Privacy Policy

Effective Date: June 25, 2025

Table of Contents

• Data Controller
• Overview of Data Processing
• Applicable Legal Bases
• Security Measures
• Disclosure of Personal Data
• International Data Transfers
• General Information on Data Retention and Deletion
• Rights of Data Subjects
• Business Services
• Provision of Online Services and Web Hosting
• Use of Cookies
• Contact and Inquiry Management
• Marketing Communications via Email, Post, Fax, or Telephone
• Web Analytics, Monitoring, and Optimization
• Social Media Presence
• Plugins and Embedded Content

Data Controller

André Nitz / André Nitz Consulting
Rostocker Straße 2
31089 Duingen, Germany

Email: andre.nitz97@gmail.com

Phone: +49 176 55100383

Legal Notice: https://andre-nitz-consulting.de/impressum-de/

Overview of Data Processing

The following section provides an overview of the types of personal data processed, the purposes for processing, and the categories of data subjects affected.

Types of Data Processed

• Master data
• Payment data
• Location data
• Contact details
• Content data
• Contractual data
• Usage data
• Meta, communication, and procedural data
• Log data

Categories of Data Subjects

• Service recipients and clients
• Prospective clients
• Communication partners
• Users
• Business and contractual partners

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations
• Communication
• Security measures
• Direct marketing
• Audience measurement
• Office and organizational procedures
• Operational and administrative procedures
• Feedback
• Marketing
• User profile creation
• Provision of our online services and ensuring user-friendliness
• Information technology infrastructure
• Public relations
• Sales promotion
• Business processes and economic procedures

Applicable Legal Bases

Legal bases under the GDPR: The following provides an overview of the legal grounds under the General Data Protection Regulation (GDPR) on which we base the processing of personal data. Please note that, in addition to the GDPR, national data protection regulations may also apply in your or our country of residence or establishment. If more specific legal bases apply in individual cases, we will inform you in this Privacy Policy.

• Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) – The data subject has given their consent to the processing of personal data concerning them for a specific purpose or for several specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests or fundamental rights and freedoms of the data subject which require protection of personal data do not override those interests.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection provisions apply in Germany. This includes in particular the Act to Protect Against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, the processing for other purposes, and the transfer as well as automated individual decision-making including profiling. In addition, data protection laws of the individual German federal states may apply.

Notice on the applicability of the GDPR and the Swiss FADP: This privacy notice serves both to provide information under the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). For this reason, please note that the terminology of the GDPR is used due to its broader territorial scope and comprehensibility. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “sensitive personal data” used in the Swiss FADP, the terms “processing” of “personal data,” “legitimate interest,” and “special categories of data” as used in the GDPR are applied. However, the legal meaning of the terms continues to be determined in accordance with the Swiss FADP, where applicable.

Security Measures

We take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with the statutory provisions, taking into account the state of the art, the implementation costs, and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as the access, input, transfer, securing of availability, and separation of the data. Furthermore, we have implemented procedures to ensure the exercise of data subject rights, the deletion of data, and responses to data security risks. We also take the protection of personal data into account as early as during the development or selection of hardware, software, and processes, in accordance with the principle of data protection through technology design and through privacy-friendly default settings.

Disclosure of Personal Data

As part of our processing of personal data, it may occur that such data is transferred to, or disclosed to, other entities, companies, legally independent organisational units, or individuals. Recipients of this data may include, for example, service providers tasked with IT duties or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and in particular enter into the appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International Data Transfers

Data processing in third countries: In the event that we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or this occurs in the context of using third-party services or disclosing or transferring data to other individuals, entities or companies (which can be identified by the provider’s mailing address or if this Privacy Policy explicitly refers to data transfers to third countries), such processing is always carried out in accordance with legal requirements.

For data transfers to the United States, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the European Commission dated 10 July 2023. In addition, we have concluded Standard Contractual Clauses (SCCs) with the respective providers, which conform to the requirements set forth by the European Commission and establish contractual obligations for the protection of your data.

This dual safeguard ensures comprehensive protection of your data: the DPF serves as the primary level of protection, while the Standard Contractual Clauses provide an additional layer of security. Should changes arise within the scope of the DPF, the Standard Contractual Clauses will apply as a reliable fallback mechanism. In this way, we ensure that your data remains adequately protected even in the face of potential political or legal developments.

For each individual service provider, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. Further information about the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (available in English).

For data transfers to other third countries, appropriate safeguards apply accordingly, in particular Standard Contractual Clauses, explicit consents, or legally required transfers. Information regarding third-country transfers and applicable adequacy decisions can be found via the information portal of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General Information on Data Retention and Deletion

We delete personal data that we process in accordance with legal requirements as soon as the underlying consent is withdrawn or there is no further legal basis for processing. This applies in cases where the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule exist where statutory obligations or particular interests require a longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for the pursuit of legal claims or the protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices include additional information on the retention and deletion of data, specifically applicable to certain processing activities.

Where multiple retention or deletion periods are specified for a data item, the longest period shall always prevail. Data that is no longer required for the originally intended purpose but is retained due to legal requirements or other reasons will be processed solely for the purposes justifying its retention.

Retention and deletion of data: The following general retention periods apply to storage and archiving under German law:

• 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as work instructions and other organisational documents necessary for understanding these (§ 147 para. 1 no. 1 in conjunction with para. 3 AO, § 14b para. 1 UStG, § 257 para. 1 no. 1 in conjunction with para. 4 HGB).
• 8 years – Accounting documents, such as invoices and cost receipts (§ 147 para. 1 no. 4 and 4a in conjunction with para. 3 sentence 1 AO, and § 257 para. 1 no. 4 in conjunction with para. 4 HGB).
• 6 years – Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents relevant for taxation, such as hourly wage sheets, internal cost allocation records, calculation documents, pricing information, and also payroll records not classified as accounting documents, as well as cash register strips (§ 147 para. 1 no. 2, 3, 5 in conjunction with para. 3 AO, § 257 para. 1 no. 2 and 3 in conjunction with para. 4 HGB).
• 3 years – Data required to consider potential warranty and damage claims or similar contractual claims and rights, and to handle related inquiries, based on past business experience and common industry practices, is stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the General Data Protection Regulation (GDPR), particularly as outlined in Articles 15 to 21 GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out pursuant to Article 6(1)(e) or (f) GDPR; this also applies to any profiling based on those provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of such data for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw your consent at any time with effect for the future.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about such data, as well as additional information and a copy of the data, in accordance with the statutory requirements.
• Right to rectification: You have the right, in accordance with the statutory requirements, to request the completion of data concerning you or the correction of inaccurate data concerning you.
• Right to erasure and restriction of processing: You have the right, in accordance with the statutory requirements, to request the immediate deletion of data concerning you, or alternatively, to request a restriction of the processing of the data in accordance with the legal provisions.
• Right to data portability: You have the right to receive the data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, or to request its transmission to another controller, in accordance with the statutory requirements.
• Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of personal data relating to you violates the provisions of the GDPR.

Business Services

We process data of our contractual and business partners, such as customers and prospective clients (collectively referred to as "contractual partners"), within the framework of contractual or similar legal relationships and associated measures, as well as for communication with the contractual partners (including pre-contractual), for example in order to respond to inquiries.

We use this data to fulfill our contractual obligations. This includes, in particular, the obligation to provide the agreed services, any necessary updates, and remedies in the event of warranty or other service-related issues. Furthermore, we use the data to assert our rights and for administrative tasks related to these obligations, as well as for business organisation purposes. We also process the data based on our legitimate interest in proper and efficient business operations, and in implementing security measures to protect our contractual partners and our business operations from misuse, data risks, breaches of confidentiality, and infringement of rights (e.g. by involving telecommunications, transport, or other auxiliary services, subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities).

Within the scope of applicable law, we disclose the data of contractual partners to third parties only to the extent necessary for the aforementioned purposes or for fulfilling legal obligations. Any additional forms of data processing, such as for marketing purposes, will be explicitly explained to the contractual partners within this privacy policy.

We inform contractual partners in advance or during the data collection process about which data is required for the aforementioned purposes, for example through online forms, by specific markings (e.g., colors) or symbols (e.g., asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after four years, unless the data is stored in a customer account, for example because it must be retained for statutory archiving purposes (e.g., for tax purposes, usually ten years). Data disclosed to us by contractual partners in the course of an assignment will be deleted in accordance with contractual and legal requirements, and generally after the end of the assignment.

• Types of data processed: Master data (e.g., full name, residential address, contact details, customer number, etc.); Payment data (e.g., bank account details, invoices, payment history); Contact data (e.g., postal and email addresses or telephone numbers); Contract data (e.g., subject matter of the contract, term, customer category).
• Categories of data subjects: Service recipients and clients; Prospective clients; Business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Communication; Office and organisational procedures; Operational and administrative processes; Business processes and economic procedures.
• Retention and deletion: Deletion in accordance with the details provided in the section "General Information on Data Retention and Deletion."
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Provision of Online Services and Web Hosting

We process user data in order to provide our online services. For this purpose, we process the user's IP address, which is necessary to deliver the content and functions of our online services to the user's browser or device.

• Types of data processed: Usage data (e.g., page views and duration of visits, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions); Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, involved individuals); Log data (e.g., log files relating to logins or access to data or access times); Content data (e.g., textual or visual messages and posts, and related information such as authorship or creation timestamps).
• Categories of data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of IT systems and technical devices such as computers, servers, etc.); Security measures.
• Retention and deletion: Deletion in accordance with the details provided in the section "General Information on Data Retention and Deletion."
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Additional information on processing activities, procedures, and services:

• Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files." These may include the address and name of accessed web pages and files, date and time of access, data volumes transmitted, confirmation of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, for example, to prevent server overload (especially in cases of abusive attacks such as DDoS attacks), and also to ensure the stability and performance of the servers. Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data required for evidence purposes is excluded from deletion until the respective incident has been conclusively resolved.
• Email dispatch and hosting: The web hosting services we use also include sending, receiving, and storing emails. For these purposes, the addresses of senders and recipients, as well as further information regarding the email communication (e.g., involved providers), and the content of the respective emails are processed. The aforementioned data may also be processed for the purpose of SPAM detection. Please note that emails on the internet are generally not encrypted. While emails are usually encrypted during transmission, they are not encrypted on the servers from which they are sent and received, unless so-called end-to-end encryption is used. We therefore cannot assume responsibility for the transmission path of emails between the sender and reception on our server. Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Use of Cookies

The term “cookies” refers to functions that store information on users’ end devices and retrieve such information from them. Cookies may be used for various purposes, including ensuring the functionality, security, and convenience of online offerings, as well as for analyzing visitor traffic. We use cookies in accordance with legal regulations. Where required, we obtain prior consent from users. If consent is not necessary, we rely on our legitimate interests. This applies when the storage and retrieval of information is essential in order to provide content and functions explicitly requested by users. This includes, for example, storing settings and ensuring the functionality and security of our online offering. Consent may be revoked at any time. We provide clear information about the scope of use and which cookies are used.

Notes on data protection legal bases: Whether we process personal data using cookies depends on the presence of user consent. If consent is given, it serves as the legal basis. In the absence of consent, we rely on our legitimate interests, as described in this section and in the context of the respective services and processes.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved and preferred content can be displayed directly when the user revisits a website. Likewise, user data collected with the help of cookies may be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g. during the consent process), users should assume that these are permanent and may be stored for up to two years.

General information on withdrawal and objection (opt-out): Users can withdraw any consent they have given at any time and may also object to processing in accordance with legal requirements, including by adjusting the privacy settings in their browser.

• Types of data processed: Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, parties involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Additional information on processing activities, procedures and services:

• Processing of cookie data based on consent: We use a consent management solution to obtain user consent for the use of cookies or for the procedures and providers specified in the context of the consent management solution. This procedure is used to collect, log, manage and revoke consent, in particular relating to the use of cookies and similar technologies that are used to store, retrieve and process information on users' end devices. Within this procedure, users' consents for the use of cookies and the associated data processing operations — including those related to specific processing operations and providers mentioned within the consent management procedure — are obtained. Users also have the option to manage and revoke their consents. Consent declarations are stored in order to avoid repeated prompts and to be able to provide proof of consent in accordance with legal requirements. Storage is carried out server-side and/or in a cookie (so-called opt-in cookie) or via comparable technologies in order to assign the consent to a specific user or their device. Unless specific information is provided regarding the providers of consent management services, the following general information applies: The storage duration of consent is up to two years. A pseudonymous user identifier is created for this purpose, which is stored together with the time of consent, details on the scope of consent (e.g. relevant categories of cookies and/or service providers), as well as information about the browser, system and end device used; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Contact and Request Management

When contacting us (e.g. by mail, contact form, email, telephone or via social media) as well as in the context of existing user and business relationships, the information provided by the requesting individuals is processed to the extent necessary to respond to contact inquiries and any requested measures.

• Types of data processed: Inventory data (e.g. full name, home address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or visual messages and contributions, including related information such as authorship details or timestamps); Usage data (e.g. page views and duration of visits, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, parties involved).
• Data subjects: Communication partners.
• Purposes of processing: Communication; organizational and administrative procedures; feedback (e.g. collecting feedback via online forms); provision of our online offering and user-friendliness.
• Storage and deletion: Deletion is carried out in accordance with the details provided in the section "General Information on Data Storage and Deletion".
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Additional information on processing activities, procedures and services:

• Contact form: When contacting us via our contact form, email or other communication channels, we process the personal data transmitted to us in order to respond to and handle the respective request. This generally includes information such as name, contact details and, where applicable, further details provided to us that are necessary for adequate handling. We use this data exclusively for the stated purpose of contact and communication; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Promotional Communication via Email, Post, Fax or Telephone

We process personal data for the purposes of promotional communication, which may be carried out through various channels, such as email, telephone, postal mail or fax, in accordance with legal requirements.

Recipients have the right to withdraw any granted consent at any time or to object to promotional communication at any time.

Following a withdrawal or objection, we store the data required to prove prior authorization for contact or mailing for up to three years after the end of the calendar year in which the withdrawal or objection occurred, based on our legitimate interests. The processing of this data is restricted to the purpose of defending against potential claims. Furthermore, based on our legitimate interest in permanently respecting the user's withdrawal or objection, we retain the data necessary to prevent further contact (e.g. the email address, phone number, or name, depending on the communication channel).

• Types of data processed: Inventory data (e.g. full name, home address, contact details, customer number, etc.); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or visual messages and contributions as well as related information, such as authorship details or timestamps).
• Data subjects: Communication partners.
• Purposes of processing: Direct marketing (e.g. via email or postal mail); marketing; sales promotion.
• Storage and deletion: Deletion is carried out in accordance with the section "General Information on Data Storage and Deletion".
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Web Analytics, Monitoring and Optimization

Web analytics (also referred to as “reach measurement”) is used to evaluate the traffic and user flows of our online offering. This may include information on the behavior, interests, or demographic characteristics of visitors—such as age or gender—as pseudonymized values. Through reach measurement, we can, for example, determine the times at which our online content or its features are most frequently accessed or reused. It also allows us to identify areas that require improvement.

In addition to web analytics, we may deploy testing procedures to optimize our online offering or its components by evaluating different versions (e.g., A/B testing).

Unless otherwise stated below, user profiles may be created for these purposes—i.e., data grouped into a usage session—and information may be stored in and read from a user's browser or end device. The collected data may include, in particular, pages visited and elements used on those pages, as well as technical details such as the browser used, operating system, and timestamps of usage. Where users have consented to the collection of their location data—either to us directly or via the providers of third-party services we use—such location data may also be processed.

In addition, users' IP addresses are stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear data of the users (such as email addresses or names) is stored in the context of web analytics, A/B testing, and optimization, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the respective procedures.

Legal basis notice: If we ask users for their consent to use third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). In this context, we also refer you to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, involved individuals).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g., access statistics, identification of returning visitors); profiles with user-related information (creation of user profiles); provision of our online services and user-friendliness.
• Storage and deletion: Deletion in accordance with the section “General Information on Data Storage and Deletion.” Cookies may be stored for up to 2 years unless otherwise stated.
• Security measures: IP masking (pseudonymization of IP addresses).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Additional information on processing operations, procedures and services:

• Google Analytics: We use Google Analytics to measure and analyze the usage of our online offering based on a pseudonymous user identification number. This ID contains no direct identifiers such as names or email addresses. It serves to assign analytical data to a device in order to identify which content users accessed within one or more sessions, which search terms were used, whether the site was revisited, and how users interacted with our platform. Additionally, information such as the time and duration of use, referral sources, and technical data about users’ devices and browsers is stored.
  In the process, pseudonymous user profiles may be created using cookies, including cross-device analysis. Google Analytics does not log or store individual IP addresses for EU users. Instead, it provides only generalized geographic location data derived from IP metadata, such as city (and derived latitude/longitude), continent, country, region, and subcontinent. For EU traffic, IP address data is used exclusively for geolocation and then immediately deleted. It is neither logged nor accessible for further use. All IP lookups for EU data traffic are performed on EU-based servers before any traffic is forwarded to Analytics servers for processing.
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;
  Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR);
  Website: https://marketingplatform.google.com/intl/en/about/analytics/;
  Security measures: IP masking (pseudonymization of IP address);
  Privacy Policy: https://policies.google.com/privacy;
  Data Processing Agreement: https://business.safety.google/adsprocessorterms/;
  Third-country transfer safeguards: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms/);
  Opt-out options: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=en, Ad personalization settings: https://myadcenter.google.com/personalizationoff;
  Further information: https://business.safety.google/adsservices/ (Types of processing and data involved).

Presence on Social Media Platforms

We maintain online presences within social media platforms and, in this context, process user data in order to communicate with users active on these platforms or to provide information about us.

Please note that user data may be processed outside the European Union. This may pose certain risks to users, for example, making it more difficult to enforce users’ rights.

In addition, user data on social media platforms is generally processed for market research and advertising purposes. For example, usage profiles can be created based on users’ behavior and inferred interests. These profiles may, in turn, be used to display advertisements—both within and outside the platforms—that are presumably aligned with users’ interests. To this end, cookies are typically stored on users’ devices, which track usage behavior and store interest data. Furthermore, such usage profiles may also include data collected across devices (especially if users are members of the respective platforms and logged in).

For a detailed explanation of the respective processing activities and opt-out options, we refer you to the privacy policies and information provided by the operators of the respective social networks.

In the event of requests for information and the exercise of data subject rights, we also point out that these are most effectively asserted with the respective platform providers. Only the providers have access to the users' data and can take direct action and provide information. However, should you require assistance, you may contact us.

• Types of data processed: Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or visual messages and posts, as well as related information such as authorship or time of creation); Usage data (e.g. page views and dwell time, click paths, usage frequency and intensity, device types and operating systems used, interactions with content and features).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Communication; Feedback (e.g. collection of feedback via online form); Public relations.
• Storage and deletion: Deletion in accordance with the section "General Information on Data Retention and Deletion".
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

• LinkedIn: Social network – We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of data of visitors to our LinkedIn profile, which is used to create "Page Insights" (statistics). This includes information about the types of content users view or interact with, as well as the actions they take. It also includes information about the devices used, such as IP addresses, operating system, browser type, language settings and cookie data, as well as data from user profiles, such as job title, country, industry, seniority level, company size and employment status. For information on how LinkedIn processes user data, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.
  We have entered into a specific agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum", https://legal.linkedin.com/pages-joint-controller-addendum), which sets out, in particular, which security measures LinkedIn must observe and under which LinkedIn has agreed to fulfill data subject rights (i.e. users can, for example, address access or deletion requests directly to LinkedIn). The users' rights (in particular the right of access, erasure, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. The joint controllership is limited to the collection and transfer of data to LinkedIn Ireland Unlimited Company, an entity established in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, especially regarding the transfer of data to its parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa); Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.xing.com/; Privacy policy: https://privacy.xing.com/en/privacy-policy.

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are retrieved from the servers of their respective providers (hereinafter referred to as “third-party providers”). Such elements may include, for example, graphics, videos or maps (hereinafter collectively referred to as “content”).

The integration always requires that the third-party providers of this content process the user’s IP address, since they could not send the content to the user’s browser without it. The IP address is therefore necessary for displaying these contents or functions. We endeavor to use only content whose providers use the IP address solely for delivering the content. Third-party providers may also employ so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may furthermore be stored in cookies on the user’s device and may include, among other things, technical details about the browser and operating system, referring websites, time of visit, and other information regarding the use of our online offering, and may also be combined with such information from other sources.

Legal basis notice: If we ask users for their consent to employ third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., an interest in efficient, economical and user-friendly services). In this context, we also draw your attention to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g., pages visited, time spent, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); Location data (details on the geographical position of a device or person).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user experience optimization.
• Retention and deletion: Deletion in accordance with the details provided in the section “General Information on Data Retention and Deletion”. Storage of cookies up to 2 years (unless otherwise stated, cookies and similar storage technologies may be stored on users’ devices for up to two years).
• Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing operations, procedures, and services:

• Google Fonts (retrieved from Google servers): Retrieval of fonts (and icons) for the purpose of technically secure, maintenance-free, and efficient use of fonts and icons with respect to their up-to-dateness, loading times, consistent display, and compliance with possible licensing requirements. The IP address of the user is shared with the font provider so the fonts can be delivered to the user’s browser. Additionally, technical data (language settings, screen resolution, operating system, used hardware) is transmitted, which is necessary to deliver fonts based on the devices and technical environment used. This data may be processed on a font provider’s server in the USA. When visiting our online offering, users' browsers send HTTP requests to the Google Fonts Web API (an interface to retrieve the fonts). This API provides the Cascading Style Sheets (CSS) and the fonts referenced therein. These HTTP requests include (1) the IP address used by the user, (2) the requested URL on Google’s server, and (3) the HTTP headers including the user-agent string, browser and OS version, and referrer URL. Google does not log or store IP addresses on its servers, nor are they analyzed. The Web API logs only the requested URL, user-agent, and referrer URL. These are restricted and controlled strictly for operational needs, font popularity statistics, and maintenance purposes. According to Google, no information collected via Google Fonts is used to create user profiles or serve targeted advertising;
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;
  Legal basis: Legitimate interests (Art. 6(1)(f) GDPR);
  Website: https://fonts.google.com/;
  Privacy policy: https://policies.google.com/privacy;
  Third country transfer basis: Data Privacy Framework (DPF);
  Further information: https://developers.google.com/fonts/faq/privacy?hl=en.
• Google Maps: We integrate maps from the service “Google Maps” provided by Google. The data processed may include IP addresses and location data of users;
  Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland;
  Legal basis: Consent (Art. 6(1)(a) GDPR);
  Website: https://mapsplatform.google.com/;
  Privacy policy: https://policies.google.com/privacy;
  Third country transfer basis: Data Privacy Framework (DPF).