Privacy Policy

1. Name and Address of the Data Controller

The controller, as defined by the General Data Protection Regulation and other national data protection laws of the member states of the
, as well as other data protection regulations, is:

NETWAYS GmbH and its affiliated companies—NETWAYS Professional Services GmbH, NETWAYS Event Services GmbH, and NETWAYS Managed Services GmbH (NETWAYS Web Services)—each for the online services they operate

2. Name and address of the data protection officer

The data protection officer for the responsible company is:

3. General Information on Data Processing

3.1 Scope of the Processing of Personal Data

As a general rule, we process our users’ personal data only to the extent necessary to provide a fully functional website at
, as well as our content and services. The processing of personal data
takes place only if one of the legal bases specified in Section 3.2 applies, i.e.,
in particular based on your consent, to fulfill a contract, due to a legal obligation
, or based on a legitimate interest.

3.2 Legal Basis for the Processing of Personal Data

To the extent that we obtain the data subject’s consent
for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. When processing
personal data that is necessary for the performance of a contract to which the data subject is a party,
Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to
processing operations necessary for the implementation of pre-contractual measures. To the extent that the processing of personal data at
is necessary to comply with a legal obligation to which our company at
is subject, Article 6(1)(c) of the GDPR serves as the legal basis.

In the event that the vital interests of the data subject or another natural person
necessitate the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party
and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest,
then Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

3.3 Data Deletion and Retention Periods

The data subject’s personal data will be erased or its processing restricted as soon as the purpose of storage
no longer applies. Storage may also take place if this is provided for by the European
or national legislature in EU regulations, laws, or other provisions to which the
controller is subject. Erasure or restriction of processing also occurs when a
retention period prescribed by the aforementioned standards expires, unless there is a need for
further storage of the data for the conclusion or performance of a contract.

3.4 Validity

This Privacy Policy informs users about the nature, scope, and purposes of the collection and
use of personal data by the responsible provider. It applies to our
online platforms, such as websites, blogs, online stores, and event pages.

4. Website Hosting and Log File Creation

4.1 Description and Scope of Data Processing

Every time our website is accessed, our system automatically collects data and information from the computer system (
) of the accessing computer.

The following data is collected in this process:

• Information about the browser type and version used
• The user’s operating system
• The user’s Internet service provider
• The user’s IP address
• Date and time of access
• Websites from which the user’s system accessed our website
• Websites accessed by the user’s system via our website

4.2 Legal Basis for Data Processing

The legal basis for the temporary storage of the data is Article 6(1)(f) of the GDPR.

4.3 Purpose of Data Processing

Data is stored in log files to ensure the website functions properly. In addition, the
data helps us optimize the website and ensure the security of our IT systems.
The data is not analyzed for marketing purposes in this context.

4.4 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
. In the case of data collected for the purpose of providing the website, this occurs when the respective session
ends.

If data is stored in log files, it is deleted after six months at the latest.
Storage beyond this period is possible. In this case, users’ IP addresses are deleted or anonymized at
so that the client making the request can no longer be identified.

4.5 Right to Object and Remedy

The collection of data for the purpose of providing the website and the storage of data in log files is absolutely necessary for the
operation of the website. Although you may object to this processing under Article 21 of the GDPR (
) (see Section 15.7), our compelling legitimate interests
in the secure operation of the website generally take precedence in this case.

5. Use of Cookies

5.1 Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in or by the browser on the user’s computer system at
. When a user visits a website, a cookie may be stored on the user’s device at
. This cookie contains a unique string of characters that allows
to uniquely identify the browser when the website is visited again.

We use cookies to make our website more user-friendly. Some elements of our website,
, require that the browser used to access the site can be identified even after changing pages.

The following data is stored and transmitted in the cookies:

• Software configuration settings, such as language, time zone, etc.
• Items in a shopping cart
• Login information

5.2 Legal Basis for Data Processing

The storage of and access to information on your device in the case of technically necessary
cookies is based on Section 25(2)(2) of the TDDDG; the subsequent processing of personal data
is based on Article 6(1)(f) of the GDPR. We use all other cookies and similar technologies—in particular
for analytics and marketing purposes (see Section 14)—only with your consent pursuant to Section 25(1)
of the TDDDG in conjunction with Article 6(1)(a) of the GDPR.

5.3 Purpose of Data Processing

The purpose of using technically necessary cookies is to simplify the use of websites for users at
. Some features of our website cannot be provided without the use of cookies.
For these, it is necessary for the browser to be recognized even after a page change.

The user data collected through technically necessary cookies is not used to create user profiles on
.

5.4 Duration of Storage, Right to Object, and Right to Erasure

Cookies are stored on the user’s computer and transmitted to our website. As a user of
, you therefore have full control over the use of cookies. By changing the settings in your browser at
, you can disable or restrict the transmission of cookies. Cookies already stored at
can be deleted at any time. This can also be done automatically. If cookies are disabled for our website at
, you may no longer be able to use all features of the website
to their full extent. You can revoke any consent you have given at any time, effective for the future, via the cookie settings on the respective website at
.

6. Newsletter

6.1 Description and Scope of Data Processing

On our website, you can subscribe to a free newsletter. When you sign up for the newsletter at
, the data entered in the form is transmitted to us.

If you purchase goods or services on our website and provide your email address,
, we may subsequently use it to send you a newsletter. In such cases,
will use the newsletter exclusively to send direct marketing for its own similar goods or services at
.

6.2 Legal Basis for Data Processing

The legal basis for processing data after a user subscribes to the newsletter is Article 6(1)(a) of the GDPR, provided the user has given consent (
).

The legal basis for sending the newsletter following the sale of goods or services is Article 6
(1)(f) of the GDPR in conjunction with Section 7(3) of the UWG. You may object to this use of your email address at
at any time without incurring any costs other than the transmission costs according to the standard rates at
.

6.3 Purpose of Data Processing

The user’s email address is collected for the purpose of delivering the newsletter.

The collection of other personal data as part of the registration process is intended to prevent misuse of the services at
or of the email address provided.

6.4 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
. The user’s email address will therefore be stored for as long as the newsletter subscription remains active.

Other personal data collected as part of the registration process is generally deleted after a period of
six months.

6.5 Right to Object and Remedy

The user may cancel their subscription to the newsletter at any time. To do so,
a link is provided in every newsletter. This also allows the user to revoke their consent to the storage of personal data collected during the registration process at
.

7. Registration

7.1 Description and Scope of Data Processing

On our website, we offer users the option to register at
by providing personal data. The data entered in the form is transmitted to us and stored. Only relevant
data is collected, such as contact information (last name, first name, email addresses, etc.) or content-related data.

The following data is also stored at the time of registration:

• The user’s IP address
• Date and time of registration

As part of the registration process, the user’s consent to the processing of this data is obtained.

7.2 Legal Basis for Data Processing

If registration serves to fulfill a contract to which the user is a party, or to
carry out precontractual measures, the additional legal basis for processing
the data is Article 6(1)(b) of the GDPR. Otherwise, consent is obtained in accordance with Article 6(1)(a) of the GDPR.

7.3 Purpose of Data Processing

User registration is required to fulfill a contract with the user, to carry out precontractual measures
, or to provide and review content in blog systems, mailing lists
, or discussion platforms.

7.4 Disclosure of Data to Third Parties

An order or a request by the user for a quote or individual contact at
may result in the user’s information being forwarded to a partner company. In this case, explicit notice will be given regarding the possible disclosure of information to
, and the user’s consent will be obtained. If necessary, the information will be disclosed to:

• Affiliated Sales Partners
• Hotels and Restaurants for Events and Training Sessions
• Logistics Partner

7.5 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
.

This applies to data collected during the registration process for the purpose of fulfilling a contract or taking pre-contractual measures (
) once the data is no longer necessary for the performance of the contract (
). Even after the contract has been concluded, it may still be necessary to store the contractual partner’s personal
data in order to comply with contractual or legal obligations.

7.6 Right to Object and Remedy

As a user, you have the option to cancel your registration at any time. You can have the data stored about you at
modified at any time.

If the data is necessary for the performance of a contract or for the implementation of precontractual measures
, early deletion of the data is possible only to the extent that no contractual or legal obligations
preclude such deletion.

8. Contact Form and Email Contact

8.1 Description and Scope of Data Processing

Our website features a contact form that can be used to contact us electronically at
. If a user chooses this option, the data entered in the form at
is transmitted to us and stored. Only relevant data is collected, such as contact information (last name, first name,
email addresses, etc.) or content-related data.

At the time the message is sent, the following data is also stored:

• The user’s IP address
• Date and time of submission

Your consent to the processing of your data will be obtained as part of the submission process, and reference will be made to this privacy policy at
.

Alternatively, you may contact us via the email address provided. In this case,
will store the user’s personal data transmitted with the email.

Data will be disclosed to third parties only in the cases specified in Section 8.4. The data will be used by
exclusively for the purposes specified in Section 8.3.

8.2 Legal Basis for Data Processing

If the user has given consent, the legal basis for processing the data is Article 6(1)
(a) of the GDPR.

The legal basis for processing the data transmitted when sending an email to
is Article 6(1)(f) of the GDPR. If the purpose of the email contact is to conclude a contract,
the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

8.3 Purpose of Data Processing

We process the personal data entered in the form to handle your inquiry, as well as
for customer service and quality management. If you contact us via email, this also constitutes the legitimate interest in processing the data required under
. Otherwise, the user’s consent is required
.

The other personal data processed during the submission process is used to prevent misuse of the
contact form and to ensure the security of our information technology systems.

8.4 Disclosure of Data to Third Parties

An order or a request by the user for a quote or individual contact at
may result in the user’s information being forwarded to a partner company. In this case, explicit notice will be given regarding the possible disclosure of information to
, and the user’s consent will be obtained. If necessary, the information will be disclosed to:

• Affiliated Sales Partners
• Hotels and Restaurants for Events and Training Sessions
• Logistics Partner

8.5 Publication of Data

When success stories are submitted, the collected data is published on the website along with the user’s name at
. In this case, explicit notice is given regarding the publication, and the appropriate consent (Art. 6(1)(a) GDPR) is obtained from
.

8.6 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
, the purpose ceases to exist, or the user’s consent has been revoked.

The personal data collected in addition during the transmission process will be deleted no later than
after a period of six months.

8.7 Right to Object and Remedy

The user may revoke their consent to the processing of personal data at
at any time. If the user contacts us via email, they may object to the storage of their personal data at
at any time. In such a case, the conversation cannot be continued.

In this case, all personal data stored when you contacted us will be deleted from
.

9. Posting Job Listings / Online Job Applications

9.1 Description and Scope of Data Processing

We collect application data electronically for the purpose of processing the application and handle it at
. Various types of data are processed in this context, such as name, phone number, email address, etc. This data at
is generally used for contacting applicants and communicating with them.

Characteristics that may not be taken into account under the General Equal Treatment Act (ethnic
origin, gender, religion or belief, disability, age, or sexual identity) do not
factor into our selection decision.
We also ask that you refrain from providing information regarding illnesses, pregnancy, ethnic origin, political views, philosophical or
religious beliefs, union membership, physical or mental health
, or sex life. The same applies to content that is likely to infringe
the rights of third parties (e.g., copyrights, press rights, or general third-party rights).

If an application is followed by the execution of an employment contract, we may store the data provided at
in a personnel file for the purposes of standard organizational and administrative processes, in compliance with the relevant legal
regulations.

9.2 Legal Basis for Data Processing

The legal basis for processing your application data is Article 6(1)(b) of the GDPR (implementation
of precontractual measures in connection with a potential employment relationship). If you consent to longer-term storage at
—for example, in our database of prospective candidates—the legal basis is Article 6(1)(a) of the GDPR
. The retention of data to defend against potential legal claims is based on Article 6
(1)(f) of the GDPR.

9.3 Purpose of Data Processing

We process your application data solely for the purpose of conducting the application process and for
recruiting employees.

9.4 Duration of Storage

If the application is rejected, the submitted data will be automatically deleted five months
after notification. This does not apply if longer retention is required due to legal requirements (such as the burden of proof under the General Equal Treatment Act (
)) or if explicit consent has been given for longer retention
in our database of prospective applicants.

9.5 Right to Object and Remedy

The user may revoke their consent to the processing of personal data at any time by contacting
. Unless there are legitimate interests on the part of the data controller or the user that prevent this, the data at
will be deleted immediately. In cases provided for by law, deletion may be replaced by a restriction on processing as described at
.

10. Blog Systems, Mailing Lists, and Discussion Forums

10.1 Description and Scope of Data Processing

Within these systems, it is possible to post comments, write guest articles, or participate in a
discussion. Only relevant data is collected, such as contact information (last name, first name, email addresses,
, etc.) or content data.

The following data is also stored at the time of registration:

• The user’s IP address
• Date and time of registration

When comments are posted, other users can subscribe to them. When a comment is posted at
, other users are notified. No personally identifiable information
that would allow for direct identification is transmitted in the comments.

Furthermore, based on our legitimate interests pursuant to Article 6(1)(f) of the GDPR,
, we reserve the right to process user information for the purpose of detecting spam or to delete posts that violate the personal rights of third parties, as defined at
.

We permanently store the data provided in comments and posts un
until users object.

10.2 Legal Basis for Data Processing

The legal basis for the processing of the data is your consent
pursuant to Article 6(1)(a) of the GDPR, or the legitimate interests of the data controller pursuant to Article 6(1)
(f) of the GDPR.

10.3 Purpose of Data Processing

We operate the systems listed above at
for marketing purposes, to recruit employees and attract customers, and to provide general information. The primary focus here is to provide relevant user groups with general information about the
business division of the data controller.

10.4 Duration of Storage

We permanently store the content and communication data provided within the systems at
until users object. Log data is deleted after six months at the latest.

10.5 Right to Object and Remedy

The user may revoke their consent to the processing of personal data at any time by contacting
. We may store unsubscribed email addresses for up to three years based on our legitimate
interests (Art. 6(1)(f) GDPR) before deleting them, in order to be able to prove that consent was previously given. The
processing of this data is limited to the purpose of potentially defending against claims. An
individual request for deletion may be submitted at any time, provided that the prior existence of
consent is confirmed at the same time.

11. Events: Ticket Sales and Personal Event Schedule

11.1 Ticket Sales via pretix

11.1.1 Description and Scope of Data Processing

We use the pretix ticketing system to sell tickets for our events. When you place an order at
, we process the information provided in the order form, specifically your name, email address, billing address
, and, if applicable, company name, as well as the selected tickets and the attendee information requested for the respective event at
. Required fields are marked as such on the order form. Payment is processed through the payment service providers listed in Section 13 at
.

To the extent that we use an external service provider to operate the ticketing system, that provider processes the data
exclusively on our behalf and in accordance with our instructions, based on a contract for
data processing (Art. 28 GDPR).

11.1.2 Legal Basis for Data Processing

The legal basis is Article 6(1)(b) of the GDPR (performance of the contract regarding participation in the “
” event) and, for the legally required retention period, Article 6(1)(c) of the GDPR.

11.1.3 Purpose of Data Processing

We process this data to fulfill your order, issue invoices, issue tickets, organize admission to the event at
, and inform you of any organizational changes to the event.

11.1.4 Duration of Storage

The data will be deleted as soon as it is no longer necessary for the event to take place
. We will delete data subject to statutory retention requirements once those requirements have expired (see
, Section 12.4).

11.1.5 Right to Object and Remedy

Since the data is necessary for the performance of the contract, early deletion is only possible at
, provided that no contractual or legal obligations prevent it. Your rights under
, Section 15, remain unaffected.

11.2 Personal Event Schedule

11.2.1 Description and Scope of Data Processing

On our event websites, you can create your own personalized event schedule at
. Use of this feature is optional. If you use it, we will store the following data:

• Your email address, which you must confirm after entering it:
• the sessions you’ve selected
• Your feedback on sessions, if you provide any

11.2.2 Legal Basis for Data Processing

The legal basis for processing your email address and the selected sessions is Article 6(1)(b)
of the GDPR, as this allows us to provide you with the feature you requested. Providing feedback is voluntary;
The legal basis for this is your consent pursuant to Article 6(1)(a) of the GDPR.

11.2.3 Purpose of Data Processing

We process this data to provide you with your personalized event schedule across all your devices at
, to make your selected sessions available as a calendar feed that you can integrate into your
calendar app, and to share your feedback with the event organizers.
Verifying your email address ensures that only you can access your schedule.

11.2.4 Duration of Storage

We delete unconfirmed email addresses after 48 hours. We delete all other data—that is,
confirmed email addresses, marked sessions, and feedback—90 days after the end of the respective
event.

11.2.5 Right to Object and Remedy

You can delete all data saved in your personal event schedule at any time by clicking the “Delete my data” button at
. You may revoke any consent you have given for the processing of your
feedback at any time, effective for the future. Your rights under Section 15 of
remain unaffected.

12. Order Processing in the Online Store and Customer Account

We process our customers’ data as part of the ordering process in our online store to enable them to
select and order the products and services of their choice, as well as to facilitate payment, delivery, and
fulfillment.

12.1 Data Processing

The data processed includes inventory data, communication data, contract data, and payment data; the individuals affected by the processing
include our customers, prospective customers, and other
business partners. The processing is carried out for the purpose of providing contractual services in connection with the operation of
, an online store, as well as for billing, delivery, and customer service. In this context, we use session cookies to
store the contents of the shopping cart and persistent cookies to store the login status.

12.2 Legal Basis for Data Processing

Processing is based on Article 6(1)(b) (fulfillment of order processes) and (c)
(legally required archiving) of the GDPR. The information marked as required at
is necessary for the establishment and performance of the contract. We disclose the data to third parties only in connection with
shipping, payment, or within the scope of legal permissions and obligations toward
legal advisors and authorities. The data is processed in third countries only if this is necessary for
the performance of the contract (e.g., at the customer’s request for shipping or payment).

12.3 Data Storage

Users have the option to create a user account, which allows them, in particular, to view their orders.
During the registration process, users are informed of the required information. User accounts on
are not public and cannot be indexed by search engines. Once users have closed their user account at
, their data associated with that account will be deleted, unless its retention at
is necessary for commercial or tax law reasons in accordance with Art. 6(1)(c) of the GDPR.
Information in the customer account remains there until it is deleted and subsequently archived in the event of a legal obligation under
. It is the users’ responsibility to back up their data at
upon cancellation before the end of the contract.

As part of the registration process, subsequent logins, and the use of our online services, we store the
IP address and the time of each user activity. This data is stored based on our
legitimate interests, as well as the users’ interests in protection against misuse and other unauthorized use
(Art. 6(1)(f) GDPR).
This data is generally not disclosed to third parties, unless such disclosure is necessary to pursue our
claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR.

12.4 Duration of Storage

The data will be deleted upon the expiration of statutory warranty obligations and comparable obligations,
. The necessity of retaining the data is reviewed every three years; in the case of statutory archiving obligations under
, the data will be deleted upon their expiration (6, 8, or 10 years, depending on the document, in accordance with
§ 257 HGB and § 147 AO).

13. External Payment Service Providers

We use external payment service providers whose platforms allow users and us to process payment transactions on
.

In connection with the performance of contracts, we use payment service providers on the basis of Article 6(1)(
)(b) of the GDPR. In addition, we use external payment service providers based on our legitimate
interests pursuant to Article 6(1)(f) of the GDPR in order to offer our users effective and secure payment options at
.

13.1 Processed Data

The data processed by payment service providers includes personal information, such as name and
address; banking information, such as account numbers or credit card numbers; passwords, TANs, and checksums; as well as
information related to the contract, transaction amounts, and recipients. This information is required to process the transactions
. However, the data entered is processed solely by the payment service providers and stored by them at
. This means we do not receive any account- or credit card-related information, but only
information confirming the payment or indicating that it was declined. Under certain circumstances, the payment service providers may transmit the data
to credit bureaus. The purpose of this transmission is to
verify identity and creditworthiness. For more information, please refer to the Terms and Conditions and Privacy Policy of the
payment service providers.

Payment transactions are subject to the terms and conditions and privacy policies of the respective
payment service providers, which are available on their respective websites or within the transaction applications. We at
also refer you to these for further information and to exercise your rights of withdrawal, access, and other
data subject rights: PayPal and Computop.

14. Use of Third-Party Providers

We use the services described in this section for analytics, marketing, and convenience purposes only if you have given your consent via the cookie settings on
(§ 25(1) TDDDG in conjunction with Art. 6(1)
lit. a GDPR). Exceptions to this are Gravatar and Akismet, for which the respective legal basis applies. You may revoke your consent at
at any time with future effect.

Some providers are based in the U.S. or process data there. For companies certified under the EU-U.S.
Data Privacy Framework, there is an adequacy decision by the European Commission (Art. 45 GDPR).
In all other cases, the transfer is based on the European Commission’s Standard Contractual Clauses (Art. 46
(2)(c) GDPR).

14.1 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow
Street, Dublin 4, Ireland (“Google”). Use of this service is permitted only with your consent, in accordance with
, Article 6(1)(a) of the GDPR, and Section 25(1) of the TDDDG. Google Analytics uses so-called “cookies,”
, which are text files stored on your computer that enable an analysis of your use of the website
.

14.1.1 Data Storage

The following information generated by the cookie regarding your use of the website is generally transmitted to a Google
server in the United States and stored there:

• Browser type/version
• Operating system used
• Referrer URL (the previously visited page)
• Hostname of the accessing computer (IP address)
• Time of the server request

The IP address transmitted by your browser as part of Google Analytics is not combined with other data from
Google. In Google Analytics 4, IP addresses are not logged or stored by Google
; they are used solely to derive approximate location data and are subsequently discarded
. The data collected is therefore pseudonymous, but not anonymous.

14.1.2 Data Analysis

On behalf of the operator of this website, Google will use this information to analyze your use of the website.
to evaluate, compile reports on website activity, and to further align with the
Website usage and internet usage-related services vis-à-vis the website operator
to provide. You can prevent the storage of cookies by adjusting your browser settings accordingly.
prevent; however, we would like to point out that in this case you may not be able to do all
You will be able to fully utilize the functions of this website.

14.1.3 Prevention of Processing

You can also prevent Google from collecting the data generated by the cookie and related to your use of the website
(including your IP address), as well as from processing this data, by downloading and installing the browser plugin available at the following link:

tools.google.com/dlpage/gaoptout

As an alternative to the browser add-on—particularly for browsers on mobile devices—you can prevent Google Analytics from tracking your activity at
by not granting or by revoking your consent in the cookie settings on this website at
.

We continue to use Google Analytics to analyze data from Google advertising cookies and Google Ads for statistical
purposes. If you do not wish this to occur, you can opt out via “My Ad Center”

https://myadcenter.google.com/home

Disable. For more information on privacy in connection with Google Analytics, see Google’s privacy policy at
:

https://policies.google.com/privacy

14.2 Google Ads

We also use the Google advertising tool “Google Ads” (formerly Google AdWords) to promote our website. As part of this,
uses the “Conversion Tracking” analytics service provided by Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland, hereinafter “Google,” on our website. This service is used only with your consent
(Art. 6(1)(a) GDPR, § 25(1) TDDDG).

14.2.1 Data Storage

If you arrived at our website via a Google ad, a cookie will be stored on your computer.
Cookies are small text files that your web browser places and stores on your computer. These so-called
“conversion cookies” expire after a limited period of time and are not used to identify you personally
. If you visit certain pages on our website and the cookie has not yet expired,
we and Google can recognize that you, as a user, clicked on one of our ads placed on Google and were redirected to
our site.

14.2.2 Data Processing

Google uses the information collected via “conversion cookies” to generate visitor statistics for our website,
. These statistics tell us the total number of users who clicked on our ad at
, as well as which pages on our website each user subsequently visited. However, neither we nor
nor any other advertisers using Google Ads receive any information that could be used to personally identify users of
.

14.2.3 Prevention of Processing

You can prevent the installation of “conversion cookies” by adjusting your browser settings at
, for example, by enabling settings that generally disable the automatic placement of cookies or, specifically, block only the
cookies from the “googleadservices.com” domain.

You can find Google’s privacy policy regarding this matter at the following link:

https://policies.google.com/technologies/ads?hl=de

14.3 Google Maps

We use the “Google Maps” component provided by Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland, hereinafter referred to as “Google,” on our website.

Each time the “Google Maps” component is called, Google sets a cookie to process user settings and data when the
page—on which the “Google Maps” component is embedded—is displayed.

14.3.1 Data Processing

This cookie is not typically deleted when you close your browser; instead, it expires after a certain period of time
, unless you delete it manually beforehand.

14.3.2 Prevention of Processing

If you do not consent to this processing of your data, you have the option to disable the “Google Maps” service at
and thereby prevent the transfer of data to Google. To do so, visit
to deny or revoke your consent in the cookie settings, or disable JavaScript in your
browser. Please note, however, that in
this case, you will not be able to use “Google Maps” at all or only to a limited extent.

The use of “Google Maps” and the information obtained through “Google Maps” is governed by the Google Terms of Service at
.

https://policies.google.com/terms?hl=de

as well as the additional terms and conditions for “Google Maps”

https://www.google.com/intl/de_de/help/terms_maps.html

14.4 Google Fonts

We use the “Google Fonts” component from Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland, hereinafter referred to as “Google,” on our website.

14.4.1 Data Processing

If fonts are not loaded locally from our servers, your browser establishes a
connection to Google’s servers when you visit a page in order to load the required fonts. In particular, your
IP address, information about your browser, and the page you are visiting are transmitted to Google. Google logs
these requests and analyzes them in aggregated form, for example, to determine the prevalence of individual font families.
For more information on data collection and processing, please see Google’s Privacy Policy:

https://policies.google.com/privacy?hl=de

14.4.2 Prevention of Processing

If you do not consent to this processing of your data, you can refuse or withdraw your consent in the
cookie settings. Your browser will then use a default font, which may cause the
website to appear differently.

14.5 Reddit

On this website, we use conversion tracking (“Reddit Pixel”) provided by Reddit, Inc., USA, at
for marketing, market research, and optimization purposes. This feature is used only with your consent (Art. 6
(1)(a) GDPR, § 25(1) TDDDG). A JavaScript code from Reddit is loaded, which collects information
about your visit, such as the pages you viewed and your interactions. The collected information is hashed
and thus pseudonymized; however, it cannot be ruled out
that Reddit may associate it with an existing Reddit account.

14.5.1 Processing and Storage of Data

Data stored through reddit® will be deleted as soon as it is no longer necessary for its intended purpose
and there are no legal retention requirements preventing its deletion.

14.5.2 Prevention of Processing

You can prevent this processing by refusing to give your consent in the cookie settings or by revoking it at
, by disabling cookies in your browser altogether, or by specifically blocking cookies from Reddit at
.

14.6 Meta Pixel (Facebook and Instagram)

We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5,
Ireland (“Meta”) on our website. This allows us to measure the effectiveness of our ads on Facebook and Instagram and
to serve targeted ads to people who have shown interest in our offerings. This feature is used only with
your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We are jointly responsible with Meta for the collection of the data and its
transmission to Meta (Art. 26 GDPR); Meta is solely responsible for the further
processing.

14.6.1 Data Storage

When you visit our pages, the Meta Pixel transmits certain information to Meta, including your IP address, details about your browser and
device, the pages you visit, and specific actions you take on our website—such as logging in or
placing an order. Cookies are stored on your device for this purpose. If you are logged into Facebook
or Instagram, Meta can associate this information with your account. We ourselves only receive
aggregated reports that do not allow for the identification of individual persons. Meta also processes
data in the U.S.; Meta is certified under the EU-U.S. Data Privacy Framework.

14.6.2 Prevention of Processing

You can prevent this processing by withdrawing your consent in the cookie settings or
Opt out. In your Facebook or Instagram account, you can also specify whether Meta may use information from
and other websites for advertising purposes. For more information about Meta’s data processing, please see
Meta’s Privacy Policy:

https://www.facebook.com/privacy/policy/

14.7 LinkedIn

We use components from the LinkedIn network on our website. LinkedIn is a service provided by LinkedIn
Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Each time you visit a page on our website that includes such a component (
), that component causes the browser you are using to download a corresponding representation of the LinkedIn component from
.

14.7.1 Data Storage

This process notifies LinkedIn which specific page of our
website you are currently visiting. If you click the LinkedIn “Share” button while at
and are logged into your LinkedIn account, you can link the content of our pages to your LinkedIn profile at
. This allows LinkedIn to associate your visit to our pages with your LinkedIn user account.

14.7.2 Prevention of Processing

If you do not want LinkedIn to associate your data with your account, you must log out of LinkedIn before visiting our website at
. For information about the purpose and scope of data collection, as well as the further
processing and use of the data by LinkedIn, and settings options for protecting your
privacy, please refer to LinkedIn’s Privacy Policy.

14.8 Gravatar (Profile Pictures)

We use the Gravatar service provided by Automattic Inc., 60
29th Street #343, San Francisco, CA 94110, USA, on our website and, in particular, on our blog.

14.8.1 Data Storage

Gravatar is a service where users can sign up and upload profile pictures and their email addresses
. When users post entries or leave comments on other websites (especially blogs)
using that email address, their profile pictures can be displayed next to the entries or
comments. To this end, the email address provided by users is transmitted to Gravatar in the form of a hash value for the purpose of
checking whether a profile is associated with it. This is the sole purpose
of transmitting the email address; it is not used for any other purpose and is deleted immediately afterward
.

The use of Gravatar is based on our legitimate interests within the meaning of Article 6(1)(f)
of the GDPR, as we use Gravatar to offer authors of posts and comments the option
to personalize their posts with a profile picture.

When images are displayed, Gravatar obtains users’ IP addresses, as this is necessary for
communication between a browser and an online service. For more information on how Gravatar collects and
uses data, please see Automattic’s privacy policy:

https://automattic.com/privacy/

14.8.2 Prevention of Processing

If users do not want a profile picture linked to their email address on Gravatar to appear in the
comments, they should use an email address that is not registered with Gravatar
when commenting. We also note that it is possible to use an anonymous email address or no email address at all at
if users do not wish to have their email address sent to Gravatar.
Users can completely prevent the transfer of this data by not using our comment system.

14.9 Akismet (Anti-Spam Check)

Our website uses the Akismet service, which is provided by Automattic Inc., 60 29th Street #343, San Francisco, CA
94110, USA. This service is used based on our legitimate interests within the meaning of Article 6(1)
Article 1(f) of the GDPR.

14.9.1 Data Storage

This service helps distinguish comments from real people from spam comments. To do this, all
information from a comment is sent to a server in the U.S., where it is analyzed and stored for four
days for comparison purposes. If a comment is classified as spam, the data is stored beyond this period
. This information includes the name entered, the email address, the IP address, the
comment content, the referrer, details about the browser and computer system used, and the time of the post.

For more information about how Akismet collects and uses data, please see Automattic’s privacy policy at
:

https://automattic.com/privacy/

14.9.2 Prevention of Processing

Users are welcome to use pseudonyms or choose not to enter their name or email address. You
can completely prevent the transfer of data by not using our comment system.

15. Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights
vis-à-vis the controller:

15.1 Right to Information

You may request confirmation from the data controller as to whether personal data concerning you
is being processed. If such processing is taking place, you may request the following information from the data controller
:

• the purposes for which the personal data is processed
• the categories of personal data that are processed
• the recipients or categories of recipients to whom the personal data concerning you
  has been or will be disclosed
• the planned duration of the storage of your personal data or, if specific details
  cannot be provided, the criteria used to determine the storage period
• the existence of a right to rectification or erasure of your personal data, a
  right to restrict processing by the controller, or a right to object to this
  processing
• the existence of a right to file a complaint with a supervisory authority
• all available information regarding the origin of the data, if the personal data was not collected from the data subject at
• the existence of automated decision-making, including profiling, pursuant to Article 22
  , paragraphs 1 and 4 of the GDPR, and—at least in such cases—meaningful information regarding
  the logic involved, as well as the scope and intended effects of such processing for
  the data subject

You have the right to request information regarding whether your personal data is being transferred to a third country
or to an international organization. In this context, you may request
to be informed about the appropriate safeguards within the meaning of Art. 46 of the GDPR in connection with the transfer
.

15.2 Right to Rectification

You have the right to request that the data controller correct and/or complete your personal data, provided that the personal data concerning you processed by
is inaccurate or incomplete. The data controller,
, must make the correction without delay.

15.3 Right to Restriction of Processing

Under the following conditions, you may request that the processing of your personal data at
be restricted:

• if you contest the accuracy of the personal data concerning you, for a period that allows
  to verify the accuracy of the personal data;
• the processing is unlawful, and you object to the erasure of the personal data and instead request that
  restrict the use of the personal data;
• the controller no longer needs the personal data for the purposes of processing
  , but you need it to assert, exercise, or defend legal claims
  , or
• if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined
  whether the controller’s legitimate grounds override your interests.

If the processing of your personal data has been restricted, such data
—with the exception of its storage—may be processed only with your consent or for the purpose of asserting, exercise, or
defense of legal claims; or to protect the rights of another natural or legal
person; or for reasons of an important public interest of the Union or a Member State
.

If processing has been restricted in accordance with the above conditions, you will be notified by the data controller at
before the restriction is lifted.

15.4 Right to Erasure

15.4.1 Obligation to Delete

You may request that the data controller immediately delete your personal data at
, and the data controller is obligated to immediately delete this data at
if any of the following reasons apply:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed
  .
• You are withdrawing your consent on which the processing is based pursuant to Art. 6(1)(a) or Art. 9(2)(
  is based on the GDPR, and there is no other legal basis for the processing.
• You object to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds
  for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR
  .
• The personal data concerning you was processed unlawfully.
• The erasure of your personal data is necessary to comply with a legal
  obligation under Union law or the law of the Member States to which the controller
  is subject.
• The personal data concerning you was collected in connection with the information society services offered at
  in accordance with Article 8(1) of the GDPR.

15.4.2 Disclosure to Third Parties

If the controller has made your personal data public and is obligated to erase it pursuant to Art. 17
(1) of the GDPR, it shall take appropriate measures, including technical measures, taking into account the available
technology and the costs of implementation, to inform the
data controllers who process the personal data that you,
, as the data subject, have requested that they delete all links to such personal data or any copies or
replicas of such personal data.

15.4.3 Exceptions

The right to erasure does not apply if the processing is necessary for the following reasons:

• on the exercise of the right to freedom of expression and information
• to comply with a legal obligation that requires processing under Union law or the law of the
  Member States to which the controller is subject, or to perform a task carried out in the public interest
  or in the exercise of official authority vested in the controller

• for reasons of public interest in the area of public health pursuant to
  , Article 9(2)(h) and (i) and Article 9(3) of the GDPR
• for archival purposes in the public interest, scientific or historical research purposes
  , or for statistical purposes pursuant to Article 89(1) of the GDPR, to the extent that the right referred to in Section 15.4.1
  is likely to render the achievement of the purposes of such processing impossible or seriously
  impair it
• to assert, exercise, or defend legal claims

15.5 Right to Information

If you have exercised your right to rectification, erasure, or restriction of processing with the data controller at
, the data controller is obligated to notify all recipients to whom your personal data at
has been disclosed of such rectification, erasure, or restriction of processing at
, unless this proves impossible or involves a
disproportionate effort.

You have the right to request that the data controller inform you of these recipients.

15.6 Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the data controller,
, in a structured, commonly used, and machine-readable format. You also have the right
to transmit this data to another data controller without hindrance from the data controller to whom the personal
data was provided, provided that

• the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on
  a contract pursuant to Art. 6(1)(b) GDPR, and
• the processing is carried out using automated means.

In exercising this right, you also have the right to have your personal data
transferred directly from one data controller to another, provided that this is technically
feasible. This must not infringe upon the freedoms and rights of others.

The right to data portability does not apply to the processing of personal data that is necessary for
to perform a task carried out in the public interest or in the exercise of
official authority vested in the controller.

15.7 Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing by
of your personal data that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR,
; this also applies to profiling based on these provisions.

The controller will no longer process your personal data unless it can demonstrate to
compelling legitimate grounds for the processing that override your interests, rights, and
freedoms, or the processing is necessary for the establishment, exercise, or defense of
legal claims.

If your personal data is processed for direct marketing purposes, you have the right to
You have the right to object at any time to the processing of your personal data for the purpose of such processing.
to engage in advertising; this also applies to profiling insofar as it is related to such direct marketing.

If you object to the processing of your personal data for direct marketing purposes, the personal data concerning you
will no longer be processed for these purposes.

You have the option, in connection with the use of information society services—
—notwithstanding Directive 2002/58/EC—to exercise your right to object through automated means,
using technical specifications.

15.8 Right to Withdraw Consent Under Data Protection Law

You have the right to withdraw your consent under data protection law at any time. Withdrawal of consent via
does not affect the lawfulness of the processing carried out on the basis of that consent up until the time of withdrawal
.

15.9 Automated Decision-Making in Individual Cases, Including Profiling

You have the right not to be subject to a decision based solely on automated processing—
, including profiling—that produces legal effects concerning you
or similarly significantly affects you. This does not apply if the
decision

• if it is necessary for the conclusion or performance of a contract between you and the data controller
  ,
• is permitted under Union or Member State law to which the controller is subject, and such law provides for appropriate measures to safeguard your rights and freedoms
  as well as your legitimate interests, or
• is done with your express consent.

However, these decisions may not be based on specific categories of personal data as defined in Article 9(
1 GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to protect the rights and freedoms of
as well as their legitimate interests.

With regard to the cases mentioned above, the data controller will take appropriate measures to safeguard your rights and
freedoms as well as your legitimate interests, including, at a minimum, the right to have the data controller
intervene on your behalf, to present your point of view, and to challenge the decision
.

15.10 Right to File a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to file a complaint with a supervisory authority at
, in particular in the Member State of your residence, your
place of work, or the location of the alleged infringement, if you believe that the
processing of your personal data violates the GDPR.

The supervisory authority to which the complaint was submitted shall inform the complainant via
of the status and outcome of the complaint, including the possibility of seeking judicial
redress under Article 78 of the GDPR.

The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (
, BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

16. Legal Age and Legal Capacity

Our online services are not intended for individuals under the age of 16. In accordance with Article 8 of the GDPR, you may only validly consent to the processing of your
data in connection with information society services once you have
reached the age of 16; prior to that, the consent of your legal guardian
is required. Entering into contracts, such as placing orders in the online store or purchasing tickets, generally requires
that you have reached the age of majority and have legal capacity.

If you are not yet 16 years old, we cannot store your information in our online systems. However, we at
do not want to lose you as an applicant and look forward to welcoming you to our office at
to receive your application in person.

17. Safety Measures

When you visit our website, we use the widely adopted TLS (Transport Layer Security) protocol in conjunction with
at the highest encryption level supported by your browser. As a rule, this
involves 256-bit encryption.

We also employ appropriate technical and organizational security measures to protect your
data against accidental or intentional manipulation, partial or complete loss,
destruction, or unauthorized access by third parties. Our security measures are
continuously improved in line with technological developments.