Privacy policy

3.1 Scope of the processing of personal data

We only process our users’ personal data to the extent necessary to provide a functioning
website and our content and services. The processing
of our users’ personal data only takes place regularly with the user’s consent. An exception
applies in cases where prior consent cannot be obtained for factual reasons
and the processing of the data is permitted by law.

3.2 Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) as the legal basis. In the processing of personal data necessary for the performance of a contract to which the data subject is party, Art. 6 para. 1 lit. b GDPR as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures. Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR as the legal basis. If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR as the legal basis for processing.

3.3 Data erasure and storage duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

3.4 Validity

This privacy policy informs users about the type, scope and purpose of the collection and use of personal data by the responsible provider. The data is collected on our online platforms such as our website, blog, store and event pages.

4. provision of the website and creation of log files

4.1 Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:

• Information about the browser type and version used
• The user’s operating system
• The user’s internet service provider
• The IP address of the user
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites that are accessed by the user’s system via our website

4.2 Legal basis for data processing

The legal basis for the temporary storage of data is Art. 6 para. 1 lit. f GDPR.

4.3 Purpose of data processing

Storage in log files takes place to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.

4.4 Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

If the data is stored in log files, this is the case after six months at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated so that it is no longer possible to assign the calling client.

4.5 Possibility of objection and removal

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

5. use of cookies

5.1 Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the browser or by the browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change.

The following data is stored and transmitted in the cookies:

• Software operating data, e.g. language setting, time zone, etc.
• Articles in a shopping cart
• Login information

5.2 Legal basis for data processing

The legal basis for the processing of personal data using cookies is Art. 6 para. 1 lit. f GDPR.

5.3 Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. This requires the browser to be recognized even after a page change.

The user data collected by technically necessary cookies is not used to create user profiles.

5.4 Duration of storage, objection and removal options

Cookies are stored on the user’s computer and transmitted to our website. As a user, you therefore also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your browser. Cookies that have already been saved can be deleted at any time. This can also be automated. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

6th Newsletter

6.1 Description and scope of data processing

You can subscribe to a free newsletter on our website. When you register for the newsletter, the data from the input screen is transmitted to us.

If you purchase goods or services on our website and enter your e-mail address, we may subsequently use it to send you a newsletter. In such a case, only direct advertising for our own similar goods or services will be sent via the newsletter.

6.2 Legal basis for data processing

The legal basis for the processing of data after registration for the newsletter by the user is Art. 6 para. 1 lit. a GDPR.

Another legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 para. 3 UWG.

6.3 Purpose of data processing

The purpose of collecting the user’s e-mail address is to deliver the newsletter.

The collection of other personal data as part of the registration process serves to prevent misuse of the services or the e-mail address used.

6.4 Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. The user’s e-mail address is therefore stored for as long as the subscription to the newsletter is active.

The other personal data collected during the registration process is generally deleted after a period of six months.

6.5 Possibility of objection and removal

The subscription to the newsletter can be canceled by the user concerned at any time. For this purpose, you will find a corresponding link in every newsletter. This also makes it possible to withdraw consent to the storage of personal data collected during the registration process.

7th registration

7.1 Description and scope of data processing

On our website, we offer users the opportunity to register by providing personal data. The data from the input mask will be transmitted to us and stored. Only relevant data is collected, e.g. contact data (surname, first name, e-mail addresses, etc.) or content data.

The following data is also stored at the time of registration:

• The IP address of the user
• Date and time of registration

As part of the registration process, the user’s consent to the processing of this data is obtained.

7.2 Legal basis for data processing

If the registration serves the fulfillment of a contract to which the user is a party or the implementation of pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR. Otherwise, consent pursuant to Art. 6 para. 1 lit. a was obtained.

7.3 Purpose of data processing

User registration is required to fulfill a contract with the user or to carry out pre-contractual measures or to provide and review content in blog systems, mailing lists or discussion platforms.

7.4 Disclosure of data to third parties

An order or the user’s request for an offer or individual contact may result in the user being forwarded to a partner company. In this case, explicit reference is made to the possible disclosure and the corresponding consent is obtained. The data will be forwarded to if required:

• Affiliated sales partners
• Hotels and restaurants for events and training courses
• Logistics partner

7.5 Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected.

This is the case for data collected during the registration process to fulfill a contract or to carry out pre-contractual measures if the data is no longer required for the execution of the contract. Even after conclusion of the contract, it may be necessary to store personal data of the contractual partner in order to comply with contractual or legal obligations.

7.6 Possibility of objection and removal

As a user, you have the option of canceling your registration at any time. You can change the data stored about you at any time.

If the data is required to fulfill a contract or to carry out pre-contractual measures, premature deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion.

8. contact form and e-mail contact

8.1 Description and scope of data processing

There is a contact form on our website which can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored. Only relevant data is collected, e.g. contact data (surname, first name, e-mail addresses, etc.) or content data.

The following data is also stored at the time the message is sent:

• The IP address of the user
• Date and time of registration

Your consent will be obtained for the processing of the data as part of the sending process and reference will be made to this privacy policy.

Alternatively, you can contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.

No data will be passed on to third parties in this context. The data is used exclusively for processing the conversation.

8.2 Legal basis for data processing

The legal basis for the processing of the data, if the user has given consent, is Art. 6 para. 1 lit. a GDPR.

The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

8.3 Purpose of data processing

The processing of the personal data from the input mask serves us to process the contact as well as for customer care and quality management. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in the processing of the data. Otherwise, the user’s consent is required.

The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

8.4 Disclosure of data to third parties

An order or the user’s request for an offer or individual contact may result in the user being forwarded to a partner company. In this case, explicit reference is made to the possible disclosure and the corresponding consent is obtained. The data will be forwarded to if required:

• Affiliated sales partners
• Hotels and restaurants for events and training courses
• Logistics partner

8.5 Publication of data

When success stories are submitted, the data collected is published on the website with the name of the user. In this case, explicit reference is made to the possible disclosure and the corresponding consent is obtained.

8.6 Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected, the purpose no longer applies or the user’s consent has been revoked.

The additional personal data collected during the sending process will be deleted after a period of six months at the latest.

8.7 Possibility of objection and removal

The user has the option to revoke their consent to the processing of personal data at any time. If the user contacts us by e-mail, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of contacting us will be deleted in this case.

9. publication of job advertisements / online job applications

9.1 Description and scope of data processing

The application data is collected and processed electronically by us for the purpose of handling the application process. Various data is processed, e.g. name, telephone number, e-mail address, etc. This data is generally used to establish contact and communication.

No information is processed that is not usable under the General Equal Treatment Act (ethnic origin, gender, religion or belief, disability, age or sexual identity). We also ask you not to provide any information on illness, pregnancy, ethnic origin, political views, philosophical or religious beliefs, trade union membership, physical or mental health or sex life. The same applies to content that is likely to infringe the rights of third parties (e.g. copyrights, press law or general rights of third parties).

If an application is followed by the conclusion of an employment contract, the transmitted data may be stored by us in a personnel file for the purpose of the usual organizational and administrative process in compliance with the relevant legal regulations.

9.2 Legal basis for data processing

The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f and Art. 6 para. 1 lit. a GDPR. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

9.3 Purpose of data processing

The processing of personal data from an e-mail serves us solely to process the application procedure and recruit employees and at the same time includes your necessary, legitimate interest in the processing of the data.

9.4 Duration of storage

If the application is rejected, the transmitted data will be deleted automatically three months after notification. This does not apply if longer storage is necessary due to legal requirements (e.g. the burden of proof under the General Equal Treatment Act) or if longer storage in our database of interested parties has been expressly consented to.

9.5 Possibility of objection and removal

The user has the option to revoke their consent to the processing of personal data at any time. If there are no legitimate interests of the controller or the user, the data will be deleted immediately. In the cases provided for by law, the data may be blocked instead of deleted.

10. blog systems, mailing lists and discussion platforms

10.1 Description and scope of data processing

Within these systems it is possible to make comments, write guest articles or take part in a discussion. Only relevant data is collected, e.g. contact data (surname, first name, e-mail addresses, etc.) or content data.

The following data is also stored at the time of registration:

• The IP address of the user
• Date and time of registration

If comments are posted, they can be subscribed to by other users. At the time of commenting, the other users are informed of this. No personal data is transmitted in the comments that would allow direct identification.

Furthermore, we reserve the right, on the basis of our legitimate interests acc. Art. 6 para. 1 lit. f. GDPR to process user data for the purpose of spam detection or to delete posts that violate the personal rights of third parties.

The data provided in the context of comments and contributions will be stored by us permanently until the user objects.

10.2 Legal basis for data processing

The legal basis for the processing of the data results from personal consent in accordance with Art. 6 para. 1 lit. a or the interests of the controller pursuant to Art. 6 para. 1 lit. f.

10.3 Purpose of data processing

We operate the above-mentioned systems for marketing purposes, employee and customer recruitment and the provision of general information. The focus here is on providing corresponding user groups with general information from the business area of the person responsible.

10.4 Duration of storage

The content and communication data provided within the scope of the systems will be stored by us permanently until the user objects. Log data is deleted after six months at the latest.

10.5 Possibility of objection and removal

The user has the option to revoke their consent to the processing of personal data at any time. We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time.

11. order processing in the online store and customer account

We process our customers’ data as part of the ordering process in our online store in order to enable them to select and order the selected products and services, as well as their payment and delivery or execution.

11.1 Processing of data

The processed data includes inventory data, communication data, contract data, payment data and the persons affected by the processing include our customers, interested parties and other business partners. The processing is carried out for the purpose of providing contractual services in the context of operating an online store, billing, delivery and customer services. We use session cookies to store the contents of the shopping cart and permanent cookies to store the login status.

11.2 Legal basis for data processing

The processing is carried out on the basis of Art. 6 para. 1 lit. b (Execution of order processes) and c (Legally required archiving) GDPR. The information marked as required is necessary for the establishment and fulfillment of the contract. We only disclose the data to third parties within the scope of delivery, payment or within the scope of legal permissions and obligations towards legal advisors and authorities. The data will only be processed in third countries if this is necessary to fulfill the contract (e.g. at the customer’s request for delivery or payment).

11.3 Storage of data

Users can optionally create a user account in which they can view their orders in particular. As part of the registration process, users are provided with the required mandatory information. The user accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data will be deleted with regard to the user account, subject to their retention for commercial or tax law reasons. Art. 6 para. 1 lit. c GDPR is necessary. Information in the customer account remains until it is deleted with subsequent archiving in the event of a legal obligation. It is the responsibility of users to back up their data before the end of the contract in the event of termination.

We store the IP address and the time of the respective user activity as part of the registration and renewed logins and use of our online services. The storage is based on our legitimate interests, as well as those of the user in protection against misuse and other unauthorized use. This data will not be passed on to third parties unless it is necessary for the pursuit of our claims or there is a legal obligation to do so in accordance with. Art. 6 para. 1 lit. c GDPR.

11.4 Duration of storage

The deletion takes place after the expiry of statutory warranty and comparable obligations, the necessity of storing the data is reviewed every three years; in the case of statutory archiving obligations, the deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) retention obligation).

12. external payment service providers

We use external payment service providers through whose platforms users and we can carry out payment transactions.

As part of the fulfillment of contracts, we use payment service providers on the basis of Art. 6 para. 1 lit. b. GDPR. We also use external payment service providers on the basis of our legitimate interests in accordance with Art. Art. 6 para. 1 lit. b. GDPR in order to offer our users effective and secure payment options.

12.1 Legal basis for data processing

The data processed by the payment service providers includes inventory data, such as the name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, sum- and recipient-related data. The information is required to carry out the transactions. However, the data entered will only be processed by the payment service providers and stored by them. This means that we do not receive any account or credit card-related information, but only information with confirmation or negative information about the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. The purpose of this transmission is to check identity and creditworthiness. Please refer to the general terms and conditions and data protection information of the payment service providers.

Payment transactions are subject to the terms and conditions and the data protection notices of the respective payment service providers, which can be accessed on the respective websites or transaction applications. We also refer to these for further information and the assertion of rights of revocation, information and other rights of data subjects. PayPal and Computop

13. use of third-party providers

13.1 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). The use takes place on the basis of Art. 6 para. 1 p. 1 lit. f. GDPR. Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site.

13.1.1 Storage of data

The following information generated by the cookie about your use of the website will generally be transmitted to and stored by Google on servers in the United States:

• Browser type/version
• Operating system used
• Referrer URL (the previously visited page)
• Host name of the accessing computer (IP address)
• Time of the server request

The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. We have also added the code “anonymizeIP” to Google Analytics on this website. This guarantees that your IP address is masked so that all data is collected anonymously. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

13.1.2 Evaluation of the data

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

13.1.3 Prevention of processing

You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link:

tools.google.com/dlpage/gaoptout

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on this link. An opt-out cookie is set to prevent the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again. You can find information on the integration of the opt-out cookie at:

developers.google.com/analytics/devguides/collection/gajs/

We continue to use Google Analytics to analyze data from double-click cookies and AdWords for statistical purposes. If you do not wish to do this, you can do so via the Ads Preferences Manager

https://myadcenter.google.com/home

deactivate. Further information on data protection in connection with Google Analytics can be found in the Google Analytics help section, for example

https://policies.google.com/privacy

13.2 Google Adwords

We also use the Google advertising tool “Google Adwords” to advertise our website. As part of this, we use the “Conversion Tracking” analysis service of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter “Google”, on our website.

13.2.1 Storage of data

If you have reached our website via a Google ad, a cookie will be stored on your computer. Cookies are small text files that your Internet browser places and stores on your computer. These so-called “conversion cookies” lose their validity after 30 days and are not used for your personal identification. If you visit certain pages of our website and the cookie has not yet expired, we and Google can recognize that you as a user have clicked on one of our ads placed on Google and have been redirected to our site.

13.2.2 Processing of the data

The information collected with the help of “conversion cookies” is used by Google to compile visit statistics for our website. These statistics tell us the total number of users who have clicked on our ad and also which pages of our website were subsequently accessed by the respective user. However, we or other advertisers via “Google Adwords” do not receive any information with which users can be personally identified.

13.2.3 Prevention of processing

You can prevent the installation of “conversion cookies” by setting your browser accordingly, e.g. settings that generally deactivate the automatic setting of cookies or specifically block only cookies from the domain “googleadservices.com”.

You can find Google’s privacy policy in this regard at the following link:

https://services.google.com/sitestats/de.html

13.3 Google Maps

We use the “Google Maps” component of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to as “Google”, on our website.

Each time the “Google Maps” component is called up, Google sets a cookie to process user settings and data when the page on which the “Google Maps” component is integrated is displayed.

13.3.1 Processing of the data

As a rule, this cookie is not deleted when you close the browser, but expires after a certain period of time unless you delete it manually beforehand.

13.3.2 Prevention of processing

If you do not agree to this processing of your data, you have the option of deactivating the “Google Maps” service and thus preventing the transfer of data to Google. To do this, you must deactivate the Java Script function in your browser. However, we would like to point out that in this case you will not be able to use “Google Maps” or only to a limited extent.

The use of “Google Maps” and the information obtained via “Google Maps” is subject to the Google Terms of Use

http://www.google.de/intl/de/policies/terms/regional.html

and the additional terms and conditions for “Google Maps”

https://www.google.com/intl/de_de/help/terms_maps.html

13.4 Google Fonts

We use the “Google Fonts” component of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to as “Google”, on our website.

13.4.1 Processing of the data

Google Fonts logs records of CSS and font requests. Aggregated user numbers determine how popular certain font families are and are published on our Analytics page. Data from Google’s web crawler also determines which websites use Google fonts. This data is published and is available in the BigQuery database of Google Fonts. Further information on collection and processing can be found in Google’s privacy policy.

https://policies.google.com/privacy?hl=de

13.4.2 Prevention of processing

If you do not agree to this processing of your data, you have the option of deactivating the “Google Maps” service and thus preventing the transfer of data to Google. To do this, you must deactivate the Java Script function in your browser. However, we would like to point out that in this case you will not be able to use “Google Maps” or only to a limited extent.

The use of “Google Maps” and the information obtained via “Google Maps” is in accordance with the
Google Terms of Use

http://www.google.de/intl/de/policies/terms/regional.html

and the additional terms and conditions for “Google Maps”

https://www.google.com/intl/de_de/help/terms_maps.html

13.5 reddit

Data is collected on this website for marketing, market research and optimization purposes – on the basis of the legitimate interests of the website operator (pursuant to Art. 6 para. 1 lit. f GDPR). A JavaScript-based code from Reddit is used for this purpose, which collects company data and analyzes its use. The information collected is encrypted by hashing (i.e. via a one-way function) and directly pseudonymized. This means that no personal conclusions can be drawn about you as a visitor to the site.

13.5.1 Processing and storage of data

The data stored in the context of reddit® will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations.

13.5.2 Prevention of processing

You can prevent the “conversion cookies” by making the appropriate settings in your browser – e.g. completely deactivating the automatic setting of cookies or specifically blocking cookies from reddit®.

13.6 Facebook

We use components of the provider facebook.com on our website. Facebook is a service of Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA.

Each time you access our website, which is equipped with such a component, this component causes the browser you are using to download a corresponding representation of the component from Facebook. This process informs Facebook which specific page of our website you are currently visiting.

13.6.1 Storage of data

If you visit our site while you are logged in to Facebook, Facebook recognizes which specific page you are visiting through the information collected by the component and assigns this information to your personal account on Facebook. For example, if you click on the “Like” button or make comments, this information will be transmitted to your personal user account on Facebook and stored there. In addition, the information that you have visited our site is passed on to Facebook. This happens regardless of whether you click on the component or not.

13.6.2 Prevention of processing

If you want to prevent this transmission and storage of data about you and your behavior on our website to and by Facebook, you must log out of Facebook before you visit our site. Facebook’s data protection information provides more detailed information on this, in particular on the collection and use of data by Facebook, your rights in this regard and the setting options for protecting your privacy:

https://de-de.facebook.com/about/privacy/

You can find an overview of the Facebook plugins at

https://developers.facebook.com/docs/plugins/

13.7 LinkedIn

We use components of the LinkedIn network on our website. LinkedIn is a service of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Each time you access our website, which is equipped with such a component, this component causes the browser you are using to download a corresponding representation of the component from LinkedIn.

13.7.1 Use for LinkedIn Ads

For individual marketing purposes, e-mail data is transferred to our partner LinkedIn. The transfer takes place taking into account the completed order data processing.

13.7.2 Storage of data

This process informs LinkedIn which specific page of our website is currently being visited. If you click on the LinkedIn “Recommend button” while you are logged into your LinkedIn account, you can link the content of our pages to your LinkedIn profile. This enables LinkedIn to associate your visit to our pages with your LinkedIn user account.

13.7.3 Prevention of processing

If you do not want LinkedIn to associate your data with your account, you must log out of LinkedIn before visiting our website. For information on the purpose and scope of data collection and the further processing and use of data by LinkedIn, as well as setting options to protect your privacy, please refer to LinkedIn’s privacy policy.

13.8 Gravatar (profile pictures)

We use the Gravatar service of Automattic Inc, 60 29th Street #343, San Francisco, CA 94110, USA, within our online offering and in particular in the blog.

13.8.1 Storage of data

Gravatar is a service where users can register and store profile pictures and their e-mail addresses. If users with the respective e-mail address leave posts or comments on other online presences (especially in blogs), their profile pictures can be displayed next to the posts or comments. For this purpose, the e-mail address provided by users is transmitted in encrypted form to Gravatar for the purpose of checking whether a profile is stored for it. This is the sole purpose of sending the e-mail address and it will not be used for any other purpose, but will be deleted afterwards.

Gravatar is used on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f) GDPR, as we use Gravatar to offer the authors of posts and comments the opportunity to personalize their posts with a profile picture.

By displaying the images, Gravatar learns the IP address of the user, as this is necessary for communication between a browser and an online service. Further information on the collection and use of data by Gravatar can be found in Automattic’s privacy policy:

https://automattic.com/privacy/

13.8.2 Prevention of processing

If users do not want a user picture linked to their email address at Gravatar to appear in the comments, they should use an email address that is not stored at Gravatar to comment. We would also like to point out that it is also possible to use an anonymous e-mail address or no e-mail address at all if users do not wish their own e-mail address to be sent to Gravatar. Users can completely prevent the transfer of data by not using our comment system.

13.9 Akismet (anti-spam check)

Our website uses the Akismet service, which is provided by Automattic Inc, 60 29th Street #343, San Francisco, CA 94110, USA. The use is based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f) GDPR.

13.9.1 Storage of data

With the help of this service, comments from real people are distinguished from spam comments. For this purpose, all details of a comment are sent to a server in the USA, where they are analyzed and stored for four days for comparison purposes. If a comment has been classified as spam, the data will be stored beyond this time. This information includes the name entered, the email address, the IP address, the comment content, the referrer, details of the browser used and the computer system and the time of the entry.

Further information on the collection and use of data by Akismet can be found in Automattic’s privacy policy:

https://automattic.com/privacy/

13.9.2 Prevention of processing

Users are welcome to use pseudonyms or refrain from entering their name or e-mail address. You can completely prevent the transfer of data by not using our comment system.

14 Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

14.1 Right to information

You can request confirmation from the controller as to whether personal data concerning you is being processed. If such processing has taken place, you can request the following information from the controller:

• the purposes for which the personal data are processed
• the categories of personal data that are processed
• the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed
• the planned duration of storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period
• the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• all available information on the origin of the data if the personal data are not collected from the data subject
• the existence of automated decision-making, including profiling, in accordance with Art. 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the data subject

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards within the meaning of Art. 46 GDPR in connection with the transfer.

14.2 Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete. The controller must make the correction immediately.

14.3 Right to restriction of processing

Under the following conditions, you may request the restriction of the processing of personal data concerning you:

• if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or
• if you object to the processing pursuant to Art. 21 para. 1 GDPR and it has not yet been established whether the legitimate reasons of the controller outweigh your reasons.

If the processing of your personal data has been restricted, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

14.4 Right to erasure

14.4.1 Obligation to delete

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
• You revoke your consent on which the processing is based in accordance with. Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.
• You create acc. Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 6(1) GDPR. Art. 21 para. 2 GDPR to object to the processing.
• The personal data concerning you has been processed unlawfully.
• The deletion of personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR. 1 GDPR is collected.

14.4.2 Information to third parties

If the controller has made the personal data concerning you public and is obliged pursuant to Art. Art. 17 para. Where the controller has made the personal data public and is obliged pursuant to Article 1 GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

14.4.3 Exceptions

The right to erasure does not exist if the processing is necessary for the following reasons:

• to exercise the right to freedom of expression and information
• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• for reasons of public interest in the area of public health pursuant to Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR
• for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Art. 6 para. 1 lit. a GDPR. Art. 89 para. 1 GDPR, insofar as the right referred to in Section 14.4.1 is likely to render impossible or seriously impair the achievement of the objectives of that processing
• for the assertion, exercise or defense of legal claims

14.5 Right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed about these recipients by the controller.

14.6 Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where

• the processing is based on consent pursuant to Art. Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. Art. 6 para. 1 lit. b GDPR is based and
• the processing is carried out using automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be impaired by this.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

14.7 Right of objection

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 (1) GDPR. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

Notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object in connection with the use of information society services by means of automated procedures using technical specifications.

14.8 Right to revoke the declaration of consent under data protection law

You have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

14.9 Automated decision-making in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

• is necessary for the conclusion or performance of a contract between you and the controller,
• is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• with your express consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or g GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to above, the controller shall take reasonable steps to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

14.10 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

15. age of majority and legal capacity

You can only effectively consent to the collection, processing and use of your data when you reach the age of majority and legal capacity. For this reason, we cannot store your data in this system if you are under the age of 16. By agreeing to this privacy policy, you declare that you have legal capacity once you have reached the age of majority.

If you are not of legal age or legally competent, we do not want to lose you as an applicant. For this reason, we would be delighted to welcome you to our office to receive your application.

16. safety measures

We use the widespread SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser when you visit our website. As a rule, this involves 256-bit encryption.

We also use suitable technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.