Privacy policy

Privacy Policy

Preamble

With the following privacy policy, we would like to inform you which types of your personal data (hereinafter also referred to as "data") we process, for which purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online services").

The terms used are not gender-specific.

Last updated: 30 January 2025

Controller

Super.Natural Europe GmbH
Elitz 6
88239 Wangen im Allgäu

Authorised representatives: Thomas Stumpp

Email address: shop@supernatural-merino.com

Legal notice: /Support/Impressum/

Representative in Switzerland

super.natural Europe AG
Birkenstrasse 11
6343 Rotkreuz
Switzerland

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

Master data.
Payment data.
Contact data.
Content data.
Contract data.
Usage data.
Meta, communication and process data.
Log data.
Creditworthiness data.

Purposes of processing

Provision of contractual services and fulfilment of contractual obligations.
Communication.
Security measures.
Direct marketing.
Reach measurement.
Tracking.
Office and organisational procedures.
Conversion measurement.
Target group formation.
Organisational and administrative procedures.
Conducting sweepstakes and contests.
Feedback.
Marketing.
Profiles with user-related information.
Provision of our online services and usability.
Assessment of creditworthiness and credit standing.
Information technology infrastructure.
Financial and payment management.
Public relations.
Sales promotion.
Business processes and business management procedures.

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

Consent (Art. 6 (1) (a) GDPR) - The data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes.
Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Legal obligation (Art. 6 (1) (c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Art. 6 (1) (f) GDPR) - processing is necessary for the purposes of the legitimate interests of the controller or of a third party, provided that the interests or fundamental rights and freedoms of the data subject which require protection of personal data do not override them.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against Misuse of Personal Data in Data Processing (German Federal Data Protection Act – BDSG). The BDSG contains, in particular, special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated individual decision-making, including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Relevant legal bases under the Swiss Federal Act on Data Protection: If you are located in Switzerland, we process your data on the basis of the Swiss Federal Act on Data Protection (in short, "FADP"). Unlike the GDPR, for example, the FADP does not, as a rule, require that a legal basis for the processing of personal data be stated; the processing of personal data must be carried out in good faith and must be lawful and proportionate (Art. 6 (1) and (2) FADP). In addition, we collect personal data only for a specific purpose that is recognisable to the data subject and process them only in a manner that is compatible with this purpose (Art. 6 (3) FADP).

Note on the applicability of the GDPR and the FADP: This privacy notice serves to provide information both under the FADP and under the General Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used owing to their broader territorial application and comprehensibility. In particular, instead of the terms used in the FADP, "Bearbeitung" (processing) of "Personendaten" (personal data), "overriding interest" and "particularly sensitive personal data", the terms used in the GDPR, "processing" of "personal data" as well as "legitimate interest" and "special categories of data", are used. However, within the scope of application of the FADP, the legal meaning of the terms continues to be determined in accordance with the FADP.

Security measures

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access to, input, transfer, securing of availability and separation of the data concerned. Furthermore, we have established procedures that ensure the exercise of data subjects' rights, the deletion of data and responses to threats to the data. In addition, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Securing online connections by means of TLS/SSL encryption technology (HTTPS): To protect users' data transmitted via our online services against unauthorised access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), thereby protecting the data against unauthorised access. TLS, as the further developed and more secure version of SSL, ensures that all data transmissions meet the highest security standards. If a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator for users that their data are being transmitted securely and in encrypted form.

Transmission of personal data

In the course of our processing of personal data, such data may be transmitted to, or disclosed to, other bodies, companies, legally independent organisational units or persons. Recipients of these data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we comply with the statutory requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data transmission within the organisation: We may transmit personal data to other departments or units within our organisation or grant them access to such data. Where the data are passed on for administrative purposes, this is based on our legitimate corporate and business interests or takes place where it is necessary to fulfil our contract-related obligations or where the data subjects have given consent or a legal permission exists.

International data transfers

Data processing in third countries: If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if the processing takes place in the context of using third-party services or of disclosing or transmitting data to other persons, bodies or companies, this is done only in accordance with the statutory requirements. If the level of data protection in the third country has been recognised by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers take place only if the level of data protection is ensured in another way, in particular by standard contractual clauses (Art. 46 (2) (c) GDPR), explicit consent or in the case of transmission required by contract or by law (Art. 49 (1) GDPR). In addition, we inform you of the bases for third-country transfers in connection with the individual providers from third countries, with adequacy decisions taking precedence as bases. Information on third-country transfers and existing adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de. Within the framework of the so-called "Data Privacy Framework" (DPF), the EU Commission has also recognised the level of data protection for certain companies from the USA as secure within the framework of the adequacy decision of 10.07.2023. The list of certified companies and further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). Within the scope of the privacy notices, we inform you which of the service providers we use are certified under the Data Privacy Framework.

Disclosure of personal data abroad: In accordance with the FADP, we disclose personal data abroad only if adequate protection of the data subjects is ensured (Art. 16 FADP). If the Federal Council has not determined that adequate protection exists (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we take alternative security measures. These may include international treaties, specific guarantees, data protection clauses in contracts, standard data protection clauses approved by the Federal Data Protection and Information Commissioner (FDPIC) or binding corporate rules recognised in advance by the FDPIC or by a competent data protection authority of another country. According to Art. 16 FADP, exceptions may be permitted for the disclosure of data abroad if certain conditions are met, including the consent of the data subject, the performance of a contract, public interest, the protection of life or physical integrity, data made public or data from a register provided for by law. These disclosures are always made in accordance with the statutory requirements. Within the framework of the so-called "Data Privacy Framework" (DPF), Switzerland has recognised the level of data protection for certain companies from the USA as secure within the framework of the adequacy decision of 07.06.2024. The list of certified companies and further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). Within the scope of the privacy notices, we inform you which of the service providers we use are certified under the Data Privacy Framework.

General information on data retention and deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or no further legal bases for the processing exist. This concerns cases in which the original purpose of processing no longer applies or the data are no longer required. Exceptions to this rule exist where statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for reasons of commercial or tax law, or whose storage is necessary for the pursuit of legal claims or for the protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where there are several statements on the retention period or deletion periods for an item of data, the longest period shall always prevail.

If a period does not expressly begin on a specific date and amounts to at least one year, it automatically starts at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the context of which data are stored, the event triggering the period is the time at which the termination notice or other ending of the legal relationship takes effect.

Data that are no longer retained for the originally intended purpose but on the basis of statutory requirements or for other reasons are processed by us exclusively for the reasons that justify their retention.

Further information on processing operations, procedures and services:

Retention and deletion of data: The following general periods apply to retention and archiving under German law:
- 10 years - Retention period for books and records, annual financial statements, inventories, management reports, the opening balance sheet and the working instructions and other organisational documents required to understand them (Section 147 (1) no. 1 in conjunction with (3) German Fiscal Code (AO), Section 14b (1) German Value Added Tax Act (UStG), Section 257 (1) no. 1 in conjunction with (4) German Commercial Code (HGB)).
- 8 years - Accounting vouchers, such as invoices and expense vouchers (Section 147 (1) nos. 4 and 4a in conjunction with (3) sentence 1 AO and Section 257 (1) no. 4 in conjunction with (4) HGB).
- 6 years - Other business documents: commercial or business letters received, copies of commercial or business letters sent, other documents insofar as they are relevant for taxation, e.g. hourly wage slips, operating cost accounting sheets, calculation documents, price labels, but also payroll documents, insofar as they are not already accounting vouchers, and till receipts (Section 147 (1) nos. 2, 3, 5 in conjunction with (3) AO, Section 257 (1) nos. 2 and 3 in conjunction with (4) HGB).
- 3 years - Data that are required to take into account potential warranty and damages claims or similar contractual claims and rights and to process related enquiries, based on previous business experience and customary industry practice, are stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 German Civil Code (BGB)).
Retention and deletion of data: The following general periods apply to retention and archiving under Swiss law:
- 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting vouchers and invoices as well as all required working instructions and other organisational documents (Art. 958f of the Swiss Code of Obligations (CO)).
- 10 years - Data that are necessary to take into account potential claims for damages or similar contractual claims and rights, and to process related enquiries, based on previous business experience and customary industry practice, are stored for the period of the statutory limitation period of ten years, unless a shorter period of five years applies, which is relevant in certain cases (Arts. 127, 130 CO). Claims for rent, lease and capital interest and other periodic payments, claims arising from the supply of food, for board and lodging and for innkeepers' debts, as well as claims arising from craftwork, the retail sale of goods, medical care, the professional work of lawyers, legal agents, procurators and notaries, and from the employment relationship of employees become time-barred on expiry of five years (Art. 128 CO).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Arts. 15 to 21 GDPR:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on those provisions. Where personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
Right of access: You have the right to request confirmation as to whether data concerning you are being processed and to obtain access to these data as well as further information and a copy of the data in accordance with the statutory requirements.
Right to rectification: In accordance with the statutory requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to erasure and restriction of processing: In accordance with the statutory requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the statutory requirements, to request restriction of the processing of the data.
Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, commonly used and machine-readable format in accordance with the statutory requirements, or to request their transmission to another controller.
Complaint to a supervisory authority: In accordance with the statutory requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State of your habitual residence, the supervisory authority of your place of work or of the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Rights of data subjects under the FADP:

As a data subject, you have the following rights in accordance with the provisions of the FADP:

Right of access: You have the right to request confirmation as to whether personal data concerning you are being processed, and to receive the information that is required for you to be able to assert your rights under this Act and to ensure transparent data processing.
Right to data delivery or transfer: You have the right to request the delivery of your personal data that you have disclosed to us in a commonly used electronic format.
Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
Right to object, erasure and destruction: You have the right to object to the processing of your data and to request that personal data concerning you be erased or destroyed.

Business services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as "contractual partners"), in the context of contractual and comparable legal relationships and associated measures and with regard to communication with the contractual partners (or pre-contractually), for example to answer enquiries.

We use these data to fulfil our contractual obligations. These include, in particular, the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we use the data to safeguard our rights and for the purposes of the administrative tasks associated with these obligations and of the organisation of our company. Furthermore, we process the data on the basis of our legitimate interests both in proper and economically sound business management and in security measures to protect our contractual partners and our business operations against misuse and endangerment of their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisers, payment service providers or tax authorities). Within the framework of applicable law, we disclose the data of contractual partners to third parties only to the extent that this is necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners are informed about further forms of processing, for example for marketing purposes, within the framework of this privacy policy.

We inform the contractual partners which data are required for the aforementioned purposes before or in the course of data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after four years, unless the data are stored in a customer account, e.g. for as long as they must be retained for statutory archiving reasons (for example, for tax purposes, as a rule ten years). We delete data disclosed to us by the contractual partner in the context of an order in accordance with the requirements and generally after the end of the order.

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or telephone numbers); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Service recipients and clients; Prospective customers. Business and contractual partners.
Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; Security measures; Communication; Office and organisational procedures; Organisational and administrative procedures. Business processes and business management procedures.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Legal obligation (Art. 6 (1) (c) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Online shop, order forms, e-commerce and delivery: We process our customers' data in order to enable them to select, acquire or order the chosen products, goods and associated services, as well as to pay for them and to have them delivered or performed. Where necessary for the execution of an order, we use service providers, in particular postal, freight forwarding and shipping companies, to carry out the delivery or performance for our customers. We use the services of banks and payment service providers to process payment transactions. The required details are marked as such in the course of the ordering or comparable purchasing process and include the details required for delivery or provision and invoicing, as well as contact information so that any necessary queries can be raised; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR).

Business processes and procedures

Personal data of service recipients and clients – including customers, clients or, in special cases, principals, patients or business partners as well as other third parties – are processed in the context of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting and project management.

The data collected serve to fulfil contractual obligations and to make operational processes efficient. This includes the processing of business transactions, the management of customer relationships, the optimisation of sales strategies and ensuring internal accounting and financial processes. In addition, the data support the safeguarding of the controller's rights and promote administrative tasks and the organisation of the company.

Personal data may be passed on to third parties if this is necessary to fulfil the stated purposes or legal obligations. The data are deleted after the expiry of statutory retention periods or when the purpose of the processing no longer applies. This also includes data that must be stored for longer on the basis of tax law and statutory documentation obligations.

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. textual or pictorial messages and posts and the information relating to them, such as details of authorship or time of creation); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and functions); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved); Log data (e.g. log files relating to logins or the retrieval of data or access times.). Creditworthiness data (e.g. credit score received, estimated probability of default, risk classification based thereon, historical payment behaviour).
Data subjects: Service recipients and clients; Prospective customers; Communication partners; Business and contractual partners; Customers; Third parties; Users (e.g. website visitors, users of online services). Employees (e.g. salaried employees, applicants, temporary staff and other staff).
Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; Office and organisational procedures; Business processes and business management procedures; Security measures; Provision of our online services and usability; Communication; Marketing; Sales promotion; Public relations; Assessment of creditworthiness and credit standing; Financial and payment management. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Legitimate interests (Art. 6 (1) (f) GDPR). Legal obligation (Art. 6 (1) (c) GDPR).

Further information on processing operations, procedures and services:

Customer management and customer relationship management (CRM): Procedures required in the context of customer management and customer relationship management (CRM) (e.g. customer acquisition in compliance with data protection requirements, measures to promote customer retention and loyalty, effective customer communication, complaint management and customer service with due regard to data protection, data management and analysis to support the customer relationship, administration of CRM systems, secure account management, customer segmentation and target group formation); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).
Contact management and contact maintenance: Procedures required in the context of organising, maintaining and securing contact information (e.g. setting up and maintaining a central contact database, regular updates of contact information, monitoring of data integrity, implementation of data protection measures, ensuring access controls, carrying out backups and restorations of contact data, training employees in the effective use of contact management software, regular review of communication history and adjustment of contact strategies); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).
Customer account: Customers can create an account within our online services (e.g. customer or user account, "customer account" for short). If the registration of a customer account is required, customers will be informed of this as well as of the details required for registration. The customer accounts are not public and cannot be indexed by search engines. In the course of registration and subsequent logins and use of the customer account, we store the customers' IP addresses together with the times of access in order to be able to prove the registration and to prevent any misuse of the customer account. If the customer account has been terminated, the data of the customer account are deleted after the time of termination, unless they are retained for purposes other than provision in the customer account or must be retained for legal reasons (e.g. internal storage of customer data, ordering processes or invoices). It is the customers' responsibility to back up their data upon termination of the customer account; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).
Saved list/ wish list: Customers can create a product list/wish list. In this case, the products are stored as part of the fulfilment of our contractual obligations until the account is deleted, unless the product list entries are removed by the customer or we expressly inform the customer of different storage periods; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR).
Customer loyalty programme/ customer card: As part of the customer loyalty programme, the controller processes the data of participating customers for the purpose of providing the services offered within the framework of this programme. For this purpose, the controller stores the information provided by the customers, insofar as necessary and marked as such, in a customer profile. Information on the use of the customer loyalty programme and on the use of the associated services and benefits is also processed within this profile. This information is passed on to third parties (e.g. executing service providers) only if this is necessary for the stated purposes. The customer profiles are deleted after participation in the programme ends. The respective data are archived only to the extent that this may be necessary for statutory retention purposes or for the fulfilment of statutory claims (up to eleven years for tax information from the end of the year in which it arose) or contractual claims (up to three years from the end of the year of termination). This is recorded in the record of processing activities; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR).
General payment transactions: Procedures required for carrying out payment transactions, monitoring bank accounts and controlling payment flows (e.g. preparing and checking transfers, processing direct debits, checking bank statements, monitoring incoming and outgoing payments, chargeback management, account reconciliation, cash management); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).
Accounting, accounts payable, accounts receivable: Procedures required for recording, processing and controlling business transactions in the area of accounts payable and accounts receivable (e.g. preparing and checking incoming and outgoing invoices, monitoring and managing open items, carrying out payment transactions, handling dunning, reconciling accounts in connection with receivables and payables, accounts payable and accounts receivable accounting); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR), Legal obligation (Art. 6 (1) (c) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).
Financial accounting and taxes: Procedures required for recording, managing and controlling finance-related business transactions and for calculating, reporting and paying taxes (e.g. account assignment and posting of business transactions, preparation of quarterly and annual financial statements, carrying out payment transactions, handling dunning, account reconciliation, tax advice, preparation and submission of tax returns, handling tax matters); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR), Legal obligation (Art. 6 (1) (c) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).
Marketing, advertising and sales promotion: Procedures required in the context of marketing, advertising and sales promotion (e.g. market analysis and target group definition, development of marketing strategies, planning and execution of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and participation in trade fairs, customer loyalty programmes, sales promotion measures, performance measurement and optimisation of marketing activities, budget management and cost control); Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).
Public relations: Procedures required in the context of public relations work and PR (e.g. development and implementation of communication strategies, planning and execution of PR campaigns, creation and distribution of press releases, maintenance of media contacts, monitoring and analysis of media response, organisation of press conferences and public events, crisis communication, creation of content for social media and corporate websites, management of corporate branding); Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Use of online platforms for offering and sales purposes

We offer our services on online platforms operated by other service providers. In this context, the privacy notices of the respective platforms apply in addition to our privacy notices. This applies in particular with regard to the execution of the payment process and the procedures used on the platforms for reach measurement and interest-based marketing.

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or telephone numbers); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Service recipients and clients; Business and contractual partners. Prospective customers.
Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; Marketing; Business processes and business management procedures; Conversion measurement (measuring the effectiveness of marketing measures). Provision of our online services and usability.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Amazon: Online marketplace for e-commerce; Service provider: Amazon EU S.à r.l. (Société à responsabilité limitée), 38 avenue John F. Kennedy, L-1855 Luxembourg; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.amazon.de/; Privacy policy: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Luxembourg).
avocadostore: Online marketplace for e-commerce; Service provider: Avocado Store GmbH, Cremon 32, 20457 Hamburg, Germany; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.avocadostore.de/; Privacy policy: https://www.avocadostore.de/privacy. Basis for third-country transfers: Switzerland - adequacy decision (Germany).
Shopware: Platform via which e-commerce services are offered and performed. The services and the processes performed in connection with them include, in particular, online shops, websites, their offers and content, community elements, purchase and payment processes, customer communication as well as analysis and marketing; Service provider: shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.shopware.com/de/; Privacy policy: https://www.shopware.com/de/datenschutz/. Basis for third-country transfers: Switzerland - adequacy decision (Germany).

Payment procedures

In the context of contractual and other legal relationships, on the basis of statutory obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, use other service providers in addition to banks and credit institutions (collectively "payment service providers").

The data processed by the payment service providers include master data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, amount- and recipient-related information. This information is required in order to carry out the transactions. However, the data entered are processed only by the payment service providers and are stored by them. That is, we do not receive any account- or credit-card-related information, but only information confirming or declining the payment. Under certain circumstances, the data are transmitted by the payment service providers to credit reference agencies. The purpose of this transmission is to verify identity and creditworthiness. In this regard, we refer to the general terms and conditions and the data protection notices of the payment service providers.

The payment transactions are subject to the terms and conditions and the data protection notices of the respective payment service providers, which can be accessed on the respective websites or transaction applications. We also refer to these for further information and for the assertion of rights of withdrawal, rights of access and other data subject rights.

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved). Contact data (e.g. postal and e-mail addresses or telephone numbers).
Data subjects: Service recipients and clients; Business and contractual partners. Prospective customers.
Purposes of processing: Provision of contractual services and fulfilment of contractual obligations. Business processes and business management procedures.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

American Express: Payment services (technical integration of online payment methods); Service provider: American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://www.americanexpress.com/de/; Privacy policy: https://www.americanexpress.com/de-de/firma/legal/datenschutz-center/online-datenschutzerklarung/. Basis for third-country transfers: Switzerland - adequacy decision (Germany).
Apple Pay: Payment services (technical integration of online payment methods); Service provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://www.apple.com/de/apple-pay/. Privacy policy: https://www.apple.com/legal/privacy/de-ww/.
Google Pay: Payment services (technical integration of online payment methods); Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://pay.google.com/intl/de_de/about/; Privacy policy: https://policies.google.com/privacy. Basis for third-country transfers: Switzerland - adequacy decision (Ireland).
Klarna: Payment services (technical integration of online payment methods); Service provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://www.klarna.com/de; Privacy policy: https://www.klarna.com/de/datenschutz. Basis for third-country transfers: Switzerland - adequacy decision (Sweden).
Mastercard: Payment services (technical integration of online payment methods); Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://www.mastercard.de/de-de.html; Privacy policy: https://www.mastercard.de/de-de/datenschutz.html. Basis for third-country transfers: Switzerland - adequacy decision (Belgium).
Mollie: Payment services (technical integration of online payment methods); Service provider: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://www.mollie.com/de; Privacy policy: https://www.mollie.com/de/privacy. Basis for third-country transfers: Switzerland - adequacy decision (Netherlands).
PayPal: Payment services (technical integration of online payment methods) (e.g. PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://www.paypal.com/de; Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full. Basis for third-country transfers: Switzerland - adequacy decision (Luxembourg).
Visa: Payment services (technical integration of online payment methods); Service provider: Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, GB; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR); Website: https://www.visa.de; Privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html. Basis for third-country transfers: EU/EEA - adequacy decision (GB), Switzerland - adequacy decision (GB).

Provision of the online services and web hosting

We process users' data in order to be able to provide our online services to them. For this purpose, we process the user's IP address, which is necessary in order to transmit the content and functions of our online services to the users' browser or end device.

Types of data processed: Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved); Log data (e.g. log files relating to logins or the retrieval of data or access times.). Content data (e.g. text or image messages and contributions, as well as information relating to them, such as details of authorship or time of creation).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Provision of our online services and usability; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also referred to as a "web host"); Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).
Collection of access data and log files: Access to our online services is logged in the form of so-called "server log files". The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volumes of data transferred, notification of successful access, browser type and version, the user's operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g. to avoid overloading the servers (in particular in the event of abusive attacks, so-called DDoS attacks), and, on the other hand, to ensure the utilisation and stability of the servers; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR). Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymised. Data whose further retention is required for evidentiary purposes are exempt from deletion until the respective incident has been finally clarified.
E-mail sending and hosting: The web hosting services we use also include the sending, receipt and storage of e-mails. For these purposes, the addresses of the recipients and senders, as well as further information relating to the sending of e-mails (e.g. the providers involved) and the contents of the respective e-mails, are processed. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that e-mails on the internet are generally not sent in encrypted form. As a rule, e-mails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and on which they are received. We therefore cannot accept any responsibility for the transmission path of e-mails between the sender and their receipt on our server; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).
Host Europe: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: Host Europe GmbH, Hansestrasse 111, 51149 Köln, Germany; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.hosteurope.de; Privacy policy: http://www.hosteurope.de/AGB/Datenschutzerklaerung/; Data processing agreement: https://www.hosteurope.de/Dokumente/. Basis for third-country transfers: Switzerland - adequacy decision (Germany).
Plesk: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: Plesk International GmbH, Vordergasse 59, 8200 Schaffhausen, Switzerland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.parallels.com/; Privacy policy: https://www.plesk.com/legal/#privacy-policy; Data processing agreement: Provided by the service provider. Basis for third-country transfers: EU/EEA - adequacy decision (Switzerland).
gstatic.com: Content delivery network (CDN) - a service with the help of which the content of online services, in particular large media files such as graphics or program scripts, can be delivered faster and more securely by means of regionally distributed servers connected via the internet; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.google.de/; Privacy policy: https://policies.google.com/privacy. Basis for third-country transfers: Switzerland - adequacy decision (Ireland).
Microsoft Azure: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://azure.microsoft.com; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement; Data processing agreement: https://azure.microsoft.com/de-de/support/legal/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland).

Use of cookies

The term “cookies” refers to functions that store information on users' end devices and read information from them. Cookies may also be used for various purposes, for example for the functionality, security and convenience of online services and for the analysis of visitor flows. We use cookies in accordance with the statutory provisions. To this end, we obtain users' prior consent where necessary. Where consent is not required, we rely on our legitimate interests. This applies where the storing and reading of information is essential in order to be able to provide expressly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online services. Consent can be withdrawn at any time. We provide clear information about its scope and about which cookies are used.

Information on the legal bases under data protection law: Whether we process personal data with the help of cookies depends on consent. Where consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage period: With regard to the storage period, a distinction is made between the following types of cookies:

Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).
Permanent cookies: Permanent cookies remain stored even after the end device has been closed. For example, the login status can be saved and preferred content displayed directly when the user visits a website again. Likewise, the user data collected with the help of cookies may be used for reach measurement. Unless we provide users with explicit information on the type and storage period of cookies (e.g. when obtaining consent), users should assume that these cookies are permanent and that the storage period may be up to two years.

General information on withdrawal and objection (opt-out): Users can withdraw the consents they have given at any time and can also object to the processing in accordance with the statutory requirements, including by means of the privacy settings of their browser.

Types of data processed: Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g. website visitors, users of online services).
Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR). Consent (Art. 6 (1) (a) GDPR).

Further information on processing operations, procedures and services:

Processing of cookie data on the basis of consent: We use a consent management solution through which users' consent to the use of cookies, or to the procedures and providers named within the consent management solution, is obtained. This procedure serves to obtain, log, manage and withdraw consents, in particular with regard to the use of cookies and comparable technologies that are used to store, read and process information on users' end devices. As part of this procedure, users' consents to the use of cookies and to the associated processing of information, including the specific processing operations and providers named in the consent management procedure, are obtained. Users also have the option of managing and withdrawing their consents. The declarations of consent are stored in order to avoid having to ask again and to be able to provide proof of consent in accordance with the statutory requirements. Storage takes place on the server side and/or in a cookie (a so-called opt-in cookie) or by means of comparable technologies, in order to be able to assign the consent to a specific user or their device. Unless specific information on the providers of consent management services is available, the following general information applies: consent is stored for up to two years. In this process, a pseudonymous user identifier is created, which is stored together with the time of consent, information on the scope of consent (e.g. the relevant categories of cookies and/or service providers) and information about the browser, the system and the end device used; Legal bases: Consent (Art. 6 (1) (a) GDPR).
Cookiefirst: Consent management: procedure for obtaining, logging, managing and withdrawing consents, in particular for the use of cookies and similar technologies for storing, reading and processing information on users' end devices, and for their processing; Service provider: Digital Data Solutions B.V., Plantage Middenlaan 42a, 1018 DH Amsterdam, Netherlands; Website: https://cookiefirst.com/de/; Privacy policy: https://cookiefirst.com/legal/privacy-policy/; Basis for third-country transfers: Switzerland - adequacy decision (Netherlands); Further information: Data stored (on the service provider's server): the user's IP number, the date and time of consent, browser information, the URL from which the consent was sent, an anonymous, random and encrypted key value; the user's consent status.

Registration, login and user account

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of the fulfilment of contractual obligations. The data processed include, in particular, the login information (user name, password and an e-mail address).

When our registration and login functions are used and when the user account is used, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests as well as those of users in protection against misuse and other unauthorised use. As a rule, these data are not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by e-mail about events that are relevant to their user account, such as technical changes.

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and e-mail addresses or telephone numbers); Content data (e.g. text or image messages and contributions, as well as information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions). Log data (e.g. log files relating to logins or the retrieval of data or access times.).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; Security measures; Organisational and administrative procedures. Provision of our online services and usability.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Deletion after termination.
Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

User profiles are not public: Users' profiles are not publicly visible or accessible.
Deletion of data after termination: If users have terminated their user account, their data relating to the user account will be deleted, subject to any statutory permission, obligation or consent of the users; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR).
No obligation to retain data: It is the users' responsibility to back up their data before the end of the contract if they have terminated it. We are entitled to irretrievably delete all of the user's data stored during the term of the contract; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR).

Contact and enquiry management

When we are contacted (e.g. by post, contact form, e-mail, telephone or via social media) and in the context of existing user and business relationships, the information provided by the enquiring persons is processed insofar as this is necessary to respond to the contact enquiries and any measures requested.

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and e-mail addresses or telephone numbers); Content data (e.g. text or image messages and contributions, as well as information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Communication partners.
Purposes of processing: Communication; Organisational and administrative procedures; Feedback (e.g. collecting feedback via an online form). Provision of our online services and usability.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR). Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR).

Further information on processing operations, procedures and services:

Contact form: When contact is made via our contact form, by e-mail or via other communication channels, we process the personal data transmitted to us in order to respond to and deal with the respective matter. This usually includes information such as name, contact information and, where applicable, further information that is communicated to us and is necessary for appropriate processing. We use these data exclusively for the stated purpose of making contact and communication; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR).

Cloud services

We use software services that are accessible via the internet and run on the servers of their providers (so-called "cloud services", also referred to as "software as a service") for the storage and management of content (e.g. document storage and management, exchange of documents, content and information with certain recipients or publication of content and information).

In this context, personal data may be processed and stored on the providers' servers insofar as they form part of communication processes with us or are otherwise processed by us as set out in this privacy policy. These data may include, in particular, users' master data and contact data, data on transactions, contracts and other processes, and their contents. The providers of the cloud services also process usage data and metadata, which they use for security purposes and for service optimisation.

Where we use the cloud services to provide forms or other documents and content for other users or publicly accessible websites, the providers may store cookies on users' devices for the purposes of web analysis or in order to remember users' settings (e.g. in the case of media control).

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and e-mail addresses or telephone numbers); Content data (e.g. text or image messages and contributions, as well as information relating to them, such as details of authorship or time of creation). Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions).
Data subjects: Prospective customers; Communication partners. Business and contractual partners.
Purposes of processing: Office and organisational procedures. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Microsoft cloud services: Cloud storage, cloud infrastructure services and cloud-based application software; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://microsoft.com/de-de; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement, Security information: https://www.microsoft.com/de-de/trustcenter; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland).

Newsletters and electronic notifications

We send newsletters, e-mails and other electronic notifications (hereinafter “newsletters”) exclusively with the consent of the recipients or on a statutory basis. Where the contents of the newsletter are specified in the course of subscribing to it, these contents are decisive for the users' consent. To subscribe to our newsletter, it is normally sufficient to provide your e-mail address. However, in order to be able to offer you a personalised service, we may ask you to provide your name so that we can address you personally in the newsletter, or to provide further information if this is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may store unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before we delete them, in order to be able to prove consent that was formerly given. The processing of these data is restricted to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the e-mail address solely for this purpose in a block list (a so-called “blocklist”).

The subscription procedure is logged on the basis of our legitimate interests for the purpose of proving that it was carried out properly. Where we commission a service provider to send e-mails, we do so on the basis of our legitimate interests in an efficient and secure dispatch system.

Contents:

Information about us, our services, promotions and offers.

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and e-mail addresses or telephone numbers); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved). Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions).
Data subjects: Communication partners. Users (e.g. website visitors, users of online services).
Purposes of processing: Direct marketing (e.g. by e-mail or post). Provision of contractual services and fulfilment of contractual obligations.
Legal bases: Consent (Art. 6 (1) (a) GDPR).
Opt-out option: You can cancel receipt of our newsletter at any time, i.e. withdraw your consents or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter, or you can otherwise use one of the contact options stated above, preferably e-mail, for this purpose.

Further information on processing operations, procedures and services:

Measurement of open and click rates: The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server or, if we use a dispatch service provider, from its server when the newsletter is opened. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected. This information is used for the technical improvement of our newsletter on the basis of the technical data or of the target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times. This analysis also includes determining whether and when the newsletters are opened and which links are clicked. The information is assigned to the individual newsletter recipients and stored in their profiles until deletion. The evaluations serve to identify the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of open and click rates, the storage of the measurement results in the users' profiles and their further processing take place on the basis of the users' consent. Unfortunately, it is not possible to withdraw consent to the performance measurement separately; in this case, the entire newsletter subscription must be cancelled or objected to. In that case, the stored profile information will be deleted; Legal bases: Consent (Art. 6 (1) (a) GDPR).
Prerequisite for the use of free services: Consent to the sending of mailings may be made a prerequisite for the use of free services (e.g. access to certain content or participation in certain promotions). If users wish to use the free service without subscribing to the newsletter, we ask you to contact us.
Reminder e-mails about the ordering process: If users do not complete an ordering process, we may remind them of the ordering process by e-mail and send them a link to continue it. This function may be useful, for example, if the purchase process could not be continued due to a browser crash, an oversight or forgetfulness. The e-mails are sent on the basis of consent, which users can withdraw at any time; Legal bases: Consent (Art. 6 (1) (a) GDPR).

Sweepstakes and contests

We process personal data of participants in sweepstakes and contests only in compliance with the relevant data protection provisions, insofar as the processing is contractually necessary for the provision, conduct and handling of the sweepstake, the participants have consented to the processing or the processing serves our legitimate interests (e.g. in the security of the sweepstake or the protection of our interests against misuse through the possible collection of IP addresses when sweepstake entries are submitted).

If participants' entries are published in the context of the sweepstakes (e.g. as part of a vote on or presentation of the sweepstake entries or of the winners, or of reporting on the sweepstake), we would like to point out that the names of the participants may also be published in this context. Participants may object to this at any time.

If the sweepstake takes place within an online platform or a social network (e.g. Facebook or Instagram, hereinafter referred to as "online platform"), the terms of use and data protection provisions of the respective platforms also apply. In these cases, we would like to point out that we are responsible for the information provided by the participants in the context of the sweepstake and that enquiries regarding the sweepstake are to be addressed to us.

Participants' data are deleted as soon as the sweepstake or contest has ended and the data are no longer required to inform the winners or because queries about the sweepstake are no longer to be expected. As a rule, participants' data are deleted no later than 6 months after the end of the sweepstake. Winners' data may be retained for longer, e.g. in order to be able to answer queries about the prizes or to fulfil the prize obligations; in this case, the retention period depends on the type of prize and is, e.g., up to three years for goods or services, e.g. in order to be able to process warranty claims. In addition, participants' data may be stored for longer, e.g. in the form of reporting on the sweepstake in online and offline media.

Where data were also collected for other purposes in the context of the sweepstake, their processing and the retention period are governed by the data protection information on that use (e.g. in the case of a subscription to the newsletter in the context of a sweepstake).

Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and e-mail addresses or telephone numbers). Content data (e.g. text or image messages and contributions, as well as information relating to them, such as details of authorship or time of creation).
Data subjects: Sweepstakes and contest participants.
Purposes of processing: Conducting sweepstakes and contests.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Web analysis, monitoring and optimisation

Web analysis (also referred to as "reach measurement") serves to evaluate the visitor flows of our online services and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognise at what times our online services or their functions or content are used most frequently, or invite reuse. Likewise, we are able to understand which areas require optimisation.

In addition to web analysis, we may also use testing procedures, for example to test and optimise different versions of our online services or their components.

Unless otherwise stated below, profiles, i.e. data combined for a usage session, may be created for these purposes and information may be stored in a browser or in a terminal device and then read out. The information collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to us or to the providers of the services we use collecting their location data, the processing of location data is also possible.

In addition, users' IP addresses are stored. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. In general, no plain data of users (such as e.g. e-mail addresses or names) are stored in the context of web analysis, A/B testing and optimisation; instead, pseudonyms are stored. This means that neither we nor the providers of the software used know the actual identity of users, but only the information stored in their profiles for the purposes of the respective procedures.

Information on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the data processing is consent. Otherwise, users' data are processed on the basis of our legitimate interests (i.e. interest in efficient, economic and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles). Provision of our online services and user-friendliness.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
Security measures: IP masking (pseudonymisation of the IP address).
Legal bases: Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Google Analytics: We use Google Analytics to measure and analyse the use of our online services on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or e-mail addresses. It serves to assign analysis information to a terminal device in order to recognise which content users have accessed within one or various usage sessions, which search terms they have used, whether they have accessed these again or have interacted with our online services. Likewise, the time of use and its duration are stored, as well as the sources of the users that refer to our online services and technical aspects of their terminal devices and browsers.
In the process, pseudonymous profiles of users are created with information from the use of various devices, whereby cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides coarse geographical location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, the IP address data are used exclusively for this derivation of geolocation data before being deleted immediately. They are not logged, are not accessible and are not used for any further purposes. When Google Analytics collects measurement data, all IP lookups are carried out on EU-based servers before the traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) (a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymisation of the IP address); Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland); Opt-out option: Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and of the data processed).
Google Tag Manager: We use Google Tag Manager, a piece of software from Google that enables us to manage so-called website tags centrally via a user interface. Tags are small code elements on our website that serve to record and analyse visitor activities. This technology helps us to improve our website and the content offered on it. Google Tag Manager itself does not create user profiles, does not store cookies with user profiles and does not carry out any independent analyses. Its function is limited to simplifying the integration and management of tools and services that we use on our website and making them more efficient. Nevertheless, when Google Tag Manager is used, users' IP address is transmitted to Google, which is necessary for technical reasons in order to implement the services we use. Cookies may also be set in the process. However, this data processing only takes place if services are integrated via the Tag Manager. For more detailed information on these services and their data processing, please refer to the further sections of this privacy policy; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) (a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Data processing agreement:
https://business.safety.google/adsprocessorterms. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland).
Google Tag Manager (server-side use): Google Tag Manager is an application with which we can manage so-called website tags via an interface and thus integrate other services into our online services (see also the further information in this privacy policy). The Tag Manager itself (which implements the tags) therefore stores neither user profiles nor cookies. The other services are integrated on the server side. This means that users' data are not transmitted directly from their terminal device to the respective service or to Google. In particular, users' IP address is not transmitted to the other service. Instead, the data are first transmitted to our server, where users' data records are assigned to our internal user identification number. The subsequent transmission of the data from our server to the servers of the respective service providers takes place only in this pseudonymised form. The user identification number does not contain any unique data, such as names or e-mail addresses; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) (a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland). Further information: https://business.safety.google/adsservices/ (types of processing and of the data processed).
plausible.io: Reach measurement and web analysis; no use of cookies or comparable persistent online identifiers; returning visitors are recognised with the help of a pseudonymous identifier that is deleted after one day; otherwise, no personal data are stored (https://plausible.io/data-policy); no data are passed on to third parties; processing takes place on the server of plausible.io on the basis of a data processing agreement;; Service provider: Plausible Insights OÜ, Västriku tn 2, 50403, Tartu, Estonia; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://plausible.io/; Privacy policy: https://plausible.io/privacy; Data processing agreement: https://plausible.io/dpa. Basis for third-country transfers: Switzerland - adequacy decision (Estonia).
Microsoft Clarity: Web analysis, reach measurement and analysis of user behaviour with regard to use and interests concerning functions and content and their duration of use on the basis of a pseudonymous user identification number and profiling; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: Consent (Art. 6 (1) (a) GDPR); Website: https://clarity.microsoft.com; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://privacy.microsoft.com/en-us/privacystatement), Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://privacy.microsoft.com/en-us/privacystatement).

Online marketing

We process personal data for the purposes of online marketing, which may include, in particular, the marketing of advertising space or the display of promotional and other content (collectively referred to as "content") based on the potential interests of users, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called "cookie"), or similar procedures are used, by means of which the information about the user that is relevant for the display of the aforementioned content is stored. This may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used and information on usage times and functions used. If users have consented to the collection of their location data, these may also be processed.

In addition, users' IP addresses are stored. However, we use available IP masking procedures (i.e. pseudonymisation by truncating the IP address) to protect users. In general, no plain data of users (such as e.g. e-mail addresses or names) are stored in the context of the online marketing procedure; instead, pseudonyms are stored. This means that neither we nor the providers of the online marketing procedures know the actual identity of users, but only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or by means of similar procedures. These cookies can later generally also be read on other websites that use the same online marketing procedure, analysed for the purpose of displaying content, supplemented with further data and stored on the server of the online marketing procedure provider.

Exceptionally, it is possible to assign plain data to the profiles, primarily when, for example, users are members of a social network whose online marketing procedures we use and the network links the user profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, for example by giving consent during registration.

As a rule, we only receive access to summarised information about the success of our advertisements. However, within the framework of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e. for example, to the conclusion of a contract with us. Conversion measurement is used solely to analyse the success of our marketing measures.

Unless otherwise stated, please assume that cookies used are stored for a period of two years.

Information on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the data processing is that permission. Otherwise, users' data are processed on the basis of our legitimate interests (i.e. interest in efficient, economic and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Information on withdrawal and objection:

We refer to the privacy notices of the respective providers and to the opt-out options stated for the providers (so-called "opt-out"). If no explicit opt-out option has been stated, you have, firstly, the option of disabling cookies in the settings of your browser. However, this may restrict functions of our online services. We therefore also recommend the following opt-out options, which are offered collectively for the respective regions:

a) Europe: https://www.youronlinechoices.eu.

b) Canada: https://www.youradchoices.ca/choices.

c) USA: https://www.aboutads.info/choices.

d) Cross-regional: https://optout.aboutads.info.

Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); tracking (e.g. interest/behaviour-based profiling, use of cookies); target group formation; marketing; profiles with user-related information (creation of user profiles); conversion measurement (measurement of the effectiveness of marketing measures). Provision of our online services and user-friendliness.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
Security measures: IP masking (pseudonymisation of the IP address).
Legal bases: Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Google Ad Manager: We use the "Google Ad Manager" service to place ads in the Google advertising network (e.g. in search results, in videos, on websites, etc.). Google Ad Manager is characterised by the fact that ads are displayed in real time based on the presumed interests of users. This allows us to display ads for our online services to users who might have a potential interest in our offering or who have previously shown an interest in it, as well as to measure the success of the ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/; Data processing terms for Google advertising products: Information on the services Data processing terms between controllers and standard contractual clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms. where Google acts as processor, data processing terms for Google advertising products and standard contractual clauses for third-country transfers of data: https://business.safety.google/adsprocessorterms.
Google Ads and conversion measurement: Online marketing procedure for the purpose of placing content and ads within the service provider's advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the ads. In addition, we measure the conversion of the ads, i.e. whether users have taken them as an occasion to interact with the ads and to make use of the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) (a) GDPR), Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and standard contractual clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.

Social media presences (social networks)

We maintain online presences within social networks and, in this context, process user data in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the area of the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users' rights.

Furthermore, the data of users within social networks are, as a rule, processed for market research and advertising purposes. For example, usage profiles can be created on the basis of usage behaviour and the resulting interests of users. These usage profiles may in turn be used, for instance, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For this reason, cookies are, as a rule, stored on the users' computers, in which the usage behaviour and the interests of the users are stored. In addition, data may also be stored in the usage profiles independently of the devices used by the users (in particular if they are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and of the opt-out options, we refer to the privacy policies and information provided by the operators of the respective networks.

Also in the case of access requests and the assertion of data subjects' rights, we would like to point out that these can be asserted most effectively with the providers. Only the latter have access to the users' data in each case and can take appropriate measures and provide information directly. Should you nevertheless require assistance, you can contact us.

Types of data processed: Contact data (e.g. postal and e-mail addresses or telephone numbers); content data (e.g. text or image messages and posts as well as the information relating to them, such as details of authorship or time of creation). Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Communication; feedback (e.g. collecting feedback via an online form). Public relations.
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Instagram: Social network that enables the sharing of photos and videos, commenting on and favouriting posts, sending messages, and subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland).
Facebook pages: Profiles within the social network Facebook - We are joint controllers, together with Meta Platforms Ireland Limited, for the collection (but not the further processing) of data of the visitors to our Facebook page (so-called "fan page"). These data include information on the types of content that users view or interact with, or the actions they take (see under "Things that you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/privacy/policy/), as well as information about the devices used by the users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see under "Device information" in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, so-called "Page Insights", to page operators so that they can obtain insights into how people interact with their pages and with the content associated with them. We have concluded a special agreement with Facebook ("Information about Page Insights", https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfil the rights of data subjects (i.e. users can, for example, send access or erasure requests directly to Facebook). The rights of the users (in particular to access, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information about Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data). The joint controllership is limited to the collection by, and the transmission of data to, Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland).
Pinterest: Social network that enables the sharing of photos, commenting on, favouriting and curating posts, sending messages, and subscribing to profiles; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.pinterest.com; Privacy policy: https://policy.pinterest.com/de/privacy-policy. Basis for third-country transfers: Switzerland - adequacy decision (Ireland).

Plug-ins and embedded functions and content

We integrate functional and content elements into our online services which are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may, for example, be graphics, videos or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the users, since without the IP address they would not be able to send the content to their browsers. The IP address is therefore required for the display of this content or these functions. We endeavour to use only such content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the users' devices and may contain, among other things, technical information about the browser and the operating system, referring websites, the time of the visit and other details on the use of our online services, and may also be linked to such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of the third-party providers, the legal basis for the processing of data is that permission. Otherwise, the users' data are processed on the basis of our legitimate interests (i.e. interest in efficient, economic and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g. page views and length of visit, click paths, intensity and frequency of use, types of device and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time details, identification numbers, persons involved).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Provision of our online services and user-friendliness; reach measurement (e.g. access statistics, recognition of returning visitors); tracking (e.g. interest-/behaviour-based profiling, use of cookies); target group formation; marketing; provision of contractual services and fulfilment of contractual obligations. Profiles with user-related information (creation of user profiles).
Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
Legal bases: Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing operations, procedures and services:

Google Fonts (obtained from the Google server): Obtaining fonts (and icons) for the purpose of a technically secure, maintenance-free and efficient use of fonts and icons with regard to their currency and loading times, their uniform display and the consideration of possible licensing restrictions. The IP address of the user is communicated to the provider of the fonts so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) are transmitted which are necessary for the provision of the fonts depending on the devices used and the technical environment. These data may be processed on a server of the font provider in the USA - When users visit our online services, their browsers send their browser HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving the fonts). The Google Fonts Web API provides the users with the Cascading Style Sheets (CSS) of Google Fonts and then with the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the internet, (2) the requested URL on the Google server and (3) the HTTP headers, including the user agent, which describes the browser and operating system versions of the website visitors, as well as the referrer URL (i.e. the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers and they are not analysed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent and referrer URL). Access to these data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. These data are logged so that Google can determine how often a particular font family is requested. With the Google Fonts Web API, the user agent is needed to adapt the font that is generated for the respective browser type. The user agent is logged primarily for debugging and is used to generate aggregated usage statistics with which the popularity of font families is measured. These aggregated usage statistics are published on the "Analytics" page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and an aggregated report on the top integrations based on the number of font requests can be generated. According to its own information, Google does not use any of the information collected by Google Fonts to create profiles of end users or to serve targeted advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland). Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
OpenStreetMap: We integrate the maps of the service "OpenStreetMap", which are offered by the OpenStreetMap Foundation (OSMF) on the basis of the Open Data Commons Open Database License (ODbL). The data of the users are used by OpenStreetMap exclusively for the purpose of displaying the map functions and for temporarily storing the selected settings. These data may include, in particular, IP addresses and location data of the users, which, however, are not collected without their consent (as a rule given in the settings of their devices or browsers); Service provider: OpenStreetMap Foundation (OSMF); Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.openstreetmap.de. Privacy policy: https://osmfoundation.org/wiki/Privacy_Policy.
Pinterest plugins and content: Pinterest plugins and content - This may include, for example, content such as images, videos or texts and buttons with which users can share content from these online services within Pinterest; Service provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.pinterest.com. Privacy policy: https://policy.pinterest.com/de/privacy-policy.
reCAPTCHA: We integrate the "reCAPTCHA" function in order to be able to recognise whether entries (e.g. in online forms) are made by humans and not by automatically operating machines (so-called "bots"). The data processed may include IP addresses, information on operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, time spent on websites, previously visited websites, interactions with ReCaptcha on other websites, possibly cookies, as well as the results of manual recognition processes (e.g. answering questions asked or selecting objects in images). The data processing is carried out on the basis of our legitimate interest in protecting our online services against abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR); Website: https://www.google.com/recaptcha/; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland). Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff.
YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) (a) GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland). Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff.

Changes and updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time, and please check the information before making contact.

Definitions of terms

This section provides you with an overview of the terms used in this privacy policy. Insofar as the terms are defined by law, their statutory definitions apply. The following explanations, on the other hand, are primarily intended to aid understanding.

Employees: Employees are persons who are in an employment relationship, whether as staff members, salaried employees or in similar positions. An employment relationship is a legal relationship between an employer and an employee which is established by an employment contract or an agreement. It includes the obligation of the employer to pay the employee remuneration while the employee performs his or her work. The employment relationship comprises various phases, including its establishment, in which the employment contract is concluded, its performance, in which the employee carries out his or her work activities, and its termination, when the employment relationship ends, whether by notice of termination, a termination agreement or otherwise. Employee data are all information that relates to these persons and is connected with their employment. This includes aspects such as personal identification data, identification numbers, salary and bank details, working hours, holiday entitlements, health data and performance appraisals.
Master data: Master data comprise essential information that is necessary for the identification and management of contractual partners, user accounts, profiles and similar assignments. These data may include, among other things, personal and demographic details such as names, contact information (addresses, telephone numbers, e-mail addresses), dates of birth and specific identifiers (user IDs). Master data form the basis for any formal interaction between persons and services, facilities or systems by enabling unambiguous assignment and communication.
Content data: Content data comprise information that is generated in the course of the creation, editing and publication of content of all kinds. This category of data may include texts, images, videos, audio files and other multimedia content published on various platforms and media. Content data are not limited to the actual content, but also include metadata that provide information about the content itself, such as tags, descriptions, author information and publication dates
Contact data: Contact data are essential information that enables communication with persons or organisations. They include, among other things, telephone numbers, postal addresses and e-mail addresses, as well as means of communication such as social media handles and instant messaging identifiers.
Conversion measurement: Conversion measurement (also referred to as "visit action evaluation") is a procedure by which the effectiveness of marketing measures can be determined. For this purpose, a cookie is usually stored on the users' devices within the websites on which the marketing measures take place and is then retrieved again on the target website. This enables us, for example, to track whether the advertisements we have placed on other websites were successful.
Meta, communication and process data: Meta, communication and process data are categories that contain information about the way in which data are processed, transmitted and managed. Metadata, also known as data about data, comprise information that describes the context, origin and structure of other data. They may include details of the file size, the creation date, the author of a document and change histories. Communication data capture the exchange of information between users via various channels, such as e-mail traffic, call logs, messages in social networks and chat histories, including the persons involved, timestamps and transmission paths. Process data describe the processes and procedures within systems or organisations, including workflow documentation, logs of transactions and activities, as well as audit logs used to track and review operations.
Usage data: Usage data refer to information that captures how users interact with digital products, services or platforms. These data cover a wide range of information that shows how users use applications, which functions they prefer, how long they stay on certain pages and which paths they take to navigate through an application. Usage data may also include the frequency of use, timestamps of activities, IP addresses, device information and location data. They are particularly valuable for analysing user behaviour, optimising user experiences, personalising content and improving products or services. Furthermore, usage data play a decisive role in identifying trends, preferences and possible problem areas within digital offerings
Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Profiles with user-related information: The processing of "profiles with user-related information", or "profiles" for short, includes any kind of automated processing of personal data that consists of the use of such personal data to analyse or evaluate certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behaviour and interests, such as the interaction with websites and their content, etc.), or to predict them (e.g. interests in certain content or products, click behaviour on a website or location). Cookies and web beacons are frequently used for profiling purposes.
Log data: Log data are information about events or activities that have been logged in a system or network. These data typically contain information such as timestamps, IP addresses, user actions, error messages and other details about the use or operation of a system. Log data are often used to analyse system problems, for security monitoring or to generate performance reports.
Reach measurement: Reach measurement (also referred to as web analytics) serves to evaluate the flows of visitors to an online service and may include the behaviour or interests of visitors in certain information, such as the content of websites. With the help of reach analysis, operators of online services can, for example, recognise at what time users visit their websites and what content they are interested in. This allows them, for example, to better adapt the content of their websites to the needs of their visitors. For reach analysis purposes, pseudonymous cookies and web beacons are frequently used in order to recognise returning visitors and thus obtain more precise analyses of the use of an online service.
Tracking: "Tracking" refers to cases where the behaviour of users can be traced across several online services. As a rule, behavioural and interest information relating to the online services used is stored in cookies or on servers of the providers of the tracking technologies (so-called profiling). This information can then be used, for example, to show the users advertisements that are likely to correspond to their interests.
Controller: "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing: "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data, be it collection, evaluation, storage, transmission or deletion.
Contract data: Contract data are specific information relating to the formalisation of an agreement between two or more parties. They document the terms under which services or products are provided, exchanged or sold. This category of data is essential for the management and performance of contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include the start and end dates of the contract, the type of services or products agreed, pricing agreements, payment terms, termination rights, renewal options and special conditions or clauses. They serve as the legal basis for the relationship between the parties and are crucial for clarifying rights and obligations, enforcing claims and resolving disputes.
Payment data: Payment data comprise all information required to process payment transactions between buyers and sellers. These data are of crucial importance for e-commerce, online banking and any other form of financial transaction. They include details such as credit card numbers, bank details, payment amounts, transaction data, verification numbers and invoice information. Payment data may also contain information about the payment status, chargebacks, authorisations and fees.
Target group formation: Target group formation (in English "Custom Audiences") refers to cases where target groups are determined for advertising purposes, e.g. the display of advertisements. For example, on the basis of a user's interest in certain products or topics on the internet, it can be inferred that this user is interested in advertisements for similar products or for the online shop in which he or she viewed the products. "Lookalike Audiences" (or similar target groups), in turn, refers to cases where the content deemed suitable is displayed to users whose profiles or interests presumably correspond to those of the users for whom the profiles were created. For the purpose of creating Custom Audiences and Lookalike Audiences, cookies and web beacons are, as a rule, used.

Privacy policy

Privacy Policy

Preamble

Table of contents

Controller

Representative in Switzerland

Overview of processing operations

Types of data processed

Categories of data subjects

Purposes of processing

Relevant legal bases

Security measures

Transmission of personal data

International data transfers

General information on data retention and deletion

Rights of Data Subjects

Business services

Business processes and procedures

Use of online platforms for offering and sales purposes

Payment procedures

Provision of the online services and web hosting

Use of cookies

Registration, login and user account

Contact and enquiry management

Cloud services

Newsletters and electronic notifications

Sweepstakes and contests

Web analysis, monitoring and optimisation

Online marketing

Social media presences (social networks)

Plug-ins and embedded functions and content

Changes and updates

Definitions of terms