Privacy Policy

Name and address of the person responsible

The controller is the body which alone – or jointly with others – determines the purposes and means of the processing of personal data. The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is the:

WASSERMANN TECHNOLOGIE GMBH

Represented by: Sebastian WASSERMANN, Florian Grünewald, Patrick Hasenauer

Bürgermeister-Ebert-Straße 5,
, 36124 Eichenzell,
, Germany

Phone: +49 6659 82-0
Email: info@wassermann-technologie.de

Contact Information for the Data Protection Officer

We have appointed an external data protection officer:

BerIsDa GmbH | Website: www.berisda.de

You can contact the Data Protection Officer by mail at WASSERMANN TECHNOLOGIE GMBH, Attn: Data Protection Officer, Bürgermeister-Ebert-Straße 5, 36124 Eichenzell, or by email at datenschutz@berisda.de.

I. General information on data processing

1. scope of the processing of personal data

The controller collects and uses personal data of its users (hereinafter also referred to as “data subject”, “person concerned” or “visitor”) only insofar as this is necessary to provide a functional website and to display the content and services. The collection and processing of users’ personal data for other purposes only takes place regularly with the user’s consent. An exception applies in cases where it is not possible to obtain prior consent for factual reasons, the processing is based on pre-contractual or contractual measures, the processing of the data is permitted by law and/or the controller has a legitimate interest in the processing.

Your personal data is generally collected directly from you, e.g. when you contact us, consent to services on this website or use forms on this website. In addition, technical data that is absolutely necessary for the operation of the site is automatically collected when you enter the site.

To the extent that the controller obtains the data subject’s consent for the processing of personal data, Article 6(1), first sentence, subparagraph (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data. If special categories of data pursuant to Article 9(1) of the GDPR are processed, Article 9(2)(a) of the GDPR serves as the legal basis. In the event of a transfer to a non-secure third country based on consent, the processing is carried out pursuant to Article 49(1), first sentence, subparagraph (a) of the GDPR. If you have consented to the storage of cookies or to access to information on your device, data processing is additionally based on Section 25(1) of the TDDDG.

When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1), first sentence, subparagraph (b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of precontractual measures. If the individual is the contact person for a (potential) business partner (customer, supplier, partner), the legal basis for (pre-)contractual measures is Article 6(1), first sentence, subparagraph (f) of the GDPR.

To the extent that the processing of personal data is necessary to fulfill a legal obligation to which the controller is subject, Article 6(1), first sentence, subparagraph (c) of the GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of the controller or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for the processing.

3. data erasure and duration of processing

If no specific retention period is specified in this privacy policy, the personal data of our website visitors will remain with us until the purpose for processing the data no longer applies. The data subject’s personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies, or if the data subject revokes their consent or objects to the processing. Data may also be retained if required by European or national legislation in EU regulations, laws, or other provisions to which the data controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

4. data transfer to a third country or an international organization

The European General Data Protection Regulation (GDPR) requires that the transfer of personal data that is already being processed or is to be processed after its transfer to a third country or an international organization is only permitted if a level of data protection comparable to the requirements of the GDPR is guaranteed. If it is therefore ensured that the provisions of the GDPR are complied with – for example, the existence of an adequacy decision by the EU Commission within the meaning of Art. 45 para. 1, 3 GDPR or the introduction of internal data protection regulations approved by a supervisory authority (so-called “appropriate safeguards”, Art. 46 para. 2, 3 GDPR). If there is no level of data protection comparable to the requirements of the GDPR, there may be risks associated with processing in a third country.

Risks of a transfer to a non-secure third country: Personal data could possibly be passed on by the provider to other third parties beyond the actual purpose of fulfilling the order, who could use the data for advertising purposes, for example. In addition, it is probably not possible to effectively enforce any data subject rights against the provider. There may be a higher probability that incorrect data processing may occur, as the provider’s technical and organizational measures for the protection of personal data do not fully meet the requirements of the GDPR in terms of quantity and quality. It is also possible for government agencies to access the personal data provided without the data subject being aware of this. In principle, this also corresponds to the European legal regulations, e.g. for the purpose of averting danger. However, the admissibility threshold for such data processing is higher in the European Union than in the country of the data recipient concerned. In summary, there is no level of data protection comparable to the requirements of the GDPR in non-secure third countries.

Among other things, we use tools on our website from providers whose headquarters or the headquarters of the parent company (or its affiliated companies) are located in a third country from a data protection perspective. We also transfer data to the USA. The transfer of data to the USA is permitted if the recipient is certified under the “EU-US Data Privacy Framework” (DPF) or has suitable additional guarantees. The DPF is an (individual) agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF program commits to complying with these data protection standards. You can find the list of certified companies at: https://www.dataprivacyframework.gov/list. There, you can search by provider name and view the certification directly. If data is transmitted to a provider that is certified in accordance with the DPF, a separate note is provided by the respective service provider.

In addition, our website also uses tools from other providers in third countries and U.S. providers that are not certified under the EU-U.S. Data Privacy Framework (DPF). The transfer and processing of personal data of data subjects in connection with these tools are carried out in accordance with the provisions of Article 49(1), sentence 1, subparagraph (a) of the GDPR—based on consent given by the data subject. If data is transferred on the basis of consent to a provider whose processing takes place in a non-secure third country, a separate notice will be provided by the respective service provider.

If data is transferred to a third country or an international organization, we will inform you of this through a separate notice regarding the specific processing activity in this Privacy Policy.

5. Recipients of Personal Data

Within our organization, access to your personal data is generally granted only to those positions and departments that require it in the course of our activities and for the purposes described in each case, and that are authorized to process this data.

As part of our service provision, we engage data processors who assist us in fulfilling our contractual obligations. We work with service providers, such as those offering IT maintenance services, video conferencing tools, or newsletter distribution (so-called data processors). These service providers act solely in accordance with our instructions and are contractually obligated to comply with applicable data protection requirements. To this end, we enter into written data processing agreements with these service providers. If specific data processors are used to process personal data, we will inform you of this through a separate notice regarding the respective processing in this Privacy Policy.

We may disclose personal data to courts, regulatory authorities, or law firms, to the extent that there is a legal obligation to do so under Article 6(1), first sentence, (c) of the GDPR, or where it is necessary under Article 6(1), first sentence, (f) of the GDPR to assert, exercise, or defense of legal claims, and there is no reason to believe that our data subjects have an overriding legitimate interest in preventing the disclosure of the data.

6. Requirement to Provide Personal Data

The provision of your personal data is not required by law or contract. There is no obligation to provide it. However, failure to provide it may mean that you are unable to use functions, services, forms and other processing on our website. We recommend that you only provide the personal data that is necessary, for example, to process your request, to carry out your desired offer and to use the functions we offer. If the provision of your personal data is required by law or contract, we will inform you of this by means of a separate note on the respective processing in this data protection information.

The collection of technical data (and possibly the collection of your IP address as a personal date) for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website and takes place automatically when you enter this website. If you do not wish to do so, you must leave this page.

II Rights of the data subject

If we process your personal data, you as the data subject have the following rights towards us as the controller:

1. Right of access, art. 15 GDPR

Within the framework of the applicable legal provisions, you have the right to (free) information about your collected and stored personal data at any time. This also includes information about the purposes of processing, its origin and recipients, the storage period and the existence of various rights.

2. Right to rectification, art. 16 GDPR

You have a right to rectification (also in the sense of completion) of your data vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete for the purpose of processing. The controller must make the correction without delay.

3. Right to erasure, art. 17 GDPR

As per the conditions of art. 17 GDPR, you can request deletion of your personal data at any time, unless there are circumstances that authorize or obligate the controller to continue processing your personal data (e.g. statutory retention periods).

4. Right to restriction of processing, art. 18 GDPR

If the legal requirements apply, you can demand restriction of processing of your personal data within the scope of art. 18 GDPR.

5. right to information, Art. 19 GDPR

If your personal data has been processed by recipients to whom the controller has disclosed the data, the controller is obliged to inform them of your requests for rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. You can request that the controller inform you about these recipients.

6. right to data portability, Art. 20 GDPR

If you have provided us with personal data and automated processing is carried out on the basis of your consent or on the basis of a contract, you have the right to transfer the data provided by you within the scope of Art. 20 GDPR, provided that this does not adversely affect the rights and freedoms of other persons. The data will be provided in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

7. right to object, Art. 21 GDPR

You have the right to object to the processing of your data at any time, provided that the processing is carried out on the basis of a balancing of interests. This is the case if the controller relies on the public interest or its legitimate interest for processing (see Art. 6 para. 1 sentence 1 lit. e and f). The prerequisite is that you assert reasons arising from your particular situation which outweigh the interests of the controller. The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Art. 21 para. 2 GDPR contains a special, deviating regulation if the personal data concerning you is used for direct marketing , in which case you have the right to object to the processing of personal data concerning you at any time without further requirements. The personal data concerning you will no longer be processed for the purpose of direct marketing. If profiling is associated with direct advertising, you can also object to this.

In connection with the use of information society services, you have the option of exercising your right to object by means of automated procedures that use technical specifications.

8. automated decision in individual cases, Art. 22 GDPR

In accordance with Art. 22 GDPR, you have the right that decisions which produce legal effects concerning you or similarly affect you are not based solely on automated processing, including profiling. Exceptions may exist if appropriate measures for the protection of your person are guaranteed and there are necessary contractual regulations or a legal provision or you have expressly consented.

You have the right to revoke your declaration of consent under data protection law at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation. You can send the revocation by e-mail or by post to the controller.

10. right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information. If you are in another federal state or not in Germany, you can also contact the data protection authority there.

III. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as the requests you send to us as the site operator. An encrypted connection can be recognized by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in the browser line. If SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

IV. External Hosting

1. Description and scope of data processing

This website is hosted by an external service provider (a so-called “host”). The personal data collected on this website is stored on the host’s servers. This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact information, names, page views, and other data generated through a website.

The legal basis for data processing is Article 6(1), first sentence, subparagraph (f) of the GDPR for the provision of the website.

3. purpose of data processing

We use a web hosting provider to ensure the secure, fast, and efficient delivery of our online services, as well as the reliable display and delivery of our website by a professional provider. These purposes constitute our legitimate interest.

4. duration of storage, possibility of objection and removal

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

The collection of data for the purpose of providing the website and the storage of that data in log files is absolutely necessary for the operation of the website. Consequently, users have no right to object.

5. Entering into a Data Processing Agreement

In connection with the data processing described above, our external hosting provider—compositum Multimedia-Agentur GmbH, Fulda—transfers and processes the data. We have entered into a data processing agreement with our hosting provider. This is a contract required under data protection law that ensures our hosting provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with data protection regulations (GDPR, BDSG, etc.).

V. Provision of the Website and Creation of Log Files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the system of the accessing device.

The following data is collected:

  1. Information about the browser type and version used
  2. The user’s operating system
  3. The user’s internet service provider
  4. The IP address of the user
  5. Date and time of access
  6. Websites from which the user’s system accesses our website
  7. Internet pages that are accessed by the user’s system via our website

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 sentence 1 lit. f GDPR.

3. purpose of data processing

Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

Storage in log files takes place to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

4. duration of storage, possibility of objection and removal

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

If the data is stored in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated so that it is no longer possible to assign them to the accessing end device.

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

VI. Use of Cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s system. When a user accesses our website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. In summary, these cookies are technically necessary for the operation of our website.

The following data is stored and transmitted in the cookies: language settings.

In principle, you can prevent or block the storage of cookies on your end device in your browser settings. To do this, you must call up the respective settings of your browser. You can also delete your stored cookie data in your browser settings.

The legal basis for the processing of personal data using technically necessary cookies is Article 6(1), first sentence, subparagraph (f) of the GDPR; cookies are stored on your device pursuant to Section 25(2), No. 2 of the TDDDG.

3. purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of the website for you. Some functions of our website cannot be offered without the use of cookies. For this, it is necessary that the browser is recognized even after a website change.

We need cookies for the following applications:

  1. Language Selection Controls

These purposes also constitute our legitimate interest in the processing of personal data in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. The user data collected by technically necessary cookies is not used to create user profiles.

4. duration of storage, possibility of objection and removal

Cookies are stored on the user’s computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

The cookies we use are stored for the following periods:

wp-wpml_current_language (language setting) – Duration: End of session

VII. Contact by Email and/or Phone

1. Description and scope of data processing

E-mail addresses and telephone numbers are provided on our website and in our signatures, which can be used to contact us electronically and/or by telephone. In this case, the personal data of the data subject transmitted with the e-mail will be stored. If you contact us by telephone, personal data may also be stored in order to process your request.

No data will be passed on to third parties in this context. The data will only be used to contact you and to conduct the conversation.

The legal basis for processing data transmitted via email or during a phone call is Article 6(1), first sentence, subparagraph (f) of the GDPR. If the purpose of the contact is to conclude a contract, the additional legal basis for the processing is Article 6(1), first sentence, subparagraph (b) of the GDPR; if the contact person is the point of contact for a (potential) business partner (customer, supplier, partner), the legal basis for (pre-)contractual measures is Article 6(1), first sentence, letter f of the GDPR.

3. purpose of data processing

The processing of personal data serves us solely to process the contact. This also constitutes the necessary legitimate interest in the processing of the data.

4. duration of storage, possibility of objection and removal

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data sent by e-mail or transmitted by telephone, this is the case when the respective conversation with the data subject has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. If a contract is concluded as a result of the contact, the corresponding (statutory) retention obligations and regulations apply.

If a data subject contacts us by e-mail or telephone, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.

VIII. Contact Form

1. Description and scope of data processing

Various contact forms are available on our website which you can use to contact us electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored.

Form: “Support and Service”

Required fields: First Name, Last Name, Email Address, Description of Your Inquiry

Optional fields: Information: Topic (select one), Phone, Company Name, Product Number, Product Name, File Upload, Newsletter Consent Checkbox

Forms: Service and Product Inquiries

Required fields: Name, Email Address

Optional information: Company, Phone Number, Quote Deadline, Required Date, Description of Request, File Upload, Checkbox for Newsletter Consent)

In addition, the following data is stored when the forms are used:

  1. User’s IP address
  2. Date and time of contact

This privacy policy is referenced during the submission process regarding the processing of data. The data is used exclusively for the purpose of handling the conversation.

Some of the forms allow you to subscribe to our newsletter. For more information about our newsletter , please see section X of this Privacy Policy : Newsletter: Subscription and Distribution.

The legal basis for processing the data submitted via the contact form is Article 6(1), first sentence, subparagraph (f) of the GDPR. If the purpose of the contact is to enter into a contract, the additional legal basis for the processing is Article 6(1), first sentence, subparagraph (b) of the GDPR; if the user is the contact person for a (potential) business partner (customer, supplier, partner), the legal basis for (pre-)contractual measures is Article 6(1), first sentence, letter f of the GDPR.

The legal basis for the processing of all other personal data processed during the sending process that is transmitted via the contact form is Art. 6 para. 1 sentence 1 lit. f GDPR.

The legal basis for processing the data, where the user has given consent, is Article 6(1), first sentence, subparagraph (a) and, where applicable, Article 49(1), first sentence, subparagraph (a) of the GDPR. The storage of your consent for evidentiary purposes and to defend against liability claims (e.g., the storage of your revocation) is based on Article 6(1), first sentence, subparagraph (f) of the GDPR. Your consent and your revocation are stored in order to be able to provide evidence of (previously) given consents, even after revocation, and thus to defend against any liability claims. These purposes constitute our legitimate interest.

3. purpose of data processing

We process the personal data entered in the contact form solely for the purpose of responding to your inquiry. The other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our IT systems. These purposes also constitute our legitimate interest.

4. duration of storage, right of objection, revocation and removal

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For the personal data from the input screen of the contact form, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

If a user contacts us via the form, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.

As a user, you have the right to revoke your consent under data protection law at any time. Revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of revocation. You may revoke the consents you have given at any time by mail or email. Your consent will be retained for three years after revocation or once the purpose no longer applies, for the purposes of providing evidence and defending against liability claims (Sections 195, 199 of the German Civil Code (BGB)).

IX. Online Application Form

1. Description and scope of data processing

The data controller collects and processes applicants’ personal data for the purpose of handling the application process. Processing may also take place electronically. This is particularly the case if you use our designated online form to submit your application to us. As part of your online application, we collect and process the following personal application data from you within the form:

  1. Your personal information (such as first name, last name, additional names, date of birth)
  2. Work permit / residence permit, if applicable
  3. Contact information (such as home address, (cell) phone number, email address),
  4. Skill Information (e.g., special knowledge and skills)
  5. if relevant to the position being advertised: medical fitness
  6. File Uploads (Documents, Cover Letter, Photo, Transcripts, Certificates)
  7. Additional information that you provide to us as part of the application process.

As a general rule, your personal data is collected directly from you as part of the hiring process, specifically from your application materials, the job interview, and the employee questionnaire.

We use the services of STELLEN-schalten.de to publish our job postings; the provider is COM1 KG, Hauptstraße 15, 36088 Hünfeld, Germany. We have entered into a data processing agreement with COM1 KG.

The processing of your data during the application process is based on Article 6(1), first sentence, letter b of the GDPR (or Section 26(1) of the BDSG (Article 88(1) of the GDPR)) for the purpose of establishing an employment relationship.

The legal basis for the processing of all other personal data processed during the sending process, which is transmitted via your online application, is Art. 6 para. 1 sentence 1 lit. f GDPR.

3. purpose of data processing

Your personal application data is collected and processed exclusively for the purpose of filling vacancies within our company. The primary purpose of data processing is therefore to establish an employment relationship with the controller.

Your data will only be forwarded to the internal departments and specialist departments of our company responsible for the specific application process.

The other personal data processed during the sending process serve to prevent misuse of the application form and to ensure the security of our information technology systems. Our legitimate interest also lies in these purposes.

4. duration of storage, possibility of objection and removal

If you are hired, we will add your application materials to your personnel file. After the employment relationship ends, we will continue to store those personal data that we are legally required to retain. This is generally due to legal obligations regarding documentation and retention, which are governed, among other things, by the German Commercial Code and the German Fiscal Code. Accordingly, the retention periods are up to ten years. In addition, personal data may be retained for the period during which claims can be asserted against us (statutory limitation period of three or up to thirty years).

If your application is rejected, your application materials will be deleted no later than 6 months after the application process is completed, unless you have given us your consent to retain them for a longer period (applicant pool).

X. Newsletter: Sign-up and Distribution

1. Description and scope of data processing

You can subscribe to a free newsletter on our website. When you register for the newsletter, the data from the input screen is transmitted to us.

  1. First Name, Last Name
  2. Email address
  3. Granting Consent (Checkbox)

The following data is also collected during registration:

  1. IP address of the calling computer
  2. Date and time of registration

Your consent is obtained for the processing of the data as part of the registration process and reference is made to this privacy policy.

The purpose of our newsletter is to send you product information that we believe will be of interest to you, to contact you to inform you about our products and services and to provide you with the latest developments and helpful information and to invite you to interesting events such as webinars or trade fairs.

The data will be used exclusively for sending the newsletter.

Double opt-in procedure

Registration for our newsletter is always carried out using a double opt-in procedure. After registering on our website, you will receive an e-mail asking you to confirm your subscription to our newsletter. This confirmation serves as proof that you have registered for our newsletter with your e-mail address.

Storage of your revocation

We may also store unsubscribed e-mail addresses on the basis of our legitimate interest in order to be able to prove a previously given consent even after unsubscribing from our newsletter.

The legal basis for processing data when subscribing to our newsletter is the user’s consent (via double opt-in) in accordance with Article 6(1), sentence 1, subparagraph (a) of the GDPR. The legal basis for carrying out the double opt-in procedure is Article 6(1), sentence 1, subparagraph (f) of the GDPR for the purpose of documenting and verifying your consent. The legal basis for storage for the purposes of providing evidence and defending against liability claims (storage of the revocation) is Article 6(1), sentence 1, subparagraph (f) of the GDPR. Your consent and your revocation are stored in order to be able to provide evidence of (previously) given consent, even after revocation, and thus to defend against any liability claims. These purposes constitute our legitimate interest.

The legal basis for the processing of all other personal data processed during the registration process, which is transmitted during registration for our newsletter, is Art. 6 para. 1 sentence 1 lit. f GDPR.

3. purpose of data processing

The purpose of collecting the user’s e-mail address is to deliver the newsletter. The collection of other personal data as part of the registration process serves to prevent misuse of the services or the e-mail address used.

The double opt-in procedure serves as proof and verification of your consent. The storage of your revocation takes place in order to be able to prove previously given consents even after revocation and thus to ward off any liability claims.

The other personal data processed during the submission process is used to prevent misuse of the newsletter sign-up and to ensure the security of our IT systems. These purposes also constitute our legitimate interest.

4. duration of storage, right of objection, revocation and removal

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. The user’s e-mail address is therefore stored for as long as the subscription to the newsletter is active.

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. You may submit your withdrawal either by mail or by email to the data controller.

We may also store unsubscribed e-mail addresses for up to three years on the basis of our legitimate interest in order to be able to prove a previously given consent even after unsubscribing.

The subscription to the newsletter can be canceled by the user concerned at any time. For this purpose, you will find a corresponding link in every newsletter. This also makes it possible to withdraw consent to the storage of personal data collected during the registration process.

XI. Social Media Wall: Taggbox

1. Description and Scope of Data Processing

This website integrates the social media pages (Instagram and Facebook) of the controller via the Taggbox service. Taggbox is a service of Social Scape Tech LLP, B-138 Main Queens Road, Rajasthan 302021, India. Taggbox is a social media aggregation tool that makes it possible to collect posts from several social media sites and integrate them on the website.

Taggbox is integrated as a plugin on the website. As soon as this is activated by your consent, a connection is established between your browser and the Taggbox servers and the servers of the social networks whose content has been integrated (here: Instagram and Facebook). We have no influence whatsoever on the type and scope of the data transmitted. There is a possibility that your IP address will be transmitted. If you are logged into your account with the respective social network while visiting our site, the information from your visit to our website can be linked to your account. If you interact with our posts (“like, share or comment”) while you are logged in, this will also be linked to your account. Furthermore, Taggbox can store various cookies on your end device. In this way, Taggbox and partners can obtain information about visitors to this website. If necessary, further data processing operations may be triggered after activation of the social media wall, over which we have no influence.

Upstream user action

If you have not consented to the processing of your data by Social Scape Tech LLP within Consent Management, the social media wall that is integrated on our site will not be displayed directly. You can also give your consent afterwards directly on the social media wall by means of an upstream action.

Use of a provider based in a third country

This means that personal data is also processed in a non-secure third country. India does not have a level of data protection comparable to that required by the GDPR. Your personal data may be disclosed by the provider to other third parties beyond the original purpose of fulfilling the order; these third parties may use the data, for example, for advertising purposes. For more information on transfers to a non-secure third country, please refer to this Privacy Policy under “I. General Information on Data Processing – 4. Data Transfers to a Third Country or an International Organization.”

The legal basis for processing the data is the user’s consent pursuant to Article 6(1), first sentence, subparagraph (a), and Article 49(1), first sentence, subparagraph (a) of the GDPR—as well as Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG.

3. Purpose of Data Processing

The use of Taggbox is in the interest of an appealing and clear presentation of our company and to simplify the presentation of our contributions.

4. Duration of Storage, Options for Withdrawal and Deletion

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Your consent is automatically reset when you close the website or end your session.

Further information about data protection at TAGGBOX can be found in their privacy policy at: https://taggbox.com/privacy-policy/

XII. Use of eTracker

1. Description and scope of data processing

We use the etracker analytics service on our website. The provider is etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, www.etracker.com.

Etracker allows us to analyze usage data for our website and our newsletter. To do this, Etracker collects, among other things, your truncated IP address, geographic information (at the city level at most), log files, and other information that your browser transmits to our web server when you visit the site. This enables us to measure user interactions, such as time spent on the site, conversions (e.g., sign-ups, orders), scroll events, clicks, and page views. For session tracking, etracker analytics does not store any data on users’ devices; instead, it assigns interactions to the respective visits purely on the server side using securely hashed session tokens. Reporting in etracker analytics is based on anonymized and primarily aggregated data.

For more information, please see etracker’s privacy policy: https://www.etracker.com/datenschutzerklaerung/

No cookies will be stored in your browser without your consent, nor will any information be read from your device’s storage. The cookie-free use of this analytics tool is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. The rights and fundamental freedoms of data subjects are safeguarded. The IP address is anonymized as early as possible during analysis with etracker, and visitor recognition is possible for no longer than the duration of the current day. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

The interactions that are tracked are associated with the site visitor for the duration of the current day, so that the visitor is recognized upon subsequent visits. Once the day has ended, visitor recognition is no longer possible.

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. You can withdraw the consent you have given via the consent management system.

You can disable etracker here:

4. Entering into a Data Processing Agreement

In connection with the data processing described above, our service provider—etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg—transfers and processes the data. We have entered into a data processing agreement with this provider. This is a contract required under data protection law that ensures that etracker processes the personal data of our website visitors only in accordance with our instructions and in compliance with data protection regulations (GDPR, BDSG, etc.).

XIII. YouTube in Enhanced Privacy Mode

1. Description and scope of data processing

This website integrates videos from the YouTube platform. YouTube is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is a subsidiary of Google LLC based in the USA.

We use YouTube in extended data protection mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, the transfer of data to YouTube partners is not necessarily excluded by the extended data protection mode. YouTube establishes a connection to the Google DoubleClick network regardless of whether you are watching a video. As soon as you start a YouTube video on this website, a connection to the YouTube servers is established. This tells the YouTube server which of our websites you have visited.

If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, YouTube may store various cookies on your end device after starting a video or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to record video statistics, improve user-friendliness and prevent fraud attempts. After the start of a YouTube video, further data processing operations may be triggered over which we have no influence.

Upstream user action

If you have not consented to the processing of your data by YouTube within Consent Management, the videos that are integrated on our site will not be played directly. You can also give your consent afterwards directly with the video by means of an upstream action.

Use of a provider based in a third country

The parent company, Google LLC, is certified under the “EU-U.S. Data Privacy Framework” (DPF). For more information about the DPF, please see this Privacy Policy under “I. General Information on Data Processing – 4. Data Transfers to a Third Country or an International Organization.”

The legal basis for processing the data is the user’s consent pursuant to Article 6(1), first sentence, subparagraph (a) of the GDPR—as well as Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG.

3. purpose of data processing

The use of YouTube is in the interest of an appealing and clear presentation of our online offers, products and services.

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal. Your consent is automatically reset at the end of the session or when you close your browser.

You can find more information about data protection at YouTube in their privacy policy at: https://policies.google.com/privacy?hl=de.

XIV. Using Calendly (Appointment Scheduling)

1. Description and scope of data processing

On our website, you can schedule appointments with us. We use the “Calendly” tool to schedule appointments. The provider is Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA (hereinafter “Calendly”).

To book an appointment, enter the requested data and the desired date in the form provided. The data entered will be used for the planning, execution and, if necessary, follow-up of the appointment. The appointment data is stored for us on the servers of Calendly, whose privacy policy you can view here: https://calendly.com/de/pages/privacy.

The provider is certified under the “EU-US Data Privacy Framework” (DPF). For more information on the DPF, please refer to this Privacy Policy under “I. General Information on Data Processing – 4. Data Transfer to a Third Country or an International Organization.” For more information about the provider’s DPF, please visit the following link: https://www.dataprivacyframework.gov/list .

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. The website operator has a legitimate interest in making it as easy as possible to arrange appointments with interested parties and customers. If the appointment booking is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

For the technical use on the site, a corresponding consent is requested via the consent management, this processing is carried out exclusively on the basis of Art. 6 para. 1 sentence 1 lit. a and § 25 para. 1 sentence 1TTDSG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TTDSG.

3. purpose of data processing

The data are processed for the purposes of planning and managing appointment bookings from our customers and interested parties.

4. duration of storage, possibility of objection and removal

The data you enter will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Mandatory statutory provisions – in particular retention periods – remain unaffected.

You have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You can send your revocation either by post or by e-mail to the controller.