," and "sensitive personal data" used in the Swiss DPA, the GDPR terms "processing" of "personal data," "legitimate interest," and "special categories of data" are used. However, the legal meaning of these terms will still be determined in accordance with the Swiss DPA within the context of its application.
Security Measures
In accordance with legal requirements and taking into account the state of technology, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and extent of threats to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection that is commensurate with the risk.
The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling both physical and electronic access to the data, as well as access, input, disclosure, ensuring availability, and separation of the data. Additionally, we have established procedures that ensure the exercise of data subject rights, data deletion, and responses to data threats. Furthermore, we consider the protection of personal data during the development or selection of hardware, software, and procedures in accordance with the principle of data protection through technical design and data protection-friendly default settings.
Transmission of Personal Data
As part of our processing of personal data, there are instances where the data is transferred or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers tasked with IT-related duties or providers of services and content embedded in a website. In such cases, we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.
International data transfers
Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if the processing occurs as part of using third-party services or the disclosure or transfer of data to other individuals, entities, or companies, this will only be done in compliance with legal requirements. If the level of data protection in the third country has been recognized by an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers will only take place if the level of data protection is secured by other means, particularly through standard contractual clauses (Art. 46 para. 2 letter c) GDPR), explicit consent, or in the case of contractual or legally required transfers (Art. 49 para. 1 GDPR). Furthermore, we will inform you of the basis for data transfers to third countries with the individual third-party providers, with adequacy decisions being prioritized as the basis. Information about third-country transfers and existing adequacy decisions can be found in the EU Commission's informational offerings: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de.
EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called "Data Privacy Framework" (DPF), the European Commission has also recognized the level of data protection as adequate for certain companies from the United States under the adequacy decision of July 10, 2023. The list of certified companies, as well as additional information about the DPF, can be found on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English) can be found. We will inform you, within the privacy notice, which of the service providers we use are certified under the Data Privacy Framework.
Disclosure of personal data abroad: According to the Swiss Data Protection Act (DSG), we disclose personal data abroad only if an adequate level of protection for the data subjects is ensured (Art. 16 Swiss DSG). If the Federal Council has not determined an adequate level of protection (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we take alternative security measures. These may include international agreements, specific guarantees, data protection clauses in contracts, standard data protection clauses approved by the Federal Data Protection and Information Commissioner (FDPIC), or company-specific data protection regulations that have been pre-approved by the FDPIC or the competent data protection authority of another country.
According to Art. 16 of the Swiss Data Protection Act (DSG), exceptions for the disclosure of data abroad may be permitted if certain conditions are met, including the consent of the data subject, contract performance, public interest, protection of life or physical integrity, publicly available data, or data from a legally established register. Such disclosures always take place in compliance with legal requirements.
Deletion of data
The data we process will be deleted in accordance with legal requirements as soon as the consents granted for processing are revoked or other authorizations expire (e.g., when the purpose of processing these data no longer exists or they are no longer required for that purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be limited to those purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons or whose storage is necessary for the assertion, exercise, or defense of legal claims, or to protect the rights of another natural or legal person. Our privacy policy may also contain further information regarding the retention and deletion of data that apply primarily to the respective processing activities.
Rights of Data Subjects
Rights of Data Subjects under the GDPR: As data subjects, you have various rights under the GDPR, which are primarily derived from Articles 15 to 21 of the GDPR:
- Right to Object: You have the right to object, at any time, to the processing of your personal data based on Article 6(1)(e) or (f) of the GDPR, for reasons related to your particular situation; this also applies to profiling based on these provisions. If your personal data is being processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.
- Right of withdrawal for consents: You have the right to revoke your consent at any time.
- Right to information: You have the right to request confirmation as to whether your data is being processed, and to obtain information about these data, as well as further details and a copy of the data in accordance with legal requirements.
- Right to rectification: You have the right, in accordance with legal requirements, to request the completion of your data or the correction of inaccurate data concerning you.
- Right to erasure and restriction of processing: You have the right, in accordance with legal requirements, to request the immediate deletion of your data, or alternatively, to request a restriction of the processing of your data in accordance with legal provisions.
- Right to data portability: You have the right, in accordance with legal requirements, to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, or to request the transmission of those data to another controller.
- Complaint to the supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the provisions of the GDPR.
Use of cookies
Cookies are small text files or other storage notes that store information on end devices and retrieve information from those devices. For example, they can store login status in a user account, shopping cart contents in an e-shop, the accessed content, or features used on an online service. Cookies can also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as for analyzing visitor traffic.
Notes on consent: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users, unless this is not legally required. Consent is not necessary, in particular, when storing and retrieving information, including cookies, is absolutely necessary to provide the telemedia service explicitly requested by the users (i.e., our online service). Necessary cookies generally include those that support the display and functionality of the online service, load balancing, security, storing user preferences and choices, or similar purposes related to providing the main and ancillary functions of the online service requested by the users. The revocable consent is clearly communicated to users and includes information about the specific cookie usage.
Information on data protection legal bases: The legal basis for processing users' personal data using cookies depends on whether we ask for consent. If users consent, the legal basis for processing their data is the stated consent. Otherwise, the data processed using cookies will be based on our legitimate interests (e.g., in the operational management of our online service and improving its usability) or, if this is necessary for the fulfillment of our contractual obligations, when the use of cookies is required to meet those obligations. We will inform users about the purposes for which cookies are processed in this privacy policy or during our consent and processing processes.
Storage period: With regard to the retention period, the following types of cookies are distinguished:
- Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest once a user leaves an online service and closes their device (e.g., browser or mobile application).
- Persistent cookies: Permanent cookies remain stored even after the device is closed. For example, they can store the login status or display preferred content directly when the user visits a website again. Additionally, the data collected through cookies can be used for reach measurement. Unless we provide explicit information to users about the type and storage duration of cookies (e.g., during the consent process), users should assume that cookies are permanent and the storage duration may be up to two years.
General information on revocation and objection (so-called “opt-out”): Users can withdraw their consent at any time and object to the processing in accordance with legal requirements. To do so, users can, among other things, limit the use of cookies in their browser settings (although this may restrict the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be made through the websites https://optout.aboutads.info and https://www.youronlinechoices.com/ be explained.
- Applicable Legal Bases Legitimate interests (Art. 6 para. 1 sentence 1 letter f) GDPR)
Further information on processing procedures, methods and services:
- Processing of cookie data based on consent: We use a cookie consent management procedure in which user consents to the use of cookies, or the processes and providers mentioned in the cookie consent management process, are obtained, managed, and can be withdrawn by users. The consent declaration is stored to avoid having to ask for consent again and to demonstrate compliance with legal obligations. The storage can be done server-side and/or in a cookie (a so-called opt-in cookie, or using similar technologies) to associate the consent with a user or their device. Subject to individual details regarding the providers of cookie management services, the following information applies: The duration of the consent storage can be up to two years. A pseudonymous user identifier is created and stored with the time of consent, details regarding the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system, and device used. Applicable Legal Bases Consent (Article 6 (1) (a) GDPR).
- Compliance: Cookie consent management; Service provider: Execution on servers and/or computers under its own data protection responsibility. Website: https://complianz.io/; Data Protection Declaration https://complianz.io/legal/. Further information: An individual user ID, language, types of consents, and the time of their submission are stored server-side and in the cookie on the user's device.
Business services
We process data of our contractual and business partners, e.g. customers and prospects (collectively referred to as “contractual partners”), within the scope of contractual and similar legal relationships, as well as related measures and communication with the contractual partners (including pre-contractual communication), for example to respond to inquiries.
We process this data in order to fulfill our contractual obligations. This includes, in particular, the obligation to provide the agreed services, any necessary updates, and remedies in the event of warranty claims or other service disruptions. Furthermore, we process the data to protect our rights and for purposes related to administrative tasks and business organization associated with these obligations. We also process the data on the basis of our legitimate interests in the proper and economically efficient operation of our business and in implementing security measures to protect our contractual partners and business operations from misuse, threats to their data, trade secrets, information, and rights (e.g. by involving telecommunications, transport and other auxiliary services, subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). In accordance with applicable laws, we only disclose data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to comply with legal obligations. Contractual partners will be informed within this privacy policy about any further types of data processing, such as for marketing purposes.
We inform our contractual partners about which data is required for the aforementioned purposes before or during the data collection process—e.g., via online forms, by using specific markings (such as colors) or symbols (such as asterisks), or in person.
We delete the data after the expiration of statutory warranty and comparable obligations, generally after four years, unless the data is stored in a customer account, for example, due to legal archiving requirements. The statutory retention period is ten years for documents relevant under tax law, such as accounting books, inventories, opening balances, annual financial statements, and the organizational documents and instructions required to understand these records, as well as accounting receipts. For received commercial and business correspondence and copies of sent commercial and business correspondence, the retention period is six years. The period begins at the end of the calendar year in which the last entry was made in the records, the inventory, opening balance, annual financial statement, or management report was prepared, the commercial or business letter was received or sent, the accounting document was created, or the recording was made, or the other document was generated.
To the extent that we use third-party providers or platforms to deliver our services, the terms of service and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.
- Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email, phone numbers); contract data (e.g., subject of contract, duration, customer category); usage data (e.g., visited websites, interest in content, access times); meta-, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Customers; prospective customers; business and contractual partners.
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; contact requests and communication; office and organizational procedures. Administration and response to inquiries.
- Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Further information on processing procedures, methods and services:
- Customer account: Customers can create an account within our online services (e.g., customer or user account, referred to as "customer account"). If the registration of a customer account is required, customers will be informed about this as well as the necessary information for registration. The customer accounts are not public and cannot be indexed by search engines. During registration and subsequent logins and usage of the customer account, we store the customers' IP addresses along with the access times in order to prove registration and prevent any misuse of the customer account. Once the customer account is terminated, the data of the customer account will be deleted after the termination date, unless it is retained for purposes other than providing the customer account or needs to be retained for legal reasons (e.g., internal storage of customer data, order processes, or invoices). It is the responsibility of the customers to back up their data when terminating the customer account. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- Shop and E-Commerce: We process the data of our customers in order to enable them to select, purchase, or order the chosen products, goods, and associated services, as well as to facilitate their payment and delivery or execution. If necessary for the execution of an order, we use service providers, especially postal, freight, and shipping companies, to carry out the delivery or execution for our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is marked as such within the order or similar acquisition process and includes the details needed for delivery, provision, and invoicing, as well as contact information to enable any necessary follow-up communication. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- Artistic and literary achievements: We process the data of our clients in order to enable them to select, purchase, or commission the chosen services or works, as well as associated activities, and to facilitate their payment, delivery, execution, or provision.
The required information is marked as such within the scope of the order, purchase, or comparable contract conclusion and includes the information necessary for delivery and billing, as well as contact details to enable any necessary follow-up communication. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
Use of Online Platforms for Offering and Sales Purposes
We offer our services on online platforms operated by other service providers. In this context, in addition to our privacy policy, the privacy policies of the respective platforms apply. This is especially true regarding the payment process and the procedures used on the platforms for reach measurement and interest-based marketing.
- Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email, phone numbers); contract data (e.g., subject of contract, duration, customer category); usage data (e.g., visited websites, interest in content, access times); meta-, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Customers
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations. Marketing.
- Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
Providers and Services Used in the Course of Business Operations
As part of our business activities, we use additional services, platforms, interfaces, or plugins from third-party providers (referred to as "services"), in compliance with legal requirements. The use of these services is based on our interest in a proper, lawful, and functional presentation of our offerings.
- Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email, phone numbers); content data (e.g., inputs in online forms); contract data (e.g., subject of the contract, duration, customer category).
- Affected persons: Customers; interested parties; users (e.g., website visitors, users of our services). Business and contractual partners.
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations. Office and organizational procedures.
- Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Payment procedure
In the context of contractual and other legal relationships, due to legal obligations, or otherwise based on our legitimate interests, we provide the affected individuals with efficient and secure payment options and involve other service providers (collectively referred to as "Payment Service Providers") in addition to banks and credit institutions.
The data processed by the payment service providers include inventory data such as name and address, banking data such as account numbers or credit card numbers, passwords, TANs, and checksums, as well as contract, amount, and recipient-related information. This information is necessary to complete the transactions. However, the entered data is only processed and stored by the payment service providers. This means that we do not receive account or credit card-related information, but only information confirming or rejecting the payment. In some cases, the data may be transmitted by the payment service providers to credit reporting agencies. This transmission aims to perform identity and credit checks. For this, we refer to the terms and conditions and privacy notices of the payment service providers.
The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions, which can be accessed within the respective websites or transaction applications. We also refer to these for further information and for the exercise of rights such as withdrawal, access, and other rights of the data subjects.
- Types of data processed: Personal data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. contract subject, duration, customer category); usage data (e.g. visited websites, interest in content, access times); metadata, communication, and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status).
- Affected persons: Customers. interested parties.
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations.
- Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
Further information on processing procedures, methods and services:
- Mastercard: Payment services (technical connection of online payment methods); Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgien; Applicable Legal Bases Contractual performance and pre-contractual inquiries (Article 6 (1) (b) GDPR); Website: https://www.mastercard.de/de-de.html. Data Protection Declaration https://www.mastercard.de/de-de/datenschutz.html.
- PayPal: Payment services (technical connection of online payment methods) (e.g. PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Applicable Legal Bases Contractual performance and pre-contractual inquiries (Article 6 (1) (b) GDPR); Website: https://www.paypal.com/de. Data Protection Declaration https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
- Visa: Payment services (technical connection of online payment methods); Service provider: Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, UK; Applicable Legal Bases Contractual performance and pre-contractual inquiries (Article 6 (1) (b) GDPR); Website: https://www.visa.de. Data Protection Declaration https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.
Provision of the Online Offer and Web Hosting
We process the users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to deliver the content and functions of our online services to the users' browser or device.
- Types of data processed: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); content data (e.g., entries in online forms).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of our online services and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices such as computers, servers, etc.); security measures.
- Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Further information on processing procedures, methods and services:
- Provision of online services on rented storage space: For the provision of our online services, we use storage space, computing power, and software that we rent or otherwise obtain from a corresponding server provider (also referred to as "web host"). Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
- Collection of access data and log files: Access to our online services is logged in the form of so-called "server logfiles." These server logfiles may include the address and name of the retrieved web pages and files, the date and time of the retrieval, the amount of data transmitted, messages about successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), and typically IP addresses and the requesting provider. The server logfiles can be used for security purposes, for example, to prevent server overload (especially in the case of abusive attacks, such as DDoS attacks), and to ensure the load and stability of the servers. Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR). Deletion of data: Logfile information is stored for a maximum period of 30 days and is then deleted or anonymized. Data that is required to be retained for evidentiary purposes is exempt from deletion until the final resolution of the respective incident.
- Email sending and hosting: The web hosting services we use also include the sending, receiving, and storage of emails. For these purposes, the addresses of the recipients and senders, as well as other information related to the email transmission (e.g., the involved providers), and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of spam detection. Please note that emails are generally not transmitted in an encrypted form over the internet. While emails are typically encrypted during transit, they are not encrypted on the servers from which they are sent and received (unless end-to-end encryption is used). Therefore, we cannot take responsibility for the transmission path of emails between the sender and the recipient on our server. Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
- Content-Delivery-Network: We use a "Content Delivery Network" (CDN). A CDN is a service that helps deliver content from an online offering, particularly large media files such as graphics or program scripts, more quickly and securely by using regionally distributed and internet-connected servers. Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
- Instart: Content Delivery Network (CDN) – A service that helps deliver content from an online offering, particularly large media files such as graphics or program scripts, more quickly and securely by using regionally distributed and internet-connected servers. Service provider: Instart Logic, Inc., 450 Lambert Avenue, Palo Alto, CA 94306, USA; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://www.instart.com. Data Protection Declaration https://www.instart.com/company/legal/privacy-policy.
Registration, login and user account
Users can create a user account. As part of the registration process, users will be informed of the required mandatory fields, and their data will be processed for the purpose of providing the user account based on contractual obligation. The processed data includes, in particular, login information (username, password, and an email address).
As part of using our registration and login functions, as well as utilizing the user account, we store the IP address and the time of each user action. The storage is based on our legitimate interests, as well as the users' interest in protection from abuse and unauthorized use. These data will generally not be shared with third parties unless necessary for the enforcement of our claims or if there is a legal obligation to do so.
Users may be informed by email about events relevant to their user account, such as technical changes.
- Types of data processed: Inventory data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; management and response to inquiries. Provision of our online services and user-friendliness.
- Applicable Legal Bases Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).
Further information on processing procedures, methods and services:
- Registration with pseudonyms: Users may use pseudonyms as user names instead of real names; Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- User profiles are not public: User profiles are not publicly visible or accessible.
- Deletion of data after termination: If users have terminated their user account, their data related to the account will be deleted, provided there is no legal permission, obligation, or user consent to retain it. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- No obligation to retain data: It is the user's responsibility to back up their data before the end of the contract after termination. We are entitled to irreversibly delete all data stored by the user during the contract period. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
Community features
The community features we provide allow users to engage in conversations or otherwise interact with each other. Please note that the use of these community features is only permitted in compliance with applicable laws, our terms and guidelines, as well as the rights of other users and third parties.
- Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations. Security measures.
- Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
Further information on processing procedures, methods and services:
- User contributions are public: The contributions and content created by users are publicly visible and accessible; Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- Storage of data for security purposes: The posts and other inputs of users are processed for the purposes of community and conversation features and, unless required or permitted by law, are not shared with third parties. An obligation to disclose may arise, in particular, in the case of unlawful content for the purpose of legal prosecution. We would like to point out that, in addition to the content of the posts, the time of submission and the users’ IP addresses are also stored. This is done in order to take appropriate measures to protect other users and the community. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- Right to delete content and information: The deletion of users’ posts, content, or information is permissible to the necessary extent after appropriate consideration, provided there are concrete indications that they violate legal regulations, our policies, or the rights of third parties. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- Limited deletion of conversation contributions: Out of consideration for other users, a user's conversation contributions remain stored even after account termination and deletion, so that conversations, comments, advice, or other communication between users do not lose their meaning or become distorted. Usernames are deleted or pseudonymized unless they were already pseudonyms. Users may request the complete deletion of their conversation contributions from us at any time. Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
- Protection of your own data: Users decide for themselves which data they disclose about themselves within our online offering—for example, when they provide personal information or participate in conversations. We ask users to protect their data and to share personal information thoughtfully and only to the extent necessary. In particular, users are asked to take special care in protecting their login credentials and to use secure passwords (i.e., preferably long and random combinations of characters). Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
Blogs and publication media
We use blogs or similar means of online communication and publication (hereinafter referred to as "publication medium"). The data of the readers are processed for the purposes of the publication medium only to the extent necessary for its presentation, communication between authors and readers, or for security reasons. Otherwise, we refer to the information regarding the processing of visitors to our publication medium as part of this privacy notice.
- Types of data processed: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; feedback (e.g., collecting feedback via online forms); provision of our online services and user-friendliness; security measures; management and response to inquiries.
- Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Further information on processing procedures, methods and services:
- Comments and contributions: If users leave comments or other contributions, their IP addresses may be stored based on our legitimate interests. This is done for our security, in case someone posts unlawful content in comments and contributions (insults, prohibited political propaganda, etc.). In this case, we may be held responsible for the comment or contribution, and therefore, we are interested in the identity of the author.
Furthermore, we reserve the right to process users' data for spam detection based on our legitimate interests.
On the same legal basis, we reserve the right to store users' IP addresses for the duration of surveys and use cookies to prevent multiple voting.
The information provided in the course of comments and posts, such as personal details, contact information, website information, and content, will be stored by us permanently until the user objects. Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR). - Accessing WordPress emojis and smileys: Retrieval of WordPress emojis and smilies – Within our WordPress blog, graphical emojis (i.e., small graphic files that express emotions) are used for the efficient integration of content elements, retrieved from external servers. The providers of the servers collect the users' IP addresses. This is necessary in order to transmit the emoji files to the users' browsers. Service provider: Aut O’Mattic A8C Irland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://automattic.com; Data Protection Declaration https://automattic.com/privacy. Basis for third country transfer: EU-US Data Privacy Framework (DPF).
- Akismet anti-spam check: und die Zeit des Eintrags.
ChatGPT said:Akismet Anti-Spam Check – We use the service "Akismet" based on our legitimate interests. With the help of Akismet, comments from real people are distinguished from spam comments. For this purpose, all comment data is sent to a server in the USA, where it is analyzed and stored for comparison purposes for four days. If a comment is classified as spam, the data will be stored beyond this period. This data includes the entered name, email address, IP address, comment content, referrer, information about the browser used, computer system details, and the time of the submission.
Users are welcome to use pseudonyms or refrain from entering their name or email address. They can completely prevent the transmission of data by not using our commenting system. While this would be unfortunate, we unfortunately do not see any alternatives that would work as effectively. Service provider: Aut O’Mattic A8C Irland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://automattic.com; Data Protection Declaration https://automattic.com/privacy. Basis for third country transfer: EU-US Data Privacy Framework (DPF). - Gravatar profile pictures: Profile pictures – We use the Gravatar service within our online offering and in particular in the blog.
Gravatar is a service where users can register and upload profile pictures along with their email addresses. When users leave posts or comments on other online platforms (especially blogs) using the respective email address, their profile pictures may be displayed next to the posts or comments. To achieve this, the email address provided by the users is transmitted encrypted to Gravatar for verification, to check whether a profile is associated with it. This is the only purpose of transmitting the email address. It is not used for any other purposes and is deleted afterwards.
The use of Gravatar is based on our legitimate interests, as we use Gravatar to offer post and comment authors the opportunity to personalize their contributions with a profile picture.
By displaying the images, Gravatar collects the users' IP addresses, as this is necessary for communication between a browser and an online service.
If users do not want a profile picture associated with their email address on Gravatar to appear in comments, they should use an email address that is not linked to Gravatar when commenting. We also point out that it is possible to use an anonymous or no email address at all if users do not want their email address to be sent to Gravatar. Users can completely prevent the transmission of data by not using our commenting system. Service provider: Aut O’Mattic A8C Irland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://automattic.com; Data Protection Declaration https://automattic.com/privacy. Basis for third country transfer: EU-US Data Privacy Framework (DPF).
Push notifications
With the users' consent, we can send users so-called "push notifications." These are messages that are displayed on the users' screens, devices, or in browsers, even when our online service is not actively being used.
To subscribe to push notifications, users must confirm their browser or device's request to receive push notifications. This consent process is documented and stored. The storage is necessary to recognize whether users have consented to receiving push notifications and to be able to prove their consent. For these purposes, a pseudonymous identifier of the browser (so-called "push token") or the device ID of the user's device is stored.
Push notifications may be required for the fulfillment of contractual obligations (e.g., technical and organizational information relevant to the use of our online services) and, on the other hand, may be purely informational in nature.
- Types of data processed: Usage data (e.g., visited websites, interest in content), meta-, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers).
- Affected persons: Communication partner.
- Purposes of processing: Provision of our online services and user-friendliness.
- Applicable Legal Bases Consent (Art. 6 (1) (a) GDPR). Contractual fulfillment and pre-contractual inquiries (Art. 6 (1) (b) GDPR).
Newsletters and electronic notifications
We send newsletters, emails, and other electronic notifications (hereinafter referred to as "newsletters") only with the consent of the recipients or based on a legal authorization. If the content of the newsletter is specifically described during the registration, this description is decisive for the consent of the users. Otherwise, our newsletters contain information about our services and us.
To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personalized addressing in the newsletter or additional information if required for the purposes of the newsletter.
Double-Opt-In-Verfahren: The subscription to our newsletter is carried out using a so-called double-opt-in procedure. This means that after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can subscribe with someone else's email address. The newsletter subscriptions are logged to be able to verify the registration process according to legal requirements. This includes storing the time of registration and confirmation, as well as the IP address. Any changes to the data stored with the mailing service provider are also logged.
Deletion and restriction of processing: We may store the unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of possible defense against claims. An individual deletion request can be made at any time, provided that the former existence of consent is also confirmed. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blacklist.
The logging of the registration process is carried out based on our legitimate interests for the purpose of proving its proper execution. If we commission a service provider for email dispatch, this is done based on our legitimate interests in an efficient and secure delivery system.
Contents:
Information about us, our services, promotions and offers.
- Types of data processed: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); usage data (e.g., visited websites, interest in content, access times).
- Affected persons: Communication partner.
- Purposes of processing: Direct marketing (e.g. by email or post).
- Applicable Legal Bases Consent (Article 6 (1) (a) GDPR).
- Right to object (Opt-Out): You can unsubscribe from our newsletter at any time, i.e., revoke your consent or object to further receipt. A link to unsubscribe from the newsletter can be found at the end of each newsletter, or you can use one of the contact options provided above, preferably by email, to do so.
Further information on processing procedures, methods and services:
- Measuring open and click rates: The newsletters contain a so-called "web beacon," i.e., a pixel-sized file that is retrieved from our server or, if we use a mailing service provider, from their server when the newsletter is opened. As part of this retrieval, technical information such as information about your browser and system, as well as your IP address and the time of retrieval, is collected.
This information is used to technically improve our newsletter based on the technical data or the audience and their reading behavior, determined by their retrieval locations (which can be identified using the IP address) or access times. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. This information is assigned to individual newsletter recipients and stored in their profiles until deletion. The evaluations help us identify the reading habits of our users and adjust our content accordingly, or send different content based on the interests of our users. Applicable Legal Bases Consent (Article 6 (1) (a) GDPR).
Advertising communication via email, post, fax or telephone
We process personal data for the purposes of advertising communication, which can be carried out via various channels, such as email, telephone, mail or fax, in accordance with legal requirements.
Recipients have the right to withdraw consent at any time or to object to promotional communications at any time.
After a withdrawal of consent or an objection, we retain the data required to prove prior authorization for contacting or sending communications for up to three years after the end of the year in which the withdrawal or objection occurred, based on our legitimate interests. The processing of this data is limited to the purpose of a possible defense against claims. Additionally, based on our legitimate interest in permanently respecting the withdrawal or objection, we store the data necessary to prevent further contact (e.g., depending on the communication channel, the email address, phone number, or name).
- Types of data processed: Inventory data (e.g. names, addresses); contact data (e.g. email, telephone numbers).
- Affected persons: Communication partner.
- Purposes of processing: Direct marketing (e.g. by email or post).
- Applicable Legal Bases Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).
Sweepstakes and competitions
We process the personal data of participants in contests and sweepstakes in compliance with applicable data protection regulations, insofar as the processing is necessary for the provision, execution, and handling of the contest as contractually required, the participants have given their consent, or the processing serves our legitimate interests (e.g., ensuring the security of the contest or protecting our interests against abuse, such as by collecting IP addresses when contest entries are submitted).
If participant entries are published as part of the contest (e.g., as part of a vote, presentation of contest entries or winners, or coverage of the contest), we point out that the names of the participants may also be published in this context. Participants may object to this at any time.
If the contest takes place on an online platform or social network (e.g., Facebook or Instagram, hereinafter referred to as "online platform"), the terms of use and data protection policies of the respective platforms also apply. In such cases, we point out that we are responsible for the information provided by participants in the context of the contest, and any inquiries regarding the contest should be directed to us.
Participant data will be deleted once the contest or competition has ended and the data is no longer required to inform the winners or because no further inquiries regarding the contest are expected. As a rule, participant data will be deleted no later than 6 months after the end of the contest. Data of the winners may be retained for a longer period, for example, to respond to inquiries about the prizes or to fulfill the prize deliveries; in such cases, the retention period depends on the nature of the prize and may be up to three years for physical items or services, for example, in order to handle warranty claims. In addition, participant data may be stored for a longer period in the context of contest-related reporting in online and offline media.
If data is collected for other purposes in the context of the contest, its processing and retention period are governed by the data protection information provided for that specific use (e.g., in the case of a newsletter subscription as part of the contest).
- Types of data processed: Inventory data (e.g., names, addresses); content data (e.g., entries in online forms); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Sweepstakes and competition participants.
- Purposes of processing: Conducting prize draws and competitions.
- Applicable Legal Bases Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 letter b) GDPR)
Surveys and polls
We conduct surveys and questionnaires to collect information for the purpose communicated in each case. The surveys and questionnaires we conduct (hereinafter referred to as “surveys”) are evaluated anonymously. The processing of personal data only takes place to the extent necessary for the provision and technical implementation of the surveys (e.g., processing the IP address to display the survey in the user's browser or using a cookie to enable the survey to be resumed).
- Types of data processed: Contact data (e.g., email addresses, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Communication partners. Participants.
- Purposes of processing: Feedback (e.g. collecting feedback via online form).
- Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Web analysis, monitoring and optimization
Web analytics (also referred to as “audience measurement”) is used to evaluate the visitor traffic on our online offering and may include pseudonymous data about user behavior, interests, or demographic information such as age or gender. Audience measurement helps us identify, for example, when our online offering, its features, or content are most frequently used or likely to be revisited. It also allows us to determine which areas require optimization.
In addition to web analytics, we may also use testing procedures to, for example, test and optimize different versions of our online offering or its components.
Unless otherwise stated below, profiles may be created for these purposes – i.e. data combined into a usage process – and information may be stored in or read from a browser or device. The collected data may include, in particular, visited websites and elements used on them, as well as technical details such as the browser used, the operating system, and information about usage times. If users have consented to the collection of their location data by us or by providers of services we use, location data may also be processed.
Users’ IP addresses are also stored. However, we use an IP masking method (i.e. pseudonymization by shortening the IP address) to protect users. In general, no plain user data (such as email addresses or names) is stored during web analysis, A/B testing, or optimization processes. Instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of the users—only the information stored in their profiles for the respective purposes.
- Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Audience measurement (e.g. access statistics, identification of returning visitors); profiles with user-related information (creation of user profiles); tracking (e.g. interest-/behavior-based profiling, use of cookies). Provision of our online services and user-friendliness.
- Security Measures IP masking (pseudonymization of the IP address).
- Applicable Legal Bases Consent (Article 6 (1) (a) GDPR).
Further information on processing procedures, methods and services:
- Burst Statistics: Service Provider: Execution on servers and/or computers under its own data protection responsibility. Applicable Legal Bases Consent (Article 6 (1) (a) GDPR). Website: https://de.wordpress.org/plugins/burst-statistics/.
Onlinemarketing
We process personal data for the purposes of online marketing, which includes, in particular, the promotion of advertising space or the display of promotional and other content (collectively referred to as "content") based on users' potential interests, as well as the measurement of their effectiveness.
For these purposes, so-called user profiles are created and stored in a file (known as a "cookie") or similar technologies are used to store information relevant to the presentation of the aforementioned content. This information may include, for example, viewed content, visited websites, used online networks, communication partners, as well as technical details such as the browser used, the operating system, usage times, and utilized features. If users have consented to the collection of their location data, this data may also be processed.
For these purposes, so-called user profiles are created and stored in a file (known as a "cookie") or similar technologies are used to store information relevant to the presentation of the aforementioned content. This information may include, for example, viewed content, visited websites, used online networks, communication partners, as well as technical details such as the browser used, the operating system, usage times, and utilized features. If users have consented to the collection of their location data, this data may also be processed.
The information in the profiles is generally stored in cookies or by using similar technologies. These cookies can later also be read on other websites that use the same online marketing technology, analyzed for the purpose of content display, supplemented with additional data, and stored on the server of the online marketing technology provider.
In exceptional cases, personal data may be associated with the profiles. This can occur, for example, if users are members of a social network that we use for online marketing and the network links the users' profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, such as giving consent during the registration process.
As a rule, we only receive access to aggregated information regarding the success of our advertisements. However, within the scope of so-called conversion tracking, we can determine which of our online marketing methods have led to a conversion, e.g., the conclusion of a contract with us. Conversion tracking is used solely to analyze the effectiveness of our marketing efforts.
Unless otherwise specified, please assume that the cookies used will be stored for a period of two years.
- Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); tracking (e.g., interest-based/behavioral profiling, use of cookies); marketing. Profiles with user-related information (creating user profiles).
- Security Measures IP masking (pseudonymization of the IP address).
- Right to object (Opt-Out): We refer to the privacy notices of the respective providers and the opt-out options provided by the providers (so-called "Opt-Out"). If no explicit opt-out option is provided, you can also disable cookies in your browser settings. However, this may limit the functionality of our online offerings. Therefore, we additionally recommend the following opt-out options, which are summarized and directed towards the respective areas:
a) Europe: https://www.youronlinechoices.eu.
b) Canada: https://www.youradchoices.ca/choices.
c) USA: https://www.aboutads.info/choices.
d) Cross-regional: https://optout.aboutads.info.
Affiliate programs and affiliate links
In our online offering, we incorporate so-called affiliate links or other references (such as search forms, widgets, or discount codes) to the offers and services of third-party providers (collectively referred to as "affiliate links"). When users follow the affiliate links or subsequently take advantage of the offers, we may receive a commission or other benefits from these third-party providers (collectively referred to as "commission").
In order to track whether users have taken advantage of the offers from an affiliate link we use, it is necessary for the respective third-party providers to know that the users have followed an affiliate link included in our online offering. The attribution of affiliate links to the respective transactions or other actions (e.g., purchases) serves solely the purpose of commission billing and will be removed once it is no longer required for this purpose.
For the purposes of the aforementioned attribution of affiliate links, the affiliate links may be supplemented with certain values that are part of the link or may otherwise be stored, for example, in a cookie. These values may include, in particular, the referring website (referrer), the time, an online identifier of the website operator where the affiliate link was located, an online identifier of the respective offer, the type of link used, the type of offer, and an online identifier of the user.
Notes on legal basis: If we ask users for their consent to use third-party providers, the legal basis for processing data is consent. Otherwise, the users' data is processed based on our legitimate interests (i.e., interest in efficient, cost-effective, and user-friendly services). In this context, we also want to point out the information regarding the use of cookies in this privacy policy.
- Types of data processed: Contract data (e.g., subject of the contract, duration, customer category); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Affiliate tracking.
- Applicable Legal Bases Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).
Customer reviews and rating processes
We participate in review and rating procedures to evaluate, optimize, and promote our services. When users rate us or provide feedback via the respective review platforms or procedures, the terms and conditions and privacy policies of those providers also apply. In most cases, submitting a review requires registration with the respective provider.
To ensure that the individuals providing reviews have actually used our services, we transmit the necessary data regarding the customer and the service used to the respective review platform, with the customer's consent (including name, email address, and order number or item number). This data is used solely to verify the authenticity of the user.
- Types of data processed: Contract data (e.g., subject of the contract, duration, customer category); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Customers; users (e.g. website visitors, users of online services).
- Purposes of processing: Feedback (e.g., collecting feedback via online form). Marketing.
- Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Further information on processing procedures, methods and services:
- Rating widget: We integrate so-called "review widgets" into our online offering. A widget is a functional and content element embedded in our online services that displays dynamic information. It can appear in the form of a seal or a similar element, sometimes referred to as a "badge." While the content of the widget is displayed within our online offering, it is actually retrieved from the servers of the respective widget provider at that moment. This is the only way to ensure the display of up-to-date content—particularly the current rating.To enable this, a data connection must be established between the web page accessed within our online services and the server of the widget provider. The widget provider receives certain technical data (access data, including the IP address) necessary to deliver the widget content to the user's browser. Additionally, the widget provider receives information that users have visited our online offering. This information may be stored in a cookie and used by the widget provider to identify which online services participating in the review system have been visited by the user. Such information may be stored in a user profile and used for advertising or market research purposes. Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Presences in social networks (social media)
We maintain online presences within social networks and, in this context, process user data in order to communicate with users active on these platforms or to provide information about us.
We point out that user data may be processed outside the European Union. This may pose certain risks for users, for example, it could make it more difficult to enforce their rights.
Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on user behavior and resulting interests. These profiles can in turn be used to display advertisements—both within and outside of the networks—that are presumably aligned with users’ interests. For these purposes, cookies are typically stored on users’ devices, in which their usage behavior and interests are recorded. Additionally, data may also be stored in the usage profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in).
For a detailed overview of the respective forms of data processing and options for objection (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.
Also in the case of information requests and the exercise of data subject rights, we point out that these are most effectively addressed to the providers themselves. Only the providers have access to the users' data and can take appropriate action and provide information directly. However, if you still require assistance, you may contact us.
- Types of data processed: Contact data (e.g., email addresses, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Contact requests and communication; feedback (e.g., collecting feedback via online form). Marketing.
- Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Further information on processing procedures, methods and services:
- Instagram: Social Network; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://www.instagram.com. Data Protection Declaration https://instagram.com/about/legal/privacy.
- Facebook pages: Profiles within the social network Facebook; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://www.facebook.com; Data Protection Declaration https://www.facebook.com/about/privacy; Basis for third country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Further information: We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (so-called “Fanpage”). This data includes information about the types of content users view or interact with, or actions they take (see “Things you and others do and provide” in the Facebook Data Policy:). https://www.facebook.com/policy), as well as information about the devices used by the users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see “Device Information” in the Facebook Data Policy:). https://www.facebook.com/policy). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, so-called "Page Insights," to page owners, enabling them to gain insights into how people interact with their pages and related content. We have entered into a special agreement with Facebook ("Page Insights Information," https://www.facebook.com/legal/terms/page_controller_addendum). This agreement specifically outlines the security measures that Facebook must adhere to and in which Facebook has committed to fulfilling the rights of data subjects (i.e., users can, for example, directly submit requests for information or deletion to Facebook). The rights of users (particularly the rights to access, deletion, objection, and complaints to the relevant supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Page Insights Information" (https://www.facebook.com/legal/terms/information_about_page_insights_data). Joint responsibility is limited to the collection by and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which particularly includes the transmission of the data to the parent company, Meta Platforms, Inc., in the USA.
- Pinterest: Social Network; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://www.pinterest.com. Data Protection Declaration https://policy.pinterest.com/de/privacy-policy.
- TikTok: Social network / video platform; Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Irland und TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://www.tiktok.com. Data Protection Declaration https://www.tiktok.com/de/privacy-policy.
- X: Social Network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR). Data Protection Declaration https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
Plugins and embedded functions and content
We integrate functional and content elements into our online offering, which are retrieved from the servers of their respective providers (hereinafter referred to as "third parties"). These may include graphics, videos, or maps (hereinafter collectively referred to as "content").
The integration always requires that the third-party providers of these contents process the users' IP addresses, as they would not be able to send the content to their browsers without the IP address. The IP address is therefore necessary for the display of these contents or functions. We strive to only use content where the respective providers use the IP address solely for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information, such as visitor traffic on the pages of this website, can be evaluated. The pseudonymous information may also be stored in cookies on the users' devices and may include technical information about the browser and operating system, referring websites, visit time, as well as other details regarding the use of our online offering, and may be linked with information from other sources.
- Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of our online offering and user-friendliness; marketing. Profiles with user-related information (creation of user profiles).
- Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
Further information on processing procedures, methods and services:
- Integration of third-party software, scripts or frameworks (e.g. jQuery): We integrate software into our online services that we retrieve from the servers of other providers (e.g., function libraries that we use for displaying or enhancing the user-friendliness of our online services). In this process, the respective providers collect the users' IP addresses and may process them for the purpose of delivering the software to the users' browsers, as well as for security purposes, and for evaluating and optimizing their services. Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR).
- Pinterest plugins and content: Pinterest plugins and content – This can include, for example, content such as images, videos or texts and buttons that users can use to share content from this online offering within Pinterest; Service provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://www.pinterest.com. Data Protection Declaration https://policy.pinterest.com/de/privacy-policy.
- X-Plugins and Content: Plugins and buttons of the "X" platform – This may include content such as images, videos, or text, and buttons that allow users to share content from this online service within X. Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland; Applicable Legal Bases Legitimate interests (Article 6 (1) (f) GDPR); Website: https://twitter.com/de; Data Protection Declaration https://twitter.com/privacy, (Settings: https://twitter.com/personalization); Data processing agreement: https://privacy.twitter.com/en/for-our-partners/global-dpa. Basis for third country transfer: Standard Contractual Clauses (https://privacy.twitter.com/en/for-our-partners/global-dpa).
Management, organization and support tools
We use services, platforms, and software from other providers (hereinafter referred to as "third-party providers") for the purpose of organizing, managing, planning, and delivering our services. In selecting third-party providers and their services, we comply with legal requirements.
In this context, personal data may be processed and stored on the servers of third-party providers. This may include various types of data that we process in accordance with this privacy policy. Such data may particularly include personal details and contact information of users, data related to transactions, contracts, other processes, and their contents.
If users are referred to third-party providers or their software or platforms as part of communication, business, or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore encourage users to review the privacy notices of the respective third-party providers.
- Types of data processed: Content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Affected persons: Communication partners; users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations. Office and organizational procedures.
Changes and updates to the privacy policy
We kindly ask you to regularly review the content of our privacy policy. We update the privacy policy whenever changes in our data processing activities make this necessary. We will inform you if such changes require any action on your part (e.g., consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that these addresses may change over time. We therefore ask you to verify the information before making contact.
Definitions of terms
In this section, you will find an overview of the terms used in this privacy policy. Where terms are legally defined, their legal definitions apply. The following explanations are primarily intended to aid understanding.
- Affiliate tracking: As part of affiliate tracking, links are recorded that allow referring websites to direct users to websites with product or other offers. The operators of the referring websites may receive a commission if users follow these so-called affiliate links and subsequently take advantage of the offers (e.g., purchase goods or use services). For this purpose, it is necessary that providers can track whether users who are interested in certain offers subsequently access them as a result of the affiliate links. Therefore, for affiliate links to function properly, they must be supplemented with certain values that either become part of the link or are otherwise stored, for example, in a cookie. These values include, in particular, the referring website (referrer), the timestamp, an online identifier of the operator of the website on which the affiliate link was placed, an online identifier of the respective offer, an online identifier of the user, as well as tracking-specific values such as advertisement ID, partner ID, and categorizations.
- Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
- Profiles with user-related information: The processing of “profiles with user-related information,” or simply “profiles,” includes any type of automated processing of personal data that involves using such personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information concerning demographics, behavior, and interests, such as interaction with websites and their content, etc.). Cookies and web beacons are often used for the purposes of profiling.
- Reach measurement. Reach measurement (also referred to as web analytics) serves to evaluate visitor flows to an online offering and may include analyzing the behavior or interests of visitors in certain information, such as website content. With the help of reach analysis, operators of online offerings can, for example, determine at what time users visit their websites and which content they are interested in. This allows them to better tailor the content of their websites to the needs of their visitors. For the purpose of reach analysis, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus enable more accurate analysis of the use of an online offering.
- Tracking: "Tracking" refers to the ability to monitor user behavior across multiple online services. Typically, behavioral and interest-related information regarding the use of various online offerings is stored in cookies or on the servers of the providers of tracking technologies (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to match their interests.
- Controller: A “controller” is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
- Processing: “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, including the collection, analysis, storage, transmission, or deletion of data.
Erstellt mit kostenlosem Datenschutz-Generator.de von Dr. Thomas Schwenke