Privacy policy

Last updated on
3 April 2023
Built by Tejus K

With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both as part of the provision of our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offer").

The terms used are not gender-specific.


Stand: 3. April 2023

Table of Contents


Responsible

JustScale GmbH
Römlinghovener Str. 77
53639 Königswinter

Authorized Representatives:

Nina Lastowiecki-Limbach and Daniel Kort

Email Address:

[email protected]

Phone:

022237878870

Overview of Processing

The following overview summarizes the types of processed data and the purposes of their processing and refers to the data subjects.


Types of Processed Data

  • Inventory Data
  • Payment Data
  • Location Data
  • Contact Data
  • Content Data
  • Contract Data
  • Usage Data
  • Meta, Communication, and Procedural Data

Categories of Data Subjects

  • Customers
  • Interested Parties
  • Communication Partners
  • Users
  • Business and Contract Partners

Purposes of Processing

  • Provision of Contractual Services and Customer Service
  • Contact Requests and Communication
  • Security Measures
  • Direct Marketing
  • Range Measurement
  • Tracking
  • Office and Organizational Procedures
  • Administration and Response to Inquiries
  • Feedback
  • Marketing
  • Profiles with User-Related Information
  • Provision of our Online Offer and User-Friendliness
  • Information Technology Infrastructure

Relevant Legal Bases


The following is an overview of the legal basis of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.


  • Consent (Art. 6 (1) p. 1 lit. a) GDPR) – The data subject has given his/her consent to the processing of personal data relating to him/her for a specific purpose or purposes.

  • Performance of a Contract and Pre-Contractual Requests (Art. 6 (1) p. 1 lit. b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures carried out at the data subject's request.

  • Legal Obligation (Art. 6 (1) p. 1 lit. c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.

  • Legitimate Interests (Art. 6 (1) p. 1 lit. f) GDPR) – Processing is necessary for the purposes of the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. These include, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for employment purposes (Section 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.

Security Measures


We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.


The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, assurance of availability of and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data compromise. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software as well as procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

Transfer of Personal Data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.


Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, entities or companies, this will only be done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of data

The data processed by us will be deleted in accordance with the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g. if the purpose of processing this data has ceased to apply or it is not necessary for the purpose). If the data are not deleted because they are required for other and legally permissible purposes, their processing will be limited to these purposes. That is, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.

Our data protection notices may also contain further details on the retention and deletion of data, which have priority for the respective processing operations.

Use of Cookies

Cookies are small text files or other memory notes that store information on end devices and read information from end devices. For example, to store the login status in a user account, the content of a shopping cart in an e-shop, the accessed content, or the functions used of an online offer. Cookies can also be used for different purposes, such as for the functionality, security, and comfort of online offers as well as for the creation of analyses of visitor flows.

Notes on consent: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users unless it is not required by law. Consent is not particularly necessary if the storage and reading of information, including cookies, are absolutely necessary to provide a telemedia service expressly requested by the users (i.e., our online offer). Necessary cookies usually include those that serve functions related to the display and operability of the online offer, load balancing, security, storage of user preferences and choices, or similar purposes related to the provision of the main and ancillary functions of the online offer requested by the users. The revocable consent is clearly communicated to the users and contains the information on the respective cookie use.

Notes on legal data protection bases: The legal basis on which we process users' personal data using cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is the declared consent. Otherwise, the data processed using cookies is based on our legitimate interests (e.g., the economic operation of our online offer and improvement of its usability) or, if necessary, for the fulfillment of our contractual obligations when the use of cookies is required to fulfill our contractual obligations. We clarify for which purposes the cookies are processed by us in the course of this data protection declaration or as part of our consent and processing procedures.

Storage duration: The following types of cookies are distinguished regarding the storage duration:

  • Temporary cookies (also: session or session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed their end device (e.g., browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device has been closed. For example, the login status can be stored or preferred content can be displayed directly when the user visits a website again. Likewise, the data collected with the help of cookies can be used to measure the reach of the users. Unless we provide users with explicit information about the type and storage duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are permanent and the storage duration can be up to two years.

General information on revocation and objection (Opt-Out): Users can revoke their given consents at any time and object to the processing in accordance with the legal requirements under Art. 21 GDPR. Users can also declare their objection via the settings of their browser, e.g., by deactivating the use of cookies (which can also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

  • Legal bases: Consent (Art. 6 (1) p. 1 lit. a) GDPR).

Further information on processing processes, procedures, and services:

  • Processing of cookie data based on consent: We use a cookie consent management procedure within which the users' consents to the use of cookies, or the processing mentioned within the framework of the cookie consent management procedure and providers, can be obtained, managed, and revoked by the users. In this process, the consent declaration is stored to avoid having to repeat its request and to be able to prove the consent in accordance with the legal obligation. The storage can be server-side and/or in a cookie (so-called opt-in cookie or using comparable technologies) to be able to assign the consent to a user or their device. Unless individual information about the providers of cookie management services is specified, the following information applies: The duration of the storage of the consent can be up to two years. A pseudonymous user identifier is created and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), and the browser, system, and end device used; Legal bases: Consent (Art. 6 (1) p. 1 lit. a) GDPR).

Business Services

We process data from our contractual and business partners, e.g., customers and interested parties (collectively referred to as “contractual partners”), within the framework of contractual and similar legal relationships, as well as associated measures and within the framework of communication with the contractual partners (or pre-contractual), e.g., to answer inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed services, any updating obligations, and remedies for warranty and other performance disruptions. Additionally, we process the data to safeguard our rights and for administrative tasks associated with these obligations, as well as business organization. Furthermore, we process the data based on our legitimate interests in proper and economic business management and security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information, and rights (e.g., involvement of telecommunications, transport, and other auxiliary services, as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). We only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about other forms of processing, e.g., for marketing purposes, within the framework of this data protection declaration.

We inform the contractual partners about which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete the data after the expiration of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal archiving reasons. The statutory retention period for tax-relevant documents as well as commercial books, inventories, opening balances, annual financial statements, the instructions required to understand these documents, and other organizational documents and booking receipts is ten years, and for received commercial and business letters and copies of sent commercial and business letters, six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance, the annual financial statement, or the management report was prepared, the commercial or business letter was received or sent, or the booking receipt was created, furthermore, the recording was made, or the other documents were created.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

  • Processed data types: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email, phone numbers); contract data (e.g., contract subject, duration, customer category).
  • Affected persons: Interested parties; business and contractual partners.
  • Purposes of processing: Provision of contractual services and customer service; contact inquiries and communication; office and organizational procedures; administration and response to inquiries.
  • Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 (1) p. 1 lit. b) GDPR); legal obligation (Art. 6 (1) p. 1 lit. c) GDPR); legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Provision of the Online Offer and Web Hosting

We process the data of the users to be able to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to deliver the content and functions of our online services to the user's browser or end device.

  • Processed data types: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
  • Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Further information on processing processes, procedures, and services:

  • Collection of access data and log files: Access to our online offer is logged in the form of so-called “server log files.” Server log files can include the address and name of the accessed websites and files, date and time of access, transferred data volumes, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), and usually IP addresses and the requesting provider. Server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, known as DDoS attacks) and to ensure the stability and capacity of the servers; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Deletion of data: Log file information is stored for a maximum duration of 30 days and then deleted or anonymized. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident is finally resolved.

Blogs and Publication Media

We use blogs or similar means of online communication and publication (hereinafter referred to as “publication medium”). The data of the readers is processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the framework of these data protection notices.

  • Processed data types: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; feedback (e.g., collecting feedback via online form); provision of our online offer and user-friendliness; security measures; administration and response to inquiries.
  • Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Further information on processing processes, procedures, and services:

  • Comments and contributions: When users leave comments or other contributions, their IP addresses may be stored based on our legitimate interests. This is done for our security in case someone leaves illegal content in comments and contributions (insults, prohibited political propaganda, etc.). In this case, we can be held liable for the comment or contribution and are therefore interested in the identity of the author. Furthermore, we reserve the right to process the information provided by users for spam detection based on our legitimate interests.

    On the same legal basis, we reserve the right, in the case of surveys, to store the IP addresses of users for the duration of the surveys and to use cookies to avoid multiple votes.

    The information provided in the context of the comments and contributions about the person, any contact and website information as well as the content details will be permanently stored by us until the users object; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Contact and Request Management

When contacting us (e.g., by mail, contact form, email, phone, or via social media) and within the framework of existing user and business relationships, the information provided by the requesting persons is processed as far as necessary to respond to the contact inquiries and any requested measures.

  • Processed data types: Contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status).
  • Affected persons: Communication partners.
  • Purposes of processing: Contact inquiries and communication; administration and response to inquiries; feedback (e.g., collecting feedback via online form); provision of our online offer and user-friendliness.
  • Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Newsletters and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter referred to as "newsletters") only with the consent of the recipients or a legal permission. If the contents of the newsletter are specifically described during the registration, they are decisive for the users' consent. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal address in the newsletter or further information if these are necessary for the purposes of the newsletter.

Double-Opt-In Procedure: The registration for our newsletter is generally carried out in a so-called double-opt-in procedure. This means you will receive an email after registration in which you are asked to confirm your registration. This confirmation is necessary so that no one can register with external email addresses. The registrations for the newsletter are logged to be able to prove the registration process in accordance with the legal requirements. This includes storing the registration and confirmation time as well as the IP address. Changes to your data stored with the email service provider are also logged.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them to prove that consent was previously given. The processing of this data is limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blacklist (so-called "blocklist").

The logging of the registration process is based on our legitimate interests for the purposes of proving its proper implementation. If we commission a service provider to send emails, this is done based on our legitimate interests in an efficient and secure sending system.

Contents:

Information about us, our services, promotions, and offers.

  • Processed data types: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status); usage data (e.g., visited websites, interest in content, access times).
  • Affected persons: Communication partners.
  • Purposes of processing: Direct marketing (e.g., via email or mail).
  • Legal bases: Consent (Art. 6 (1) p. 1 lit. a) GDPR).
  • Opt-Out: You can cancel the receipt of our newsletter at any time, i.e., revoke your consents or object to further receipt. You will find a link to cancel the newsletter at the end of each newsletter or you can use one of the above-mentioned contact options, preferably email.

Further information on processing processes, procedures, and services:

  • Measurement of open and click rates: The newsletters contain a so-called "web-beacon", i.e., a pixel-sized file that is retrieved from our server or, if we use a dispatch service provider, from their server when the newsletter is opened. Within the framework of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is first collected. This information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. This information is assigned to the individual newsletter recipients and stored in their profiles until they are deleted. The evaluations help us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

    The measurement of open rates and click rates as well as storage of the measurement results in the profiles of the users – This text area must be unlocked with a premium license.  Legal bases: Consent (Art. 6 (1) p. 1 lit. a) GDPR).

Advertising Communication via Email, Mail, Fax, or Phone

We process personal data for the purposes of advertising communication, which may take place via various channels, such as email, phone, mail, or fax, in accordance with legal requirements.

Recipients have the right to revoke given consents at any time or to object to advertising communication at any time.

After revocation or objection, we store the data required to prove previous authorization to contact or send for up to three years after the end of the year of revocation or objection based on our legitimate interests. The processing of this data is limited to the purpose of a possible defense against claims. Based on the legitimate interest in permanently observing the users' revocation or objection, we further store the data required to avoid renewed contact (e.g., depending on the communication channel, the email address, phone number, name).

  • Processed data types: Inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers).
  • Affected persons: Communication partners.
  • Purposes of processing: Direct marketing (e.g., via email or mail).
  • Legal bases: Consent (Art. 6 (1) p. 1 lit. a) GDPR); legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Web Analysis, Monitoring, and Optimization

Web analysis (also referred to as "reach measurement") is used to evaluate the visitor flows of our online offer and can include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize when our online offer or its functions or content are used most frequently or invite reuse. We can also identify which areas need optimization.

In addition to web analysis, we may also use testing procedures to test and optimize different versions of our online offer or its components.

Unless otherwise stated below, profiles, i.e., data summarized for a usage process, may be created and information stored in a browser or an end device and read from it for these purposes. The information collected includes, in particular, visited websites and used elements, as well as technical information, such as the browser used, the computer system used, and information about usage times. If users have consented to the collection of their location data to us or the providers of the services we use, location data may also be processed.

IP addresses of users are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. Generally, clear data of users (such as email addresses or names) are not stored within the framework of web analysis, A/B testing, and optimization, but pseudonyms. This means that we and the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the respective procedures.

  • Processed data types: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); profiles with user-related information (creating user profiles); tracking (e.g., interest/behavior-based profiling, use of cookies); provision of our online offer and user-friendliness.
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: Consent (Art. 6 (1) p. 1 lit. a) GDPR).

Further information on processing processes, procedures, and services:

Online Marketing

We process personal data for the purposes of online marketing, which may include the marketing of advertising spaces or the display of advertising and other content (collectively referred to as “content”) based on the potential interests of users and the measurement of their effectiveness.

For these purposes, user profiles are created and stored in a file (so-called “cookie”) or similar procedures are used, in which the relevant information for the display of the aforementioned content is stored about the user. This information may include, for example, viewed content, visited websites, used online networks, but also communication partners and technical information, such as the browser used, the computer system used, and information about usage times and used functions. If users have consented to the collection of their location data, this may also be processed.

IP addresses of users are also stored. However, we use available IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. Generally, clear data of users (such as email addresses or names) are not stored within the framework of online marketing procedures, but pseudonyms. This means that we and the providers of the online marketing procedures do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or by similar procedures. These cookies can generally be read later on other websites that use the same online marketing procedure, analyzed for the purpose of displaying content, and supplemented with further data and stored on the server of the online marketing procedure provider.

Exceptionally, clear data may be assigned to the profiles. This is the case if the users, for example, are members of a social network whose online marketing procedures we use and the network connects the profiles of the users with the aforementioned information. We ask you to note that users can make additional agreements with the providers, e.g., by consenting within the framework of the registration.

We generally only have access to aggregated information about the success of our advertisements. However, within the framework of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, to a contract conclusion with us. The conversion measurement is solely used to analyze the success of our marketing measures.

Unless otherwise stated, please assume that the used cookies are stored for a period of two years.

  • Processed data types: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); tracking (e.g., interest/behavior-based profiling, use of cookies); marketing; profiles with user-related information (creating user profiles).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Opt-out option: We refer to the data protection notices of the respective providers and the opt-out options provided by the providers (so-called “opt-out”). If no explicit opt-out option has been specified, you have the option of disabling cookies in your browser settings. However, this may limit the functions of our online offer. We therefore additionally recommend the following opt-out options, which are offered for respective areas: a) Europe: https://www.youronlinechoices.eu.
    b) Canada: https://www.youradchoices.ca/choices.
    c) USA: https://www.aboutads.info/choices.
    d) Cross-regional: https://optout.aboutads.info.

Customer Reviews and Rating Procedures

We participate in review and rating procedures to evaluate, optimize, and promote our services. If users rate us via the participating rating platforms or procedures or provide feedback in other ways, the general terms and conditions or usage conditions and the data protection notices of the providers also apply. As a rule, the rating also requires registration with the respective providers.

To ensure that the persons providing reviews have actually used our services, we transmit the necessary data regarding the customer and the service used to the respective rating platform (including name, email address, and order number or item number) with the customer's consent. This data is used solely to verify the authenticity of the user.

  • Processed data types: Contract data (e.g., contract subject, duration, customer category); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status).
  • Affected persons: Customers; users (e.g., website visitors, users of online services).
  • Purposes of processing: Feedback (e.g., collecting feedback via online form); marketing.
  • Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Social Media Presence


We maintain online presences within social networks and process user data in this context to communicate with the users active there or to offer information about us.


We point out that user data may be processed outside the area of the European Union. This can result in risks for users because, for example, it could make it more difficult to enforce the rights of users.


Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, user profiles can be created based on the usage behavior and resulting interests of users. The usage profiles can, in turn, be used to display advertisements inside and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behavior and interests of the users are stored. Furthermore, data can also be stored in the usage profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).


For a detailed description of the respective forms of processing and the opt-out options, we refer to the data protection declarations and information of the operators of the respective networks.


Also, in the case of requests for information and the assertion of data subject rights, we point out that these can be most effectively asserted with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, you can contact us.


  • Processed data types: Contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Contact inquiries and communication; feedback (e.g., collecting feedback via online form); marketing.
  • Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Further information on processing processes, procedures, and services:


  • Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
  • Facebook Pages: Profiles within the social network Facebook – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (so-called “fan page”). This data includes information about the types of content that users view or interact with or the actions they take (see “Things done and provided by you and others” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by the users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see “Device information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, known as “Page Insights,” to page operators to give them insights into how people interact with their pages and the content associated with them. We have entered into a special agreement with Facebook (“Page Insights Information,” https://www.facebook.com/legal/terms/page_controller_addendum), which specifically sets out which security measures Facebook must observe and in which Facebook has agreed to fulfill the rights of data subjects (i.e., users can, for example, direct requests for information or deletion directly to Facebook). The rights of users (in particular, to information, deletion, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Page Insights Information” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (ensuring data protection level for processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: Joint responsibility agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. Joint responsibility is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, particularly concerning the transmission of the data to the parent company Meta Platforms, Inc. in the USA (based on the standard contractual clauses agreed between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Data processing agreement: https://legal.linkedin.com/dpa; Standard contractual clauses (ensuring data protection level for processing in third countries): https://legal.linkedin.com/dpa; Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
  • Twitter: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, parent company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Privacy policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
  • Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Website: https://www.xing.de; Privacy policy: https://privacy.xing.com/en/privacy-policy.

Plugins and Embedded Functions as well as Content


We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include, for example, graphics, videos, or city maps (hereinafter uniformly referred to as "content").


The integration always requires that the third-party providers of this content process the users' IP addresses, as they could not send the content to their browsers without the IP address. The IP address is therefore necessary for the presentation of this content or functions. We strive to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the users' devices and may include technical information about the browser and operating system, referring websites, visit times, and other details about the use of our online offer, as well as being linked to such information from other sources.


  • Processed data types: Usage data (e.g., visited websites, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time details, identification numbers, consent status); inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); location data (information about the geographical position of a device or person).

  • Affected persons: Users (e.g., website visitors, users of online services).

  • Purposes of processing: Provision of our online offer and user-friendliness.

  • Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR).

Further information on processing processes, procedures, and services:


  • Google Fonts (retrieval from Google server): Retrieval of fonts (and symbols) for the purpose of a technically secure, maintenance-free, and efficient use of fonts and symbols regarding up-to-dateness and loading times, their uniform presentation, and consideration of possible licensing restrictions. The provider of the fonts is informed of the user's IP address so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, used hardware) is transmitted, which is necessary for the provision of the fonts depending on the used devices and the technical environment. This data may be processed on a server of the font provider in the USA – When visiting our online offer, the browsers of the users send their browser HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving the fonts). The Google Fonts Web API provides the users with the cascading style sheets (CSS) of Google Fonts and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the Internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the User-Agent that describes the browser and operating system versions of the website visitors, as well as the referring URL (i.e., the website where the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, User-Agent, and referring URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how often a particular font family is requested. The User-Agent must adjust the font generated for the respective browser type. The User-Agent is primarily logged and used to generate aggregated usage statistics to measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts "Analytics" page. Finally, the referring URL is logged so that the data can be used for production maintenance, and an aggregated report on the top integrations based on the number of font requests can be generated. According to Google's own information, none of the information collected by Google Fonts is used to create profiles of end users or to display targeted advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Further information: https://developers.google.com/fonts/faq/privacy?hl=en.

  • Google Maps: We integrate the maps of the service "Google Maps" provided by Google. The processed data may include, in particular, IP addresses and location data of the users; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy.

  • YouTube Videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=en, settings for the display of advertisements: https://adssettings.google.com/authenticated.

Changes and Updates to the Privacy Policy


We ask you to regularly inform yourself about the content of our privacy policy. We will adapt the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or other individual notification becomes necessary.


If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time, and we ask you to check the information before contacting us.

Rights of Data Subjects


As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:


  • Right to object: You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

  • Right to withdraw consent: You have the right to withdraw consent given at any time.

  • Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to request information about this data as well as further information and a copy of the data in accordance with legal requirements.

  • Right to rectification: You have the right, in accordance with legal requirements, to request the completion of data concerning you or the rectification of inaccurate data concerning you.

  • Right to erasure and restriction of processing: You have the right, in accordance with legal requirements, to request that data concerning you be deleted immediately or, alternatively, to request a restriction of the processing of the data in accordance with legal requirements.

  • Right to data portability: You have the right to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format in accordance with legal requirements, or to request that it be transmitted to another controller.

  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the requirements of the GDPR.