Privacy Policy

General version pursuant to DSGVO and BDSG

 

This privacy policy describes the processing of personal data exclusively within the framework of the functions, services, and technical components actually implemented and actively used on this website. The decisive factor for the scope of data processing is solely the specific technical configuration of the website at the time of each access by the user.

No personal data is processed beyond the purposes described in this declaration. In particular, only those services are used that are actually integrated into the website and functionally active. The following information may also include services or functions that are not active on all subpages, at all times, or only under certain conditions (e.g., after user consent).

For the actual data processing in individual cases, only the specific services technically executed in the respective usage context are decisive.

Editorial Note

The website operator designs and operates the website independently. The website operator is solely responsible for the services offered on this website.

1. Privacy at a Glance – General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is all data with which you can be personally identified. Detailed information on data protection can be found in our privacy policy below.

We process your personal data in accordance with the provisions of the DSGVO, the BDSG, and all other applicable laws.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice (Impressum) of this website.

How do we collect your data?

Your data is collected in part when you provide it to us. This may include data you enter into a contact form. Other data is collected automatically or after your consent when you visit the website through our IT systems. These are primarily technical data (e.g., internet browser, operating system, or time of page access).

What do we use your data for?

Some of the data is collected to ensure the website is provided without errors. Other data may be used to analyse your user behaviour. If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders, or other inquiries.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients, and purpose of your stored personal data. You also have the right to request correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request restriction of processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

2. Hosting

We host the content of our website with an external service provider (hoster). Personal data collected on this website is stored on the servers of the hoster. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

The hoster is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 Abs. 1 lit. b DSGVO) and in the interest of secure, fast, and efficient provision of our online offering (Art. 6 Abs. 1 lit. f DSGVO). A data processing agreement has been concluded with all hosters in accordance with Art. 28 DSGVO.

Cloudflare

We use the Content Delivery Network (CDN) from Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, to increase the security and delivery speed of our website. Data transfer between your browser and our website is routed through Cloudflare's network. The legal basis is Art. 6 Abs. 1 lit. f DSGVO. A data processing agreement has been concluded with Cloudflare.

3. General Information and Mandatory Details

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Note on the Responsible Entity

The responsible entity for data processing on this website can be found in the legal notice of this website. The responsible entity is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

Storage Duration

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent, your data will be deleted unless we have other legally permissible reasons for storing your personal data.

Due to commercial and tax law requirements (in particular pursuant to § 257 HGB and § 147 AO), we are obliged to archive certain documents and data (e.g., accounting records, invoices, and business correspondence) for a period of 6 to 10 years. During this time, processing of this data is restricted and is carried out solely to fulfil these legal obligations (Art. 6 Abs. 1 lit. c DSGVO).

General Information on Legal Bases for Data Processing

If you have consented to data processing, we process your personal data on the basis of Art. 6 Abs. 1 lit. a DSGVO. In the event of consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 Abs. 1 lit. a DSGVO. If you have consented to the storage of cookies, data processing is also carried out on the basis of § 25 Abs. 1 TDDDG. Consent can be revoked at any time. If your data is required for contract fulfilment, we process it on the basis of Art. 6 Abs. 1 lit. b DSGVO. Further processing may take place on the basis of Art. 6 Abs. 1 lit. c DSGVO (legal obligation) or Art. 6 Abs. 1 lit. f DSGVO (legitimate interest).

Overview of Legal Bases

• Contract execution and initiation (Art. 6 Abs. 1 lit. b DSGVO)
• Processing of inquiries (Art. 6 Abs. 1 lit. a DSGVO)
• Sending newsletters (Art. 6 Abs. 1 lit. a DSGVO)
• Improvement of our website (Art. 6 Abs. 1 lit. f DSGVO)
• Payment processing (Art. 6 Abs. 1 lit. b DSGVO)
• Fulfilment of legal obligations (Art. 6 Abs. 1 lit. c DSGVO)

Data Protection Officer

If required by law, a data protection officer has been appointed. Their contact details can be found in the legal notice of this website or can be requested from the website operator.

Note on Data Transfer to Third Countries

Among other things, we use tools from companies based in the USA or other third countries that are not considered safe under data protection law. If these tools are active, your personal data may be transferred to these countries and processed there. We would like to point out that in these countries, a level of data protection comparable to that of the EU cannot be guaranteed. Data transfer to the USA is carried out, where possible, only to companies certified under the EU-U.S. Data Privacy Framework or on the basis of EU Standard Contractual Clauses in accordance with Art. 46 DSGVO.

Disclosure of Data to Third Parties

We only disclose your personal data to third parties if:

• You have given your express consent in accordance with Art. 6 Abs. 1 lit. a DSGVO,
• The disclosure is necessary pursuant to Art. 6 Abs. 1 lit. f DSGVO for the assertion, exercise, or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data,
• There is a legal obligation to disclose data pursuant to Art. 6 Abs. 1 lit. c DSGVO, or
• This is legally permissible and necessary for the processing of contractual relationships with you pursuant to Art. 6 Abs. 1 lit. b DSGVO.

Transfer of personal data to service providers in third countries (e.g., USA) only takes place in compliance with legal data protection requirements, in particular where an adequacy decision by the EU Commission exists or EU Standard Contractual Clauses have been concluded.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent at any time. The lawfulness of data processing carried out until the revocation remains unaffected.

Right to Object to Data Collection — Art. 21 DSGVO

IF DATA PROCESSING IS BASED ON ART. 6 ABS. 1 LIT. E OR F DSGVO, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS (ART. 21 ABS. 1 DSGVO).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO SUCH PROCESSING (ART. 21 ABS. 2 DSGVO).

Right to Lodge a Complaint with the Supervisory Authority

In the event of violations of the DSGVO, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work, or place of the alleged infringement.

Right to Data Portability

You have the right to receive data that we process automatically on the basis of your consent or in fulfilment of a contract in a commonly used, machine-readable format, either for yourself or for a third party.

Access, Erasure and Rectification

You have the right at any time to receive free information about your stored personal data, its origin and recipients, and the purpose of data processing, and where applicable the right to rectification or erasure of this data.

Right to Restriction of Processing

You have the right to request restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful, the data is no longer needed for the purposes of processing, or you have lodged an objection pursuant to Art. 21 Abs. 1 DSGVO.

SSL/TLS Encryption

This site uses SSL/TLS encryption for security reasons. You can recognise an encrypted connection by the fact that the address bar of the browser changes from http:// to https:// and by the lock symbol in your browser bar.

4. Data Collection on This Website

Cookies

Our website uses so-called cookies. Cookies are small data packages and do not cause any damage to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or your web browser performs an automatic deletion.

Cookies can come from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites.

Cookies that are necessary for the performance of the electronic communication process or for the provision of certain functions desired by you (necessary cookies) are stored on the basis of Art. 6 Abs. 1 lit. f DSGVO. Where consent has been requested, processing takes place exclusively on the basis of Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG; consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate automatic deletion of cookies when closing the browser. Please note that if cookies are deactivated, not all functions of our website may be fully usable.

We use the following types of cookies:

• Technically necessary cookies – required for proper operation of the website
• Statistics/analysis cookies – for evaluating website usage
• Marketing cookies – for displaying relevant advertising content

Consent Management – Borlabs Cookie

To obtain and document the legally required consent for the use of certain cookies, we use the consent management tool Borlabs Cookie. The tool stores your selection in a cookie on your device. The cookie "borlabs-cookie" stores the consents you have given and has a duration of one year. The legal basis is Art. 6 Abs. 1 lit. c DSGVO (legal obligation to document consent pursuant to § 25 TDDDG and Art. 7 DSGVO). You can revoke your consent at any time with effect for the future via the cookie settings.

Server Log Files

The provider of the website automatically collects and stores information in server log files, which your browser automatically transmits. These are:

• Browser type and browser version
• Operating system used
• Internet service provider
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. Under no circumstances will the collected data be used to draw conclusions about your identity. The collection of this data is based on Art. 6 Abs. 1 lit. f DSGVO. Log file data is always stored separately from other personal data.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing the inquiry. We do not pass this data on without your consent. Processing is based on Art. 6 Abs. 1 lit. b DSGVO (contract fulfilment) or Art. 6 Abs. 1 lit. f DSGVO (legitimate interest). The data will remain with us until you request deletion or the purpose for data storage no longer applies.

Inquiry by Email, Telephone, or Fax

If you contact us by email, telephone, or fax, your inquiry including all resulting personal data will be stored and processed for the purpose of handling your request. We do not pass this data on without your consent. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (where contract-related) or Art. 6 Abs. 1 lit. f DSGVO. Statutory retention periods remain unaffected.

Registration on This Website

You can register on this website to use additional functions. The data entered for this purpose will only be used for the purpose of using the respective offer or service for which you have registered. Mandatory information must be provided in full. Processing is based on Art. 6 Abs. 1 lit. b DSGVO.

5. Newsletter

Newsletter Data

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the provided email address and that you agree to receive the newsletter. Upon registration, the IP address and the date and time of registration are stored. This serves to prevent misuse of the services. Processing is carried out exclusively on the basis of your consent (Art. 6 Abs. 1 lit. a DSGVO). You can revoke your consent at any time, for example via the unsubscribe link in the newsletter.

The data you provide for the purpose of receiving the newsletter will be stored by us until you unsubscribe and will be deleted thereafter. After unsubscribing, your email address may be stored in a blocklist to prevent future unwanted mailings (legitimate interest pursuant to Art. 6 Abs. 1 lit. f DSGVO).

Double Opt-In Procedure

The newsletter is sent based on the recipient's consent. As part of the registration process, a double opt-in procedure is used. After entering your email address, you will receive a confirmation email asking you to confirm your subscription. This confirmation is necessary to prevent unauthorized registrations using third-party email addresses. Registrations are logged in order to prove the registration process in accordance with legal requirements.

6. E-Commerce and Payment Providers

Processing of Customer and Contract Data

We collect, process, and use personal data only insofar as it is necessary for the establishment, content design, or modification of the legal relationship. This is done on the basis of Art. 6 Abs. 1 lit. b DSGVO. The collected customer data will be deleted after completion of the order or termination of the business relationship and expiry of statutory retention periods.

Data for Online Orders

When concluding a purchase contract via our online shop, we collect the following data for contract processing:

• Name and address (billing and, if applicable, delivery address)
• Email address
• Telephone number (optional)
• Payment data
• Order data (items ordered, quantity, price)

Processing is based on Art. 6 Abs. 1 lit. b DSGVO. Tax and commercial law relevant data (e.g., invoices) are stored for 10 years (§ 147 AO, § 257 HGB).

Payment Service Providers – General

We offer various payment methods on our website. The respective payment service providers process your payment data independently according to their own privacy policies. By using a payment method, you simultaneously agree to the privacy policy of the respective provider.

PayPal

If you pay via PayPal, credit card via PayPal, direct debit via PayPal, or – if offered – purchase on account or instalment payment via PayPal, we pass on your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The transfer is based on Art. 6 Abs. 1 lit. b DSGVO and only to the extent necessary for payment processing.

PayPal may carry out credit checks. For this purpose, your payment data may be passed on to credit agencies on the basis of Art. 6 Abs. 1 lit. f DSGVO. Further information can be found at www.paypal.com.

Klarna – Instant Transfer, Invoice and Instalment Purchase

We offer payment options from Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Available options include instant transfer, invoice purchase (14-day payment term), and instalment purchase. For invoice and instalment purchase, delivery to an address other than the invoice address is not possible.

When using instant transfer, you transmit your PIN and a valid TAN to Klarna, which thereby gains access to your online banking account. Klarna checks your account balance, executes the transfer, and sends us a transaction confirmation. Account turnovers, overdraft limits, and further account information are also checked.

In addition to your PIN and TAN, payment data and personal data (name, address, telephone number, email address, IP address, and other data required for payment processing) are transmitted to Klarna for identity verification and fraud prevention.

Klarna may check your creditworthiness and, where there is legitimate reason, exchange data with credit agencies. If there are doubts about your creditworthiness, Klarna may refuse certain payment methods. The legal basis is Art. 6 Abs. 1 lit. a and lit. b DSGVO. Further information: www.klarna.com.

Stripe

We use the payment service provider Stripe. The provider for users in the EEA is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes transaction data and technical data (e.g., IP address, browser type) to process payments and prevent fraud.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO and Art. 6 Abs. 1 lit. f DSGVO. Data may be transferred to the USA under the EU-U.S. Data Privacy Framework. Further information: stripe.com.

Credit Card Payment

Credit card payments are processed via a PCI-DSS-certified payment service provider. Your credit card data is transmitted in encrypted form and is not stored on our servers. Processing is based on Art. 6 Abs. 1 lit. b DSGVO.

Prepayment / Bank Transfer

When paying in advance, we will provide you with our bank details. Your transfer data is stored for payment processing and bookkeeping purposes pursuant to Art. 6 Abs. 1 lit. b and lit. c DSGVO and the statutory retention periods.

7. Analytics and Marketing Tools

The tracking measures listed below are carried out on the basis of Art. 6 Abs. 1 lit. a DSGVO (consent). We only use these tools if you have given your explicit consent via our consent management tool. You can revoke your consent at any time with effect for the future via the cookie settings.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables the website operator to analyse the behaviour of website visitors. Google Analytics uses cookies that enable an analysis of the use of the website. The information generated is usually transferred to a Google server in the USA and stored there.

The use of Google Analytics is based exclusively on your consent in accordance with Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. We use Google Analytics only with IP anonymisation activated, so that your IP address is shortened within the EU before being transmitted to the USA. We have concluded a data processing agreement with Google (Art. 28 DSGVO). Google is certified under the EU-U.S. Data Privacy Framework.

You can prevent the collection of your data by Google Analytics by downloading the browser plugin: https://tools.google.com/dlpage/gaoptout

Google AdSense

This website uses Google AdSense, a service for integrating advertisements provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google AdSense uses cookies and so-called web beacons (invisible graphics) to evaluate visitor traffic and display advertisements. The information generated (including your IP address) may be transferred to Google servers in the USA.

Processing is based on your consent in accordance with Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. No advertising cookies are set without your active consent via our consent tool. Revocation of your consent is possible at any time via the cookie settings. Data transfer to the USA is based on the EU-U.S. Data Privacy Framework.

Google Tag Manager

We use Google Tag Manager, a tool from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It allows us to manage tracking and statistical tools on our website. The Tag Manager itself does not create user profiles, store cookies, or perform independent analyses, but does collect your IP address. The legal basis is Art. 6 Abs. 1 lit. f DSGVO or Art. 6 Abs. 1 lit. a DSGVO where prior consent has been given.

Meta Pixel (formerly Facebook Pixel)

This website integrates the Meta Pixel from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. It enables tracking of user behaviour after clicking on Meta advertisements. The data collected is anonymous to us; however, Meta may link it to the respective user profile and use it for its own advertising purposes. The legal basis is Art. 6 Abs. 1 lit. a DSGVO; consent can be revoked at any time.

8. Plugins and Tools

Google reCAPTCHA

We use Google reCAPTCHA on this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is used to check whether data entry on this website is made by a human or by an automated programme. For this purpose, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics such as IP address, dwell time, or mouse movements. The analysis data is forwarded to Google. The legal basis is Art. 6 Abs. 1 lit. f DSGVO or Art. 6 Abs. 1 lit. a DSGVO where prior consent has been given. Further information: policies.google.com.

Google Fonts

This site uses Google Fonts for consistent font display. Fonts are loaded only after consent via the consent management tool, so that a connection to Google's servers is only established after your consent. This may involve transferring your IP address to Google. The transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework. The legal basis is Art. 6 Abs. 1 lit. a DSGVO. Further information: policies.google.com.

Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To use its functions, your IP address must be stored. Data is usually transferred to Google servers in the USA. Use takes place in the interest of an attractive presentation and easy findability of the indicated locations (Art. 6 Abs. 1 lit. f DSGVO) or on the basis of your consent.

YouTube

This website embeds videos from the YouTube platform. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When visiting a page with an embedded YouTube video, a connection to YouTube servers is established. We use the enhanced privacy mode. The legal basis is Art. 6 Abs. 1 lit. f DSGVO or Art. 6 Abs. 1 lit. a DSGVO.

Vimeo

This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA. When visiting a page with Vimeo content, a connection to Vimeo servers is established and your IP address is transmitted. The legal basis is Art. 6 Abs. 1 lit. f DSGVO.

9. Social Media

Social Media Presence and Plugins

We maintain public profiles on social networks and use social plugins on our website to increase awareness of our company. The underlying commercial purpose is considered a legitimate interest within the meaning of the DSGVO (Art. 6 Abs. 1 lit. f DSGVO). Integration takes place using privacy-friendly methods such as the two-click solution or via simple links to best protect visitors to our website. The specific social networks used can be found in the legal notice of this website.

Facebook / Meta

Our website uses social media plugins from Facebook. The operator is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. When visiting a page of our website containing such a plugin, your browser establishes a direct connection to Facebook's servers. Facebook thereby receives information that your browser has accessed the page, even if you do not have a Facebook account or are not logged in. This information (including your IP address) is transmitted directly to a Facebook server in the USA and stored there.

Within the framework of joint controllership, we have concluded an agreement on the joint processing of data with Meta. Privacy policy: https://de-de.facebook.com/privacy/explanation

Instagram

Functions of the Instagram service are integrated on our website. The operator is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. If you are logged into your Instagram account, you can link content from our pages to your Instagram profile by clicking the Instagram button. Privacy policy: https://privacycenter.instagram.com/policy

X (formerly Twitter)

Functions of the X service are integrated on our website. These functions are offered by X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. For the EU, Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland, is responsible. By using X, the websites you visit are linked to your X account and made known to other users. Data transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework. Privacy policy: https://twitter.com/en/privacy

LinkedIn

We maintain a presence on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Data transfers to the USA are carried out on the basis of EU Standard Contractual Clauses. Privacy policy: https://www.linkedin.com/legal/privacy-policy

XING

We maintain a presence on XING. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

Pinterest

We maintain a presence on Pinterest. The operator is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Privacy policy: https://policy.pinterest.com/en/privacy-policy

TikTok

We maintain a presence on TikTok. The operator is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

10. Data Processing Agreements

We have concluded data processing agreements (pursuant to Art. 28 DSGVO) with all service providers who process personal data on our behalf. These contracts ensure that these providers comply with applicable data protection regulations and process personal data only in accordance with our instructions. If these providers are located outside the EU/EEA, an adequate level of data protection is ensured through appropriate safeguards (e.g. EU Standard Contractual Clauses pursuant to Art. 46 DSGVO or an adequacy decision pursuant to Art. 45 DSGVO).

11. Rights of Data Subjects

If personal data is processed by you, you are a data subject within the meaning of the DSGVO and you have the following rights against the responsible entity:

11.1 Right of Access — Art. 15 DSGVO

You may request confirmation from the responsible entity as to whether personal data concerning you is being processed by us. If such processing exists, you may request information about the purposes of processing, the categories of data, the recipients, the intended storage period, the existence of a right to rectification, erasure or restriction, the right to lodge a complaint with a supervisory authority, the origin of the data, and the existence of automated decision-making including profiling. You also have the right to request information about whether your data is transferred to a third country or international organisation.

11.2 Right to Rectification — Art. 16 DSGVO

You have the right to request rectification and/or completion from the responsible entity if the personal data processed is incorrect or incomplete. The responsible entity is obliged to carry out the rectification without delay.

11.3 Right to Restriction of Processing — Art. 18 DSGVO

You have the right to request restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful, the data is no longer required for the purposes of processing, or you have lodged an objection pursuant to Art. 21 Abs. 1 DSGVO. If the restriction has been lifted, you will be informed in advance by the responsible entity.

11.4 Right to Erasure — Art. 17 DSGVO

You can request the responsible entity to delete the personal data concerning you without delay, provided the data is no longer necessary for the purposes for which it was collected, you have revoked consent, you have lodged an objection, the data has been processed unlawfully, or a statutory obligation to delete exists. The right to erasure does not exist insofar as processing is necessary for the exercise of the right to freedom of expression, for the fulfilment of a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims.

11.5 Right to Notification — Art. 19 DSGVO

If you have exercised the right to rectification, erasure, or restriction of processing against the responsible entity, the latter is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification, erasure, or restriction, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients by the responsible entity.

11.6 Right to Data Portability — Art. 20 DSGVO

You have the right to receive the personal data concerning you that you have provided to the responsible entity in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another responsible entity, provided the processing is based on consent or a contract and is carried out using automated procedures.

11.7 Right to Object — Art. 21 DSGVO

You have the right, on grounds arising from your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 Abs. 1 lit. e or f DSGVO; this also applies to profiling based on these provisions. The responsible entity will no longer process the data unless they can demonstrate compelling legitimate grounds that override your interests. If data is processed for the purpose of direct marketing, you have the right to object at any time.

11.8 Right to Withdraw Consent — Art. 7 Abs. 3 DSGVO

You have the right to withdraw your data protection consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

11.9 Automated Decision-Making Including Profiling — Art. 22 DSGVO

You have the right not to be subject to a decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for the conclusion or performance of a contract, is permitted by law, or is made with your express consent.

In cases where automated decision-making is permissible, the responsible entity shall take appropriate measures to safeguard your rights and freedoms, including at least the right to obtain human intervention, to express your point of view, and to contest the decision.

11.10 Right to Lodge a Complaint with a Supervisory Authority — Art. 77 DSGVO

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the DSGVO. The supervisory authority shall inform the complainant of the status and results of the complaint including the possibility of a judicial remedy pursuant to Art. 78 DSGVO.

12. Data Security

During the website visit, we use the SSL/TLS procedure in conjunction with the highest level of encryption supported by your browser. This is generally 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can recognise whether an individual page is transmitted in encrypted form by the closed display of the key or lock symbol in the status bar of your browser.

We use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

13. Storage Duration of Personal Data

The criterion for the duration of storage of personal data is the respective statutory retention period. After the expiry of the period, the corresponding data is routinely deleted, provided it is no longer needed for contract performance or initiation.

Due to commercial and tax law requirements (in particular pursuant to § 257 HGB and § 147 AO), we are obliged to archive certain documents and data (e.g., booking receipts, invoices, and business correspondence relating to payment processing) for a period of 6 to 10 years. During this period, the processing of this data is restricted and takes place solely to fulfil these statutory obligations (Art. 6 Abs. 1 lit. c DSGVO).

14. Currency and Amendments to This Privacy Policy

This privacy policy is currently valid. Due to the further development of our website and offerings, or due to changed legal or regulatory requirements, it may be necessary to amend this privacy policy. The current version of the privacy policy can be accessed and printed at any time on the website.

Source: Created with the participation of e-recht24.de

Status: May 2026