Not following Least Privilege is not an option anymore. Here’s why.

Nexode Consulting GmbH

Managing Director: Christoph Ebeling

Oberwallstraße 6

10117 Berlin

info@nexode.de

VAT Identification Number: DE347774883

Registered with the Commercial Register of the District Court of Charlottenburg under HRB 234987 B

1. Data protection summary

The following notes provide a simple overview of what happens to your personal data when you visit our website. For detailed information on the subject of data protection, please refer to this privacy policy below.

Data processing on this website

As the operator of the website, we are responsible for data processing. We are the

Nexode Consulting GmbH

Oberwallstraße 6

10117 Berlin

Phone: 0 30 4397375 0

E-mail: info@nexode.de

How do we collect your data?

On the one hand, your data is collected by you providing it to us. This can be, for example, data that you enter in a contact form. Other data is collected automatically or after your consent when you visit the website by our IT systems. This is mainly technical data (e.g. Internet browser, operating system or time of page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipient and purpose of your stored personal data. You also have a right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. For this purpose, as well as for further questions on the subject of data protection, you can contact us at any time.

Third-party analytics and tools

When visiting this website, your surfing behavior can be statistically evaluated. This is done primarily with so-called analysis programs. Detailed information about these analysis programs can be found in the following of this privacy policy.

2. General notes and mandatory information

2.1. Terms

Personal data is any information relating to an identified or identifiable natural person (hereinafter 'data subject'). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Profiling is any type of automated processing of personal data that consists of using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects relating to that natural person's job performance, economic situation, health, personal preferences, interests, reliability, behavior, location or change of location.

Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separate and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

The controller or the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for under Union or Member State law.

Processor means a natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller.

A recipient is a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not a third party. However, public authorities that may receive personal data in the context of a specific investigation mandate under Union or Member State law shall not be considered as recipients.

Third party means a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons authorised to process the personal data under the direct responsibility of the controller or the processor.

Consent shall mean any freely given indication of the data subject's wishes for the specific case in an informed and unambiguous manner in the form of a statement or any other unambiguous affirmative act by which the data subject indicates that he or she consents to the processing of personal data relating to him or her.

2.2. Privacy

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected.

Personal data is data with which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We point out that data transmission over the Internet (eg communication by e mail) security gaps. A complete protection of the data against access by third parties is not possible.

2.3. Note to the responsible person

Responsible for data processing on this website is:

Nexode Consulting GmbH

Oberwallstraße 6

10117 Berlin

Phone: 0 30 4397375 0

E-mail: info@nexode.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.).

2.4. Storage period and regular deletion

Unless a more specific storage period has been specified within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies or until statutory periods for data storage have expired. If you assert a legitimate request for deletion or revoke consent for data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons no longer apply.

2.5. General information on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) a GDPR or Art. 9 (2) a GDPR, if special categories of data are processed according to Art. 9 (1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49 (1) a GDPR. If you have consented to the storage of cookies or to the access to information in your terminal device (e.g. via device fingerprinting), the data processing is additionally carried out on the basis of Section 25 (1) TTDSG. The consent can be revoked at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation, we process it on the basis of Art. 6 para. 1 lit. c GDPR. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6 para. 1 lit. f GDPR. Information about the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.

2.6. Note on data transfer to the USA and other third countries

Among other things, we use tools from companies based in the USA or other third countries that are not secure under data protection law. If these tools are active, your personal data may be transferred to these third countries and processed there. We would like to point out that no level of data protection comparable to that in the EU can be guaranteed in these countries. For example, US companies are obliged to hand over personal data to security authorities without you as a data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data located on US servers for monitoring purposes. We have no influence on these processing activities.

2.7. Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

2.8. Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6 ABS. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE PURPOSE OF ASSERTING, EXERCISING OR DEFENDING LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21 (1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS CONNECTED WITH SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ARTICLE 21 (2) GDPR).

2.9. SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or requests that you send to us as the site operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from 'http://' to 'https://' and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2.10. Objection to advertising e-mails

The use of contact data published within the framework of the imprint obligation to send advertising and information materials not expressly requested is hereby prohibited. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, such as spam e-mails.

3. Rights of the data subject

If you wish to exercise one or more of the following (information) rights, you can contact us at any time.

3.1. Right of complaint to the competent supervisory authority

In the event of breaches of the GDPR, data subjects shall have a right of appeal to a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged breach. The right of appeal is without prejudice to other administrative or judicial remedies.

3.2. Right to confirmation

You have the right to request confirmation as to whether personal data concerning you is being processed. For this purpose, you can contact us at any time.

3.3. Right to information

You have the right to receive from us at any time, free of charge, information about the personal data stored about you and a copy of this information. Furthermore, you have a right to information about the following information:

* the processing purposes

* the categories of personal data that are processed

* the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations

* if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration

* the existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by us or a right to object to such processing

* if the personal data is not collected from you: All available information about the origin of the data

* the existence of automated decision-making including profiling pursuant to Article 22(1) and (4) of the GDPR and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for you

* whether personal data has been transferred to a third country or to an international organisation. If this is the case, you also have the right to obtain information about the appropriate safeguards in connection with the transfer

3.4. Right to correction

You have the right to request the immediate correction of inaccurate personal data concerning you. Furthermore, you have the right to request the completion of incomplete personal data - also by means of a supplementary declaration - taking into account the purposes of the processing.

3.5. Right to deletion

You have the right to request that we erase the personal data concerning you without delay, provided that one of the following reasons applies and to the extent that the processing is not necessary:

* The personal data were collected or otherwise processed for purposes for which they are no longer necessary.

* You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR and there is no other legal basis for the processing.

* You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

* The personal data have been processed unlawfully.

* The deletion of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.

* The personal data was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

If one of the above reasons applies and you wish to arrange for the deletion of personal data stored by us, you can contact us at any time. We will arrange for the deletion request to be complied with immediately.

If the personal data have been made public by us and our company as the controller is obliged to erase the personal data pursuant to Article 17 (1) of the Data Protection Regulation, we shall implement reasonable measures, including technical measures, taking into account the available technology and the cost of implementation, to inform other data controllers which process the published personal data, that the data subject has requested from those other data controllers the erasure of all links to the personal data or copies or replications of the personal data, unless the processing is necessary. We will arrange the necessary in individual cases.

3.6. Right to restriction of processing

You have the right to request us to restrict processing if one of the following conditions is met:

* You dispute the accuracy of the personal data for a period of time that allows us to verify the accuracy of the personal data.

* The processing is unlawful, you object to the erasure of the personal data and request instead the restriction of the use of the personal data.

* We no longer need the personal data for the purposes of processing, but you need it to assert, exercise or defend legal claims.

* You have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether our legitimate grounds outweigh yours.

If one of the above conditions is met and you wish to request the restriction of personal data stored by us, you can contact us at any time. We will arrange the restriction of the processing.

3.7. Right to data transfer

You have the right to receive the personal data concerning you, which has been provided by you, in a structured, common and machine-readable format. You also have the right to transfer this data to another controller to whom the personal data has been provided without hindrance from us, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR and the processing is carried out using automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, you have the right to have the personal data transferred directly from one controller to another controller, insofar as this is technically feasible and insofar as this does not affect the rights and freedoms of other persons.

3.8. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

We will no longer process the personal data in the event of objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of your person, or the processing serves to assert, exercise or defend legal claims.

If we process personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data for such marketing. This also applies to profiling, insofar as it is associated with such direct advertising. If you object to us processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, you have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you which is carried out by us for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the Data Protection Regulation, unless such processing is necessary for the performance of a task carried out in the public interest.

You are also free, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

3.9. Automated decisions in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects vis-à-vis it or similarly significantly affects it, unless the decision (1) is necessary for the conclusion or performance of a contract between you and us, or (2) is permitted by Union or Member State law to which we are subject and that law contains adequate measures to safeguard the rights and freedoms and legitimate interests of you, or (3) with your explicit consent.

If the decision (1) is necessary for the conclusion or performance of a contract between you and us, or (2) is made with your express consent, we will take reasonable steps to protect your rights and freedoms and legitimate interests, including at least the right to obtain the intervention of a person on our part, to

express your point of view and to contest the decision.

3.10. Right to revoke consent under data protection law

You have the right to revoke consent to the processing of personal data at any time. If you wish to exercise your right to withdraw your consent, you can contact us at any time.

4. Collection of general data and information

Our website collects a series of general data and information with each call by a data subject or an automated system. This general data and information is stored in the log files of the server. The following data may be collected: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system accesses our website (so-called referrer), (4) the sub-websites that are accessed via an accessing system on our website, (5) the date and time of access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) other similar data and information that serve to avert danger in the event of attacks on our information technology systems.

When using these general data and information, the Nexode Consulting GmbH does not draw any conclusions about the data subject. Rather, this information is needed (1) to deliver the content of our website correctly, (2) to optimise the content of our website and the advertising for it, (3) to ensure the long-term functionality of our information technology systems and the technology of our website, and (4) to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack. Therefore, the Nexode Consulting GmbH analyzes anonymously collected data and information on one hand, and on the other hand, with the aim of increasing the data protection and data security of our enterprise so that we can ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from any personal data provided by a data subject.

5. Hosting

We host the content of our website with the following provider:

Amazon Web Services (AWS)

Provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (hereinafter AWS).

When you visit our website, your personal data is processed on the servers of AWS. In the process, personal data may also be transferred to the parent company of AWS in the USA. The data transfer to the USA is based on the EU standard contractual clauses.

Details can be found here:

https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/

For more information, please see the AWS Privacy Policy:

https://aws.amazon.com/de/privacy/?nc1=f_pr

The use of AWS is based on Art. 6 (1) lit. f GDPR. We have a legitimate interest in the most reliable presentation of our website. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.

Data processing

We have concluded a contract on data processing (AVV) for the use of the above mentioned service. This is a contract required by data protection law, which ensures that this processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

6. Data collection on this website

6.1. Cookies

Our website uses so-called 'cookies'. Cookies are small data packets and do not cause any damage to your end device. They are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your end device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or until they are automatically deleted by your web browser.

Cookies can originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services of third-party companies within websites (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies can be used to evaluate user behavior or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 (1) lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, the processing is based exclusively on this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG); the consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. When deactivating cookies, the functionality of this website may be limited.

You can find out which cookies and services are used on this website by reading this privacy policy or our cookie policy.

6.2. Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

* Browser type and version

* Operating system used

* Referrer URL and sub-websites

* Host name and Internet service provider of the accessing computer - Date and time of the server request

* IP address

* data and information required for the prevention of risks to our information technology systems.

This data is not merged with other data sources and we do not draw any conclusions about the data subject. Rather, this information is required in order to

* to deliver the contents of our website correctly

* to optimise the content of our website and the advertising for it - to ensure the permanent functionality of our information technology systems and the technology of our website

* to provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.

The anonymously collected data and information is evaluated by us, on the one hand, statistically and, on the other hand, with the aim of increasing the data protection and data security of our enterprise so as to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from any personal data provided by a data subject.

The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website - for this purpose, the server log files must be collected.

6.3. Contact forms

If you send us inquiries via the contact form, your data from the inquiry form including the contact data you provided there will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent.

The processing of this data is based on Art. 6 (1) lit. b GDPR, if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; the consent can be revoked at any time.

The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g. after we have completed processing your request). Mandatory legal provisions - in particular retention periods - remain unaffected.

6.4. Request by e-mail, phone or fax

If you contact us by e-mail, telephone or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

The processing of this data is based on Art. 6 (1) lit. b GDPR, if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; the consent can be revoked at any time.

The data you send to us via contact requests will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g. after your request has been processed). Mandatory legal provisions - in particular legal retention periods - remain unaffected.

7. Social media

7.1. Facebook

Elements of the social network Facebook are integrated on this website.

The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the collected data is also transferred to the USA and other third countries.

An overview of Facebook social media elements can be found here: https://developers.facebook.com/docs/plugins/?locale=de_DE

When the social media element is active, a direct connection is established between your end device and the Facebook server. Facebook thereby receives the information that you have visited this website with your IP address. If you click the Facebook 'Like' button while logged into your Facebook account, you can link the content of this website on your Facebook profile.

This allows Facebook to associate your visit to this website with your user account. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by Facebook. You can find more information on this in Facebook's privacy policy at:

https://de-de.facebook.com/privacy/explanation

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in achieving the greatest possible visibility in social media.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Facebook. The processing by Facebook that takes place after the onward transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the text of the agreement at:

https://www.facebook.com/legal/controller_addendum

According to this agreement, we are responsible for providing the privacy information when using the Facebook tool and for the privacy-secure implementation of the tool on our website. Facebook is responsible for the data security of the Facebook products. You can assert data subject rights (e.g., requests for information) regarding data processed by Facebook directly with Facebook. If you assert the data subject rights with us, we are obliged to forward them to Facebook.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum

https://de-de.facebook.com/help/566994660333381

https://www.facebook.com/policy.php

7.2. Instagram

On this website, functions of the service Instagram are integrated. Instagram is a social network that allows users to share photos and videos and distribute them on other social networks.

The provider of this service is Instagram Inc., 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA. However, the collected data may also be transferred to other third countries.

You can find an overview of Instagram plugins and their appearance here:

https://developers.facebook.com/docs/instagram/oembed

Each time you call up a page of our website that contains Instagram components (Instagram buttons), your browser is caused to download a representation of the corresponding Instagram component from Instagram. In this technical process, Instagram receives information about which specific page of our website you are visiting.

If you are logged in to Instagram at the same time, Instagram can recognise which specific page of our website you are visiting each time you visit our website and for the entire duration of your stay on our website. This information is collected by the Instagram component and assigned by Instagram to your respective Instagram account. If you click one of the Instagram buttons integrated on our website, e.g. the 'Instagram' button, Instagram assigns this information to your personal Instagram user account and stores this personal data.

Instagram always receives information via the Instagram component that you have visited our website if you are logged into Instagram at the same time as calling up our website; this happens regardless of whether you click on the Instagram component or not. If you do not wish this information to be transmitted to Instagram, you can prevent this by logging out of your Instagram account before accessing our website.

For more information, please see Instagram's privacy policy at:

https://help.instagram.com/519522125107875

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in achieving the greatest possible visibility in social media.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum

https://help.instagram.com/519522125107875

7.3. LinkedIn

Elements of the Internet-based social network LinkedIn are integrated on this website. LinkedIn is a platform for professional contacts where users can create a professional profile and network with other professionally interested individuals and companies.

The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. However, the collected data may also be transferred to the USA and other third countries.

An overview of LinkedIn plugins and their appearance can be found here: https://developer.linkedin.com/plugins

Each time you call up a page of our website that contains LinkedIn components (LinkedIn plug-ins), your browser is caused to download a representation of the corresponding LinkedIn component from LinkedIn. In this technical process, LinkedIn receives information about which specific page of our website you are visiting.

If the LinkedIn plugin is active, a direct connection is established between your end device and the LinkedIn server. LinkedIn thereby receives the information that you have visited this website with your IP address. If you click the LinkedIn 'Recommend Button' while logged into your LinkedIn account, you can link the content of this website on your LinkedIn profile.

If you are logged in to LinkedIn at the same time, LinkedIn can recognise which specific page of our website you are visiting each time you call up our website and for the entire duration of your stay on our website. This information is collected by the LinkedIn component and assigned by LinkedIn to your respective LinkedIn account. If you click one of the LinkedIn buttons integrated on our website, e.g. the 'Share' button, LinkedIn assigns this information to your personal LinkedIn user account and stores this personal data.

LinkedIn always receives information via the LinkedIn component that you have visited our website if you are logged into LinkedIn at the same time as calling up our website; this happens regardless of whether you click on the LinkedIn component or not. If you do not wish this information to be transmitted to LinkedIn, you can prevent this by logging out of your LinkedIn account before accessing our website.

This allows LinkedIn to associate your visit to this website with your user account. You can find more information on this in LinkedIn's privacy policy at: https://www.linkedin.com/legal/privacy-policy

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in achieving the greatest possible visibility in social media.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.linkedin.com/legal/l/dpa

https://www.linkedin.com/legal/l/eu-sccs

7.4. Pinterest

Functions of the social network Pinterest are integrated on our website. Pinterest is a platform on which users can share content with other members or post it publicly (in so-called 'pinboards').

The provider of this service is Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. However, the collected data may also be transferred to the USA and other third countries.

You can find an overview of Pinterest plugins and their appearance here: https://developers.pinterest.com/docs/widgets/save/

When you call up a page on our website that contains such a plugin, your browser establishes a direct connection to the Pinterest servers. The plugin transmits log data to the Pinterest server in the USA. This log data may include your IP address, the address of the websites visited that also contain Pinterest functions, type and settings of the browser, date and time of the request, how you use Pinterest, and cookies.

If you are logged in to Pinterest at the same time, Pinterest can recognise which specific page of our website you are visiting each time you call up our website and for the entire duration of your stay on our website. This information is collected by the Pinterest component and assigned by Pinterest to your respective Pinterest account. If you click one of the Pinterest buttons integrated on our website, e.g. the 'Pin it' button, Pinterest assigns this information to your personal Pinterest user account and stores this personal data.

Pinterest always receives information via the Pinterest component that you have visited our website if you are logged into Pinterest at the same time as calling up our website; this happens regardless of whether you click on the Pinterest component or not. If you do not wish this information to be transmitted to Pinterest, you can prevent this by logging out of your Pinterest account before accessing our website.

For more information on the collection, processing and use of your data by Pinterest, as well as your rights in this regard and options for protecting your privacy, please refer to Pinterest's privacy policy at: https://policy.pinterest.com/de/privacy-policy

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in achieving the greatest possible visibility in social media.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://policy.pinterest.com/de/privacy-policy

7.5. Tumblr

Functions of the Tumblr service are integrated on our website. Tumblr is a platform that allows users to publish and share texts, images, quotes, links, audio and videos in a blog.

The provider of this service is Tumblr, Inc, 35 East 21st St, 10th Floor, New York, NY 10010, USA. However, the collected data may also be transferred to other third countries.

You can find an overview of Tumblr buttons and their appearance here: https://www.tumblr.com/buttons

Each time you visit a page of our website that contains Tumblr components (Tumblr buttons), your browser is caused to download a representation of the corresponding Tumblr component from Tumblr. In this technical process, Tumblr receives information about which specific page of our website you are visiting.

If you are logged in to Tumblr at the same time, Tumblr can recognise which specific page of our website you are visiting each time you visit our website and for the entire duration of your stay on our website. This information is collected by the Tumblr component and assigned by Tumblr to your respective Tumblr account. If you click one of the Tumblr buttons integrated on our website, e.g. the 'Reblog' button, Tumblr assigns this information to your personal Tumblr user account and stores this personal data.

Tumblr always receives information via the Tumblr component that you have visited our website if you are logged into Tumblr at the same time as calling up our website; this happens regardless of whether you click on the Tumblr component or not. If you do not wish this information to be transmitted to Tumblr, you can prevent this by logging out of your Tumblr account before accessing our website.

For more information, please see Tumblr's privacy policy at: https://www.tumblr.com/privacy/de

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in achieving the greatest possible visibility in social media.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.tumblr.com/privacy/de

7.6. Twitter

Functions of the Twitter service are integrated on this website. Twitter is a social network that allows users to post and distribute so-called 'tweets', short messages of a maximum of 280 characters.

The provider of this service is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. However, the collected data may also be transferred to the USA and other third countries.

You can find an overview of Twitter buttons and their appearance here: https://about.twitter.com/en_us/company/brand-resources.html

Each time you call up a page of our website that contains Twitter components (Twitter buttons), your browser is caused to download a representation of the corresponding Twitter component from Twitter. In this technical process, Twitter receives information about which specific page of our website you are visiting.

If you are logged in to Twitter at the same time, Twitter can recognise which specific page of our website you are visiting each time you call up our website and for the entire duration of your stay on our website. This information is collected by the Twitter component and assigned by Twitter to your respective Twitter account. If you click one of the Twitter buttons integrated on our website, e.g. the 'Tweet' button, Twitter assigns this information to your personal Twitter user account and stores this personal data.

Twitter always receives information via the Twitter component that you have visited our website if you are logged into Twitter at the same time as calling up our website; this happens regardless of whether you click on the Twitter component or not. If you do not wish this information to be transmitted to Twitter, you can prevent this by logging out of your Twitter account before accessing our website.

For more information, please see Twitter's privacy policy at: https://twitter.com/en/privacy

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in achieving the greatest possible visibility in social media.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://gdpr.twitter.com/en/controller-to-controller-transfers.html

7.7. XING

This website integrates elements of the Internet-based social network XING, which enables connection with existing business contacts and promotes the establishment of new business contacts. Users can create a personal profile on XING and companies can set up company profiles or publish job offers.

The provider of this service is XING SE, Dammtorstraße 30, 20354 Hamburg, Germany.

You can find an overview of the XING plugins and their appearance here: https://dev.xing.com/plugins

Each time you call up a page of our website that has integrated a XING component (XING plug-in), your browser is caused to download a representation of the corresponding XING component from XING. In this technical process, XING receives information about which specific page of our website you are visiting.

If you are logged in to XING at the same time, XING can recognise which specific page of our website you are visiting each time you visit our website and for the entire duration of your stay on our website. This information is collected by the XING component and assigned by XING to your respective XING account. If you click one of the XING buttons integrated on our website, e.g. the 'Share' button, XING assigns this information to your personal XING user account and stores this personal data.

XING always receives information via the XING component that you have visited our website if you are logged into XING at the same time as calling up our website; this happens regardless of whether you click on the XING component or not. If you do not wish this information to be transmitted to XING, you can prevent this by logging out of your XING account before accessing our website.

You can find more information on this in XING's privacy policy at:

https://www.xing.com/privacy

As well as in the privacy notices for the XING Share button under:

https://www.xing.com/app/share?op=data_protection

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in achieving the greatest possible visibility in social media.

8. Newsletter

8.1. Subscription to our newsletter

On our website you have the possibility to subscribe to our newsletter. Which personal data is transmitted to the controller when ordering the newsletter, is determined by the input mask used for this purpose.

With our newsletter we inform you regularly about offers, blogs and social media posts. The newsletter can only be received by you if you have a valid e-mail address and you have registered to receive the newsletter. For legal reasons, a confirmation e-mail will be sent to the e-mail address you entered for the first time for the newsletter dispatch using the double opt-in procedure. This confirmation email serves to verify whether the owner of the email address as the data subject has authorised the receipt of the newsletter.

When you register for the newsletter, we also store the IP address assigned to you by your Internet service provider (ISP) at the time of registration as well as the date and time of registration. The collection of this data is necessary in order to be able to trace the (possible) misuse of the e-mail address at a later date and therefore serves our legal protection.

The personal data collected in the context of a registration for the newsletter will be used exclusively for sending our newsletter. Furthermore, subscribers to the newsletter could be informed by e-mail if this is necessary for the operation of the newsletter service or a related registration, as could be the case in the event of changes to the newsletter offer or changes in the technical circumstances. No personal data collected as part of the newsletter service will be passed on to third parties. The subscription to our newsletter can be cancelled by you at any time.

The consent to the storage of personal data that you have given us for the newsletter dispatch can be revoked at any time. For the purpose of revoking the consent, you will find a corresponding link in each newsletter. Furthermore, it is also possible to unsubscribe from the newsletter mailing at any time directly on the website of the controller or to notify the controller of this in another way.

8.2. Newsletter tracking

Our newsletters contain so-called tracking pixels. A tracking pixel is a miniature graphic that is embedded in such emails that are sent in HTML format to enable log file recording and log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, we can see if and when an e-mail was opened by a data subject, and which links in the e-mail were called up by the data subject.

Such personal data collected via the tracking pixels contained in the newsletters are stored and evaluated by us in order to optimise the newsletter dispatch and to better adapt the content of future newsletters to the interests of the data subject. This personal data will not be passed on to third parties. You are entitled at any time to revoke the separate declaration of consent given in this regard via the double opt-in procedure. After a revocation, this personal data will be deleted by us. We automatically interpret an unsubscription from the receipt of the newsletter as a revocation.

9. Plugins and tools

9.1. Amazon CloudFront CDN

On our website, we use Amazon CloudFront, a content delivery network (CDN).

The provider of this service is Amazon Web Services, Inc, 410 Terry Ave North, Seattle, WA 98109, USA. The collected data may be transferred to the USA and other third countries.

Amazon CloudFront is a fast service for securely delivering data, applications, and APIs on a global scale with low latency and high transfer speeds. When you access our website, a connection is made to Amazon CloudFront servers.

We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by Amazon CloudFront. For more information, please see the privacy policy of Amazon Web Services at: https://aws.amazon.com/de/privacy/

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in the optimised provision and improvement of the stability of our website.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://d1.awsstatic.com/legal/awsgdpr/AWS_GDPR_DPA.pdf

9.2. Calendly

On this website, we use Calendly, an appointment scheduling service.

The provider of this service is Calendly LLC, 271 17th Street NW, Atlanta, GA 30363, USA. The collected data may be transferred to the USA and other third countries.

Calendly is a tool that allows you to coordinate appointments with us easily and efficiently. When you make an appointment through Calendly, the data you provide is stored and synchronised with our calendar.

For more information, please see Calendly's privacy policy at:

https://calendly.com/pages/privacy

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in efficient scheduling and communication.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://assets.calendly.com/assets/security/Calendly_DPA.pdf

9.3. Cookiebot

This website uses Cookiebot, a cookie content management service.

The provider of this service is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark. With the help of Cookiebot, we inform you about the cookies used on our website and ask for your consent to use certain cookies.

When you enter our website, a connection is established to Cookiebot's servers and a cookie is set with your consent/refusal decision.

For more information, please see Cookiebot's privacy policy at: https://www.cookiebot.com/de/privacy-policy/

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in the correct fulfillment of the legal requirements for the use of cookies.

9.4. Facebook

Several tools and plugins (services) from Facebook are used on this website. The services are listed individually below.

The provider of these services is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the collected data is also transferred to the USA and other third countries.

Insofar as consent has been obtained, the use of the respective service is based on Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked individually and in total at any time. If no consent has been obtained, the use of the respective service is based on our legitimate interest in analyzing user behavior in order to optimise both our website and our advertising.

Insofar as personal data is collected on our website with the help of the services described below and forwarded to Facebook, we and Meta Platforms Ireland Limited are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook.

Facebook's privacy policy, which is available at https://de de.facebook.com/privacy/explanation, provides information about the collection, processing and use of personal data by Facebook. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert the data subject rights with us, we are obliged to forward them to Facebook.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum

https://de-de.facebook.com/help/566994660333381

https://www.facebook.com/policy.php

9.4.1. Facebook Conversion API

Elements of the Facebook Conversion API service are integrated on our website.

The Facebook Conversion API is a service that allows actions users take on our website to be sent to Facebook. This allows us to measure the effectiveness of our Facebook ads by determining what actions were taken on our website after a user saw or clicked on our ads.

When the Facebook Conversion API is active, data about your use of our website is sent directly to Facebook. Facebook thereby receives the information that you have visited this website with your IP address and have performed certain actions.

9.4.2. Facebook Custom Audiences

Elements of the Facebook Custom Audiences service are integrated on our website.

Facebook Custom Audiences is a tool from Facebook for targeting ads. It allows us to define specific audiences for our ads based on the behavior and interests of our website users.

When the Facebook Custom Audiences element is active, a direct connection is established between your end device and the Facebook server. Facebook thereby receives the information that you have visited this website with your IP address.

9.5. Google

Several tools and plugins (services) from Google are used on this website. The services are listed individually below.

The provider of these services is in each case Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. However, the collected data may also be transferred to the USA and other third countries.

Insofar as consent has been obtained, the use of the respective service is based on Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked individually and in total at any time. If no consent has been obtained, the use of the respective service is based on our legitimate interest in targeted advertising and analysis of user behavior to optimise our advertising measures.

Insofar as personal data is collected on our website with the help of the respective service and forwarded to Google, we and Google Ireland Limited are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transfer to Google.

Google's privacy policy, which is available at https://policies.google.com/privacy?hl=de, provides information on the collection, processing and use of personal data by Google. You can assert data subject rights (e.g. requests for information) regarding the data processed by Google directly with Google. If you assert the data subject rights with us, we are obliged to forward them to Google.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://policies.google.com/privacy/frameworks?hl=de

https://www.google.com/about/datacenters/locations/

https://safety.google/privacy/privacy-controls/

9.5.1. Google Ads and Google Ads Remarketing

Elements of the online advertising service Google Ads and Google Ads Remarketing are integrated on this website.

Google Ads is an Internet advertising service that allows advertisers to display ads in Google's search engine results and in the Google advertising network. Google Ads allows an advertiser to specify certain keywords in advance, by means of which an ad is displayed in Google's search engine results exclusively when the user retrieves a keyword-relevant search result with the search engine.

The purpose of Google Ads is to advertise our website by displaying interest relevant advertising on third-party websites and in the search engine results of the Google search engine.

Google Ads Remarketing is a feature of Google Ads that enables a company to display targeted advertising to previous visitors to our website. For this purpose, the surfing behavior of users on our website is analyzed and then targeted product recommendations and interest-based advertising are displayed when the user visits other websites in the Google Display Network.

9.5.2. Google AdSense

Elements of the Google AdSense advertising network are integrated on this website.

Google AdSense allows us to embed advertisements in our website and receive compensation for their display or other use. Google AdSense technology uses cookies and web beacons (invisible graphics) that allow information such as visitor flow on our website.

9.5.3. Google AdWords

On our website we use Google AdWords.

Google AdWords is an online advertising program that enables us to place ads in Google search results as well as in the Google advertising network. With Google AdWords, we can specify certain keywords in advance, with the help of which an ad is only displayed in Google search results when the user performs a search query relevant to the search engine.

9.5.4. Google Analytics

Elements of the analysis service Google Analytics are integrated on this website.

Google Analytics is a web analysis service. Web analysis is the collection, compilation and evaluation of data about the behavior of visitors to websites. A web analysis service collects, among other things, data on which website a data subject came to a website from (so-called referrers), which subpages of the website were accessed or how often and for how long a subpage was viewed. Cookies are used for this purpose.

The purpose of the Google Analytics component is to analyze the flow of visitors to our website. Google uses the data and information obtained, among other things, to evaluate the use of our website in order to compile online reports for us.

9.5.5. Google Conversion Tracking

On this website we use the analysis service Google Conversion Tracking.

Google conversion tracking allows us to track the actions of users who have clicked on a Google ad to be redirected to our website. This helps us measure the effectiveness of Google ads for statistical and market research purposes.

9.5.6. Google Fonts

Elements of the Google Fonts service are integrated on this website.

Google Fonts is a service that allows us to use special fonts on our website. When you visit our site, your browser loads the required font into your browser cache to display texts and fonts correctly.

For this purpose, the browser you use must establish a connection to Google's servers. Through this, Google obtains knowledge that our website was accessed via your IP address.

9.5.7. Google Tag Manager

Elements of the Google Tag Manager service are integrated on our website.

Google Tag Manager is a solution that allows us to manage website tags through one interface. The tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool takes care of triggering other tags, which in turn may collect data. Google Tag Manager does not access this data.

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. Insofar as no consent has been obtained, the use of the service is based on our legitimate interest in the efficient and simpler management of website tags.

9.5.8. Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited ('Google'), Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission. If Google Maps is activated, Google may use Google Fonts for the purpose of uniform display of fonts. When calling up Google Maps, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly.

The use of Google Maps is in the interest of an appealing presentation of our online offers and an easy location of the places indicated by us on the website. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be revoked at any time.

9.6. Communication via WhatsApp

On this website, we use the messenger service WhatsApp for communication.

The provider of this service is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This company is a subsidiary of Meta Platforms Inc, 1 Hacker Way, Menlo Park, CA 94025, USA. The collected data may be transferred to the USA and other third countries.

WhatsApp provides a platform for exchanging text messages, pictures, videos and other file formats. To use WhatsApp, you need to install the corresponding app on your mobile device.

When you send us a message via WhatsApp, WhatsApp stores this message and all the information it contains. This may include, but is not limited to, your username, phone number, the content of the message and any files transmitted.

We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by WhatsApp. For more information, please refer to the privacy policy of WhatsApp at:

https://www.whatsapp.com/legal/privacy-policy-eea/?lang=de

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in efficient and fast communication.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.whatsapp.com/legal/business-data-transfer-addendum/?lang=de

9.7. LinkedIn Insight Tag

Elements of the LinkedIn Insight Tag service are integrated on our website.

The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. However, according to LinkedIn, the collected data is also transferred to the USA and other third countries.

The LinkedIn Insight Tag enables the collection of data about members of LinkedIn who have visited our website, including the URL, IP address, device and browser characteristics, and timestamp. This data is encrypted, identities remain anonymous, and the data is deleted within 90 days. LinkedIn does not share any personally identifiable information with us, but only provides aggregate reports on website audience and ad performance.

When the LinkedIn Insight Tag is active, a direct connection is established between your end device and the LinkedIn server. LinkedIn thereby receives the information that you have visited this website with your IP address.

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in analyzing user behavior in order to optimise both our website and our advertising.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to LinkedIn, we and LinkedIn Ireland Unlimited Company are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transfer to LinkedIn.

LinkedIn's privacy policy, which is available at https://www.linkedin.com/legal/privacy-policy, provides information about the collection, processing and use of personal data by LinkedIn. You can assert data subject rights (e.g. requests for information) regarding the data processed by LinkedIn directly with LinkedIn. If you assert the data subject rights with us, we are obliged to forward them to LinkedIn.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.linkedin.com/legal/l/dpa

https://www.linkedin.com/legal/l/eu-sccs

9.88. Meta Pixel

Elements of the analysis tool Meta Pixel (formerly known as Facebook Pixel) are integrated on our website.

The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, the collected data is also transferred to the USA and other third countries.

Meta Pixel is an analysis tool that is used to measure user behavior on our website in order to optimise our online offers. For this purpose, the tool sets a cookie that records the user's behavior on the website and transmits it to Meta. In the process, both general information about the content used and specific data such as IP address are collected.

When the Meta pixel is active, a direct connection is established between your end device and the Meta server. Meta thereby receives the information that you have visited this website with your IP address.

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in analyzing and improving the usability of our website.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Meta, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Meta.

The data policy published by Meta, which can be accessed at https://www.facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Meta. You can assert data subject rights (e.g. requests for information) regarding the data processed by Meta directly with Meta. If you assert the data subject rights with us, we are obliged to forward them to Meta.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum

9.9. Pipedrive and chatbots

Elements of the CRM system Pipedrive are integrated on this website.

The provider of this service is Pipedrive OÜ, Paldiski mnt 80, 10617 Tallinn, Estonia. However, according to Pipedrive, the collected data may also be transferred to the USA and other third countries.

Information about the Pipedrive elements can be found here:

https://www.pipedrive.com/en-gb/features

When the Pipedrive element is active, a direct connection is established between your end device and the Pipedrive server. Pipedrive thereby receives the information that you have visited this website with your IP address.

This enables Pipedrive to assign the visit to this website to your user account. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by Pipedrive. For more information, please refer to Pipedrive's privacy policy at:

https://www.pipedrive.com/en-gb/privacy

In addition, we use a chatbot provided by Pipedrive. Chatbots are automated interlocutors that answer users' questions, provide information, and facilitate interactions. They work based on pre-programmed rules, artificial intelligence, or a combination of both.

The use of a chatbot may involve the collection and processing of personal data, such as your name, email address and the content of your conversations with the chatbot. This data is used to respond to your inquiries, improve our services, and personalise our communications.

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in effective customer management.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Pipedrive, we and Pipedrive OÜ, Paldiski mnt 80, 10617 Tallinn, Estonia are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Pipedrive. The processing by Pipedrive that takes place after the onward transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement.

According to this agreement, we are responsible for providing the privacy information when using the Pipedrive tool and for the privacy-secure implementation of the tool on our website. Pipedrive is responsible for the data security of the Pipedrive products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Pipedrive directly with Pipedrive. If you assert the data subject rights with us, we are obliged to forward them to Pipedrive.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.pipedrive.com/en-gb/privacy

9.10. SoundCloud

Plugins of the social network SoundCloud (SoundCloud Limited, Berners House, 47-48 Berners Street, London W1T 3NF, United Kingdom.) may be integrated on this website. You can recognise the SoundCloud plugins by the SoundCloud logo on the pages concerned.

When you visit this website, a direct connection between your browser and the SoundCloud server is established after the plugin is activated. SoundCloud thereby receives the information that you have visited this website with your IP address. If you click the 'Like button' or 'Share button' while logged into your SoundCloud user account, you can link and/or share the content of this website with your SoundCloud profile. This allows SoundCloud to associate your visit to this website with your user account. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by SoundCloud.

The storage and analysis of the data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in ensuring the greatest possible visibility in social media. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.

The United Kingdom is considered a secure third country under data protection law. This means that the UK has a level of data protection that corresponds to the level of data protection in the European Union.

For more information, please see SoundCloud's privacy policy at: https://soundcloud.com/pages/privacy

If you do not want SoundCloud to associate your visit to this website with your SoundCloud user account, please log out of your SoundCloud user account before activating SoundCloud plugin content.

9.11. Spotify

On this website, functions of the music service Spotify are integrated. The provider is Spotify AB, Birger Jarlsgatan 61, 113 56 Stockholm in Sweden. You can recognise the Spotify plugins by the green logo on this website. You can find an overview of the Spotify plugins at:

https://developer.spotify.com

This allows a direct connection between your browser and the Spotify server to be established via the plugin when you visit this website. Spotify thereby receives the information that you have visited this website with your IP address. If you click the Spotify button while logged into your Spotify account, you can link the content of this website on your Spotify profile. This allows Spotify to associate your visit to this website with your user account.

We would like to point out that cookies from Google Analytics are used when using Spotify, so that your usage data can also be passed on to Google when using Spotify. Google Analytics is a tool of the Google Group for analyzing user behavior based in the USA. Spotify is solely responsible for this integration. We as the website operator have no influence on this processing.

The storage and analysis of the data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the appealing acoustic design of its website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.

For more information, please see Spotify's privacy policy: https://www.spotify.com/de/legal/privacy-policy/

If you do not want Spotify to associate your visit to this website with your Spotify user account, please log out of your Spotify user account.

9.12. YouTube

This website embeds videos from the website YouTube. The operator of the website is Google Ireland Limited ('Google'), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our websites on which YouTube is embedded, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited.

Furthermore, YouTube may store various cookies on your terminal device or use comparable technologies for recognition (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve the user experience, and prevent fraud attempts.

If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

YouTube is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be revoked at any time.

For more information on the handling of user data, please see YouTube's privacy policy at: https://policies.google.com/privacy?hl=de

9.13. Chatbots

We use chatbot services on our website. Provider of this service may vary depending on the specific implementation.

Chatbots are automated conversationalists that answer users' questions, provide information, and facilitate interactions. They operate based on pre-programmed rules, artificial intelligence, or a combination of both.

The use of a chatbot may involve the collection and processing of personal data, such as your name, email address and the content of your conversations with the chatbot. This data is used to respond to your inquiries, improve our services, and personalise our communications.

The exact nature of the data the chatbot collects depends on the specific questions and information you provide during your interaction with the chatbot. If consent has been obtained, the above-mentioned service is used on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in efficient and fast processing of user requests.

For more details on the specific privacy practices of the chatbot provider we use, we recommend reading the privacy policy of that provider.

Please note that data transfer to the US or other third countries is based on the EU Commission's standard contractual clauses if the chatbot service provider is located outside the EU.

9.14. Hotjar

On this website, we use Hotjar, a service for analyzing user behavior.

The provider of this service is Hotjar Ltd., 5th Floor, Dragonara Business Centre, Dragonara Road, Paceville St. Julian's STJ 3141, Malta.

Hotjar is a tool that helps us better understand the needs of our users and optimize the offerings and experience on this website. Using Hotjar's technology, we gain a better understanding of user experiences (e.g., how much time users spend on which pages, which links they click, what they like and dislike, etc.) to align our offerings with user feedback. Hotjar uses cookies and other technologies to collect data on user behavior and their devices, especially the IP address of the device (collected and stored in anonymized form during website use), screen size, device type (Unique Device Identifiers), information about the browser used, location (country only), and preferred language for displaying the website. Hotjar stores this information in a pseudonymized user profile on our behalf. Hotjar is contractually prohibited from selling the data collected on our behalf.

For more information, please see Hotjar's privacy policy at: https://www.hotjar.com/legal/policies/privacy/

If consent has been obtained, the use of the aforementioned service is based on Art. 6 para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in analyzing user behavior to optimize both our web offerings and our advertising.

9.13. Leadinfo

On this website, we use Leadinfo, a service for analyzing user behavior.

The provider of this service is Leadinfo B.V., Rotterdam, Netherlands.

This service recognizes visits from companies to our website based on IP addresses and shows us publicly available information, such as company names or addresses. In addition, Leadinfo sets first-party cookies to evaluate user behavior on our website and processes domains from form entries (e.g., 'leadinfo.com') to correlate IP addresses with companies and improve the services.

For more information, please see Leadinfo's privacy policy at: https://www.leadinfo.com/en/privacy/

If consent has been obtained, the use of the aforementioned service is based on Art. 6 para. 1 lit. a DSGVO and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in analyzing user behavior to optimize both our web offerings and our advertising.