Privacy Notice

Our Privacy Policy

This page contains:

Privacy Information for Customers (Weblink)
Privacy Information for Website Visitors (Weblink)

1. Privacy Notice for Customers

Data subjects

This notice applies to all individuals who are customers of the controller and use services in connection with “Myself at Work,” including prospective and former customers. All terms referring to individuals include all genders and the corresponding linguistic forms, including diverse, female, and male gender identities. Every such term is to be read as including “(male/female/diverse).”

Controller

The controller responsible for the processing described here is: distinctions GmbH, Gustav-Freytag-Straße 6, 65189 Wiesbaden, email: support@myselfatwork.com, managing directors: Silke Hermann, Jonas Happel.

Rights of data subjects and other information

(1) Data subjects have the following rights with respect to the data stored about them: the right of access, the right to rectification of inaccurate data, the right to erasure of data for which there is no longer a reason for retention, the right to restriction of processing, and the right to data portability. They also have the right to lodge a complaint with the supervisory authority competent for the controller.

(2) Where processing is based on the data subjects’ consent, they may withdraw their consent at any time with effect for the future, for example by sending an informal message through any of the contact channels listed above under “Controller.”

(3) Where processing is based on the pursuit of a legitimate interest, i.e., on Article 6(1), first sentence, point (f) of the GDPR, data subjects may object to the processing at any time, for example by sending an informal message through any of the contact channels listed above under “Controller.” If the objection is justified, processing will cease. Where the legitimate interest is direct marketing, the objection is always justified.

(4) No automated decision-making, including profiling, takes place.

(5) A legal obligation to process data exists only where reference is made below to Article 6(1), first sentence, point (c) of the GDPR.

Transfers to countries outside the European Union

(1) Where personal data are transferred to entities outside the European Union, the controller must provide information about additional safeguards under Article 44 et seq. of the GDPR..

(2) Where the controller relies on an adequacy decision in the privacy notice below, this means that the receiving entity is located in a country, territory, or specific sector that the European Commission has decided provides an adequate level of data protection. In this case, the safeguard is based on Article 45 of the GDPR.

(3) Where the controller relies on the EU standard contractual clauses in the privacy notice below, this means that the receiving entity has contractually committed to respecting EU data protection principles on the basis of the EU standard contractual clauses. In this case, the safeguard is based on Article 46 of the GDPR.

(4) Where the controller relies on binding corporate rules in the privacy notice below, this means that the competent supervisory authority has authorized the transfer. In this case, the safeguard is based on Article 47 of the GDPR.

(5) Where the controller relies in the privacy notice below on the data subjects’ explicit consent to a transfer to a country outside the European Union, this means that they agree to the transfer despite being aware of all the associated risks. In this case, the safeguard is based on Article 49(1)(a) of the GDPR.

The following risk information is provided as a precaution:

As a general matter, the European Commission has recognized the United States as a safe third country. The following information is therefore provided solely as a precaution and only in the exceptional event that consent is sought for a data transfer to the United States: The rule-of-law principles in the United States are not comparable to those in the European Union. In particular, investigative authorities and intelligence services have extensive rights of access that are not subject to the principle of proportionality applicable in the European Union. In addition, data subjects have only limited means of asserting their rights.

(6) The information above is provided solely as a precaution. It applies only if and to the extent that reference is made to it in the privacy notice below.

Additional information

(1) No automated decision-making, including profiling, takes place.

(2) A legal obligation to process data exists only where reference is made below to Article 6(1), first sentence, point (c) of the GDPR

Data processing

Steps prior to entering into a contract:

The steps prior to entering into a contract are as follows: As a rule, data subjects visit the controller’s website, select a questionnaire product and the corresponding number of licenses, and register. Acceptance generally takes the form of issuing the licenses. All data that the data subjects voluntarily provide through a form are processed in this context. The purpose is to take steps prior to entering into a contract or to enter into a contract. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

The following may occur only in exceptional cases:

Either the data subjects make initial contact with the controller or the controller contacts them. In this context, the controller processes all data that the data subjects voluntarily provide. These are often contact details (name and contact information such as email address, mailing address, and telephone number) and communication data (a description of the subject matter, notes from conversations, and form entries). The controller prepares an offer on this basis. The controller stores these data. The purpose is to take steps prior to entering into a contract or to enter into a contract. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.
The controller also arranges for preliminary discussions during the pre-contractual phase to be held by videoconference. It leaves it up to the data subjects to decide whether to enable their cameras and whether the conversations may be recorded. Where it gives them this choice, it obtains the necessary consent, which the data subjects give by enabling their cameras and, where applicable, participating in a recording. For this purpose, it processes the name, the time consent was given, and the consent status. The purpose is compliance with a legal obligation. The legal basis is Article 6(1), first sentence, point (c) of the GDPR in conjunction with Article 7(1) of the GDPR.
Data subjects communicate by videoconference during preliminary discussions in the pre-contractual phase. The following data are processed in all cases: audio data and the time of joining the call. If the camera is enabled, image data are also processed. The purpose is performance of the contract. Where the camera is enabled and/or a recording is made, the resulting image data and/or recording data are processed only if and to the extent that the data subjects consent (Article 6(1), first sentence, point (a) of the GDPR). The prohibition under Article 9(1) of the GDPR does not preclude this, because the exception under Article 9(2)(a) of the GDPR applies here. For all other processing operations, the legal basis is Article 6(1), first sentence, point (b) of the GDPR.

During the contractual relationship:

Once the contract has been entered into, the controller collects additional communication and billing data (delivery of the service and responses to inquiries) in order to perform the contract. The purpose is performance of a contract. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

On one of the controller’s websites, data subjects can register to use a restricted-access area, then log in and subsequently log out. The aim is for data subjects to purchase questionnaire licenses and then receive license codes that they can use to complete questionnaires. They then receive the assessment results. When data subjects do this, the controller collects the data they provide during registration. Within the restricted-access area, the controller records the data subjects’ actions to the extent necessary to provide that area and its functions. The following data are processed: (1) the registration data entered by the data subjects, (2) data about logins, (3) data about actions that the data subjects take within the login area, (4) data about logout status, (5) data about the questionnaires that the data subjects complete for analysis and the resulting findings, and (6) license codes and their redemption/use status. The purpose is to take steps prior to entering into contracts and/or to perform contracts. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

Shortly before they are erased, the questionnaire responses and the resulting findings are extracted in anonymized form in order to gain scientific insights and use the knowledge gained for the future development of the controller’s products. However, the GDPR does not apply to this, as anonymized data fall outside its scope.

The controller transfers the data relevant for tax purposes relating to this category of data subjects to an external tax advisory firm. For this purpose, it processes the name and all data arising from invoices and incoming payments. The purpose is to obtain assistance with bookkeeping from an external tax advisory firm. The legal basis is Article 6(1), first sentence, point (f) of the GDPR, with the legitimate interest arising from the purpose stated above. Processing of data at the external tax advisory firm does not constitute processing on behalf of the controller (see DSK Short Paper No. 13), but rather a transfer of data that is itself justified under Article 6(1), first sentence, point (f) of the GDPR. This therefore constitutes another form of outsourcing.

The controller also arranges for contract-related meetings to be held by videoconference. It leaves it up to the data subjects to decide whether to enable their cameras and whether the conversations may be recorded. Where it gives them this choice, it obtains the necessary consent, which the data subjects give by enabling their cameras and, where applicable, participating in a recording. For this purpose, it processes the name, the time consent was given, and the consent status. The purpose is compliance with a legal obligation. The legal basis is Article 6(1), first sentence, point (c) of the GDPR in conjunction with Article 7(1) of the GDPR.

Data subjects communicate by videoconference in connection with performance of the contract. The following data are processed in all cases: audio data and the time of joining the call. If the camera is enabled, image data are also processed. The purpose is performance of the contract. Where the camera is enabled and/or a recording is made, the resulting image data and/or recording data are processed only if and to the extent that the data subjects consent (Article 6(1), first sentence, point (a) of the GDPR). The prohibition under Article 9(1) of the GDPR does not preclude this, because the exception under Article 9(2)(a) of the GDPR applies here. For all other processing operations, the legal basis is Article 6(1), first sentence, point (b) of the GDPR.

The controller leaves it up to the data subjects to decide whether to provide a video testimonial. If they choose to do so, it obtains the necessary consent. For this purpose, it processes the name, the time consent was given, and the consent status. The purpose is compliance with a legal obligation. The legal basis is Article 6(1), first sentence, point (c) of the GDPR in conjunction with Article 7(1) of the GDPR.

The controller uses the data subjects’ email addresses to send them marketing communications. The legal basis is Article 6(1), first sentence, point (f) of the GDPR, with the legitimate interest arising from their status as customers and Recital 47 of the GDPR.

The controller uses the data subjects’ mailing addresses to send them marketing communications by mail. The legal basis is Article 6(1), first sentence, point (f) of the GDPR, with the legitimate interest arising from their status as customers and Recital 47 of the GDPR.

If the controller changes its processing, in particular by using new recipients, it will notify the data subjects of the change by emailing them the updated privacy information. The purpose is compliance with the transparency obligations under the GDPR (Articles 12 to 14 of the GDPR). The legal basis is Article 6(1), first sentence, point (c) of the GDPR.

After the contractual relationship ends:

After the active contractual relationship ends, the data are stored until the end of their respective retention periods and then erased. The purpose of erasure is compliance with a legal obligation within the meaning of Article 5(1)(a) and (e) of the GDPR. The legal basis is Article 6(1), first sentence, point (c) of the GDPR.

The following retention periods apply:

1. Data relevant to the controller’s taxation are generally retained for eight years. The applicable period begins on December 31 of the year in which the document was created. The purpose is compliance with a retention obligation. The legal basis is Article 6(1), first sentence, point (c) of the GDPR in conjunction with Section 147 of the Fiscal Code of Germany (AO).

2. Where processing is based on consent, the data processed on that basis are retained until consent is withdrawn or the purpose for which they are processed ceases to apply. The purpose is specified in the relevant declaration of consent. The legal basis is Article 6(1), first sentence, point (a) of the GDPR.

3. Data that provide evidence of consent are retained for three years, with this period beginning on December 31 of the calendar year in which consent is withdrawn or the data are erased for other reasons. The purpose is compliance with a retention obligation. The legal basis is Article 6(1), first sentence, point (c) of the GDPR in conjunction with Article 7(1) of the GDPR. The period is determined by the limitation periods for regulatory offenses under Section 31(2), point 1 of the Act on Regulatory Offences (OWiG) in conjunction with Article 83(4) and (5) of the GDPR.

4. Data generated when data subjects assert claims against the controller under data protection law (see “Rights” above) are retained for three years, beginning on December 31 of the calendar year in which the controller responds. The legal basis is Article 6(1), first sentence, point (f) of the GDPR. The legitimate interest in processing arises from the controller’s need to be able to defend itself at a later date against civil claims and allegations of regulatory or criminal offenses. This interest in retaining the data ends upon expiry of the limitation period under Sections 193 and 195 of the German Civil Code (BGB) or Section 31(2), point 1 in conjunction with Section 31(3) of the Act on Regulatory Offences (OWiG) and Article 83(4) and (5) of the GDPR, as applicable.

5. Data generated when data subjects assert other claims against the controller are retained for three years, beginning on December 31 of the calendar year in which the controller responds. The legal basis is Article 6(1), first sentence, point (f) of the GDPR. The legitimate interest in processing arises from the controller’s need to be able to defend itself at a later date against civil claims. This interest in retaining the data ends upon expiry of the limitation period under Sections 193 and 195 of the German Civil Code (BGB).

Processors and third parties that receive data

The following third-party providers receive personal data:

Third-party provider: Various applications from Microsoft Corporation (United States), which has been engaged under Article 28 of the GDPR, are used: Microsoft365 Cloud, Microsoft Teams (project management tool), and Microsoft Teams (videoconferencing tool). The fact that the third-party provider is based outside the European Union does not preclude its engagement, as the transfer is justified under Article 45 of the GDPR.

Third-party provider: The web hosting service “raidboxes” from Raidboxes GmbH (Germany – EU), which has also been engaged under Article 28 of the GDPR, is used.

Third-party provider: “Woocommerce” from Automattic Inc. (United States) is used as the online store system. The fact that the third-party provider is based outside the European Union does not preclude its engagement, as the transfer is justified under Article 45 of the GDPR.

Third-party provider: The automation tool “Brevo” from Brevo GmbH (Germany – EU), which has been engaged under Article 28 of the GDPR, is used for contract-related communications.

Third-party provider:The payment tool “Mollie” from Mollie B.V (Netherlands – EU) may be used for payments.

Third-party provider: Various applications from the “Tripetto” product range offered by Tripetto B.V. (Netherlands – EU) are used: Tripetto Form, Tripetto Appointment Booking, and Trippetto Email Automation. This provider does not process the data itself or on our behalf; it provides plugins and software that store any data locally on the controller’s systems.

Third-party provider: The accounting tool “Lexware Office” from Haufe Service Center GmbH (Germany – EU), which has been engaged under Article 28 of the GDPR, is used.

Third-party provider: The accounting tool “Datev” from Datev eG (Germany – EU), which has been engaged under Article 28 of the GDPR, is used.

Third-party provider: The collaboration tool “slack” from Slack Technologies Ireland Limited (Ireland – EU) is used. The fact that data may be processed outside the EU, for example with the involvement of Slack Technologies Inc. (United States), does not preclude the use of this third-party provider. For all data other than employee data, the transfer is justified under Article 45 of the GDPR. For employee data, the third-party provider has committed to the EU standard contractual clauses, so the transfer is justified under Article 46 of the GDPR.

Third-party provider: The webinar and videoconferencing tool “Zoom” from Zoom Video Communications, Inc. (United States), which has been engaged under Article 28 of the GDPR, is used. The fact that this provider is based outside the European Union does not preclude its engagement, as it has committed to the EU standard contractual clauses, so the transfer is justified under Article 46 of the GDPR.

Glossary

A glossary follows below. Not all of the situations explained in the glossary are necessarily relevant to the data processing operations described here. The explanations are provided solely to aid general understanding and thus promote transparency.

Topic: Basic terms

Personal data:Any information that directly or indirectly allows inferences to be drawn about natural persons, i.e., human beings.

Processing of personal data:Any active or passive handling of personal data, from collection through the main processing operations to erasure.

Consent: A demonstrable indication of wishes, freely given before personal data are processed, that permits specific processing of the personal data of the data subject giving consent.

Topic: Social media

Company and/or product page: This term means that the controller maintains a company or product page on a social media platform, with a link to that page on the website. If data subjects click this link (i.e., the link to the company or product page), they are taken to the controller’s profile.

Plugin: This term means that the controller has embedded a plugin from the provider of a social network or social media platform on the website. If data subjects click this plugin, they are taken to the controller’s profile. The controller uses a two-click solution. This means that, as a rule, no personal data are initially passed on to the plugin provider described here after the click. The provider can be identified from the design of the plugin (for example, its logo). The controller enables data subjects to communicate directly with the plugin provider through the button. Only when they click the marked field and thereby activate it does the provider receive the information that the data subjects have visited this website. Only then are the data described in greater detail above transferred. Activating the plugin therefore transfers the data subjects’ personal data to the provider described here. This transfer takes place regardless of whether the data subjects have an account with that provider and are logged in. If they are logged in to the provider’s service, their data collected by this controller are linked directly to the account that the data subjects maintain with that provider. It is advisable to log out regularly after using a social network, and particularly before activating the button, as this can prevent the data from being linked to the data subjects’ profiles with the provider.

Ads: This term means that the controller uses ads on a social media platform. Using this tool’s advertising materials, this controller can draw attention to its offerings on the social network or social media platform described, where applicable. It can use advertising campaign data to determine how successful individual advertising measures are. Its aim is to show data subjects advertising that interests them, make this website more appealing to them, and calculate advertising costs fairly. These advertising materials are delivered by the provider described here. If data subjects reach this website through an ad shown to them by this provider, the tool stores a cookie on their computers. These cookies are not intended to identify the data subjects personally. Typically, the following analytics values are stored for this cookie: the unique cookie ID, the number of ad impressions per placement (frequency), the most recent impression (relevant for post-view conversions), and opt-out information (a flag indicating that the user no longer wishes to be targeted). Because this tool is used, the data subjects’ browsers automatically establish a direct connection to the server of the provider described here. The controller has no influence over the extent or subsequent use of the data collected through this tool. However, it provides the following information to the best of its knowledge: Embedding this tool’s advertising materials informs the provider described here that the data subjects have visited the relevant part of this website or clicked an ad placed by the controller. If the data subjects are registered with a service offered by this provider, it can link the visit to their accounts. Even if the data subjects are not registered with the provider described here or are not logged in, the provider may still obtain and store their IP addresses. Data subjects can prevent participation in this tracking process in several ways: by adjusting their browser settings, in particular by blocking third-party cookies, which prevents data subjects from receiving ads from third-party providers; or by disabling cookies.

Pixel: This term means that the controller uses pixels. A pixel is an analytics tool that allows the controller to measure the effectiveness of advertising. It is generally used to understand and track the actions people take on a website. The controller has implemented the pixel on this website by placing the pixel code in the website’s header. When data subjects then visit the website and take an action (for example, complete a purchase), the pixel is triggered and the action is reported. This informs the controller when a data subject takes an action and allows the controller to analyze it. Advanced matching is also available; the controller uses this feature as well, and its use is likewise covered by consent. The pixel also allows data subjects’ data (for example, first name, last name, and email address) to be transferred to the providers and enriched with existing tracking data. This makes it possible to collect data even about data subjects who do not use this social media platform or to capture data about users who are not logged in to it while visiting this website. Data subjects are thus tracked through this social media platform.

Custom Audience upload: This term means that the controller uploads data subjects’ data (generally their email addresses) to the third-party provider of the social media platform described, where applicable; of course, only after consent has been given. This allows this controller to have interest-based ads shown to data subjects when they visit the social network or social media platform provided by that provider. The process is as follows: The controller uploads contact details (generally email addresses) to the provider described here. The provider then checks whether the data subjects are registered with it using those contact details. If not, the contact details are not added to the Custom Audience (a type of database that the controller maintains with this provider). If they are, the contact details are added to the controller’s Custom Audience. When the data subjects then visit the social network provided by this provider, this controller can show them advertising that interests them.

Publication of media recordings: This term means that the controller uploads media recordings of data subjects (photographs, audio recordings, and/or video recordings) to the relevant social media platform and publishes them there.

Topic: Embedded videos

Plugin: This term means that plugins from the video platform are embedded on this website. Each time a page offering one or more video clips is accessed, a direct connection is established between the data subjects’ browsers and a server operated by the third-party provider. The third-party provider stores the data subjects’ data as usage profiles and uses them for advertising, market research, and/or tailoring its website to users’ needs. In particular, this analysis is carried out (even for users who are not logged in) to provide advertising tailored to users’ needs and to inform other users of the social network about the data subjects’ activities on the controller’s website. Data subjects have the right to object to the creation of these user profiles and must contact the provider to exercise that right. Further information about the purpose and scope of data collection and the provider’s processing of the data can be found in the privacy notice.

Own channel: This term means that the controller operates its own channel on the video platform.

Publication of media recordings:This term means that the controller uploads media recordings of data subjects (photographs, audio recordings, and/or video recordings) to the relevant video platform and publishes them there.

2. Privacy Notice for Website Visitors

Data subjects

This notice applies to all individuals who visit the controller’s website that provides a link to this privacy notice. All terms referring to individuals include all genders and the corresponding linguistic forms, including diverse, female, and male gender identities. Every such term is to be read as including “(male/female/diverse).”

Controller

Rights of data subjects and other information

(4) No automated decision-making, including profiling, takes place.

(5) A legal obligation to process data exists only where reference is made below to Article 6(1), first sentence, point (c) of the GDPR.

Transfers to countries outside the European Union

(1) Where personal data are transferred to entities outside the European Union, the controller must provide information about additional safeguards under Article 44 et seq. of the GDPR..

The following risk information is provided as a precaution:

The People’s Republic of China has no data protection law that meets the requirements of the GDPR and EU standards. The rule-of-law principles in the People’s Republic of China are not comparable to those in the European Union. In particular, investigative authorities and intelligence services have extensive rights of access that are not subject to the principle of proportionality applicable in the European Union. In addition, data subjects have only limited means of asserting their rights. Furthermore, the same fundamental human rights do not apply in China as in the EU.

(6) The information above is provided solely as a precaution. It applies only if and to the extent that reference is made to it in the privacy notice below.

Additional information

(1) No automated decision-making, including profiling, takes place.

(2) A legal obligation to process data exists only where reference is made below to Article 6(1), first sentence, point (c) of the GDPR

Data processing

Browsing the website for information:

Displaying the website

Data subjects initially use the website for information, i.e., they access it without actively interacting with it. In this context, the controller collects the following data about the data subjects to the extent technically necessary to display the website: IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, volume of data transferred in each case, website from which the request originates, browser, operating system and its interface, and language and version of the browser software. The purpose is to display the website. The legal basis is Article 6(1), first sentence, point (f) of the GDPR, with the legitimate interest arising from the purpose stated above.

Erasure

Once the data subjects finish browsing the website for information, the data are erased. The purpose is compliance with a legal obligation (Article 5(1)(a) and (e) of the GDPR). The legal basis is Article 6(1), first sentence, point (c) of the GDPR.

Web hosting:

The controller uses an external web hosting provider that displays the website and processes the data technically necessary to do so. The following data are processed: IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, volume of data transferred in each case, website from which the request originates, browser, operating system and its interface, and language and version of the browser software. The purpose is to display the website. The legal basis is Article 6(1), first sentence, point (f) of the GDPR, with the legitimate interest arising from the purpose stated above.

Active use:

On this website, data subjects can register to use a restricted-access area, then log in and subsequently log out. The aim is for data subjects to purchase questionnaire licenses and then receive license codes that they can use to complete questionnaires. They then receive the assessment results. When data subjects do this, the controller collects the data they provide during registration. Within the restricted-access area, the controller records the data subjects’ actions to the extent necessary to provide that area and its functions. The following data are processed: (1) the registration data entered by the data subjects, (2) data about logins, (3) data about actions that the data subjects take within the login area, (4) data about logout status, (5) data about the questionnaires that the data subjects complete for analysis and the resulting findings, and (6) license codes and their redemption/use status. The purpose is to take steps prior to entering into contracts and/or to perform contracts. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

Anonymization

Email marketing:

The controller processes data subjects’ email addresses and names in order to send them useful information by email at regular or irregular intervals. It also stores information indicating that a contractual relationship exists or existed between them and the controller so that it can demonstrate its legitimate interest. The legitimate interest here arises from the fact that a contractual relationship exists between the data subjects and the controller, in the context of which email marketing is within the data subjects’ reasonable expectations. This is supported by Recital 47, sentence 7. The following data are processed: (1) email address, (2) name, and (3) data on the status of the contractual relationship. Specific notice of the right to object: Data subjects may object to the use of their data for this purpose at any time, for example by sending an informal message to the controller (contact channels can be found at the beginning of this notice and in the legal notice). In particular, data subjects may object without incurring any costs other than transmission costs at basic rates. The legal basis is Article 6(1), first sentence, point (f) of the GDPR, with the legitimate interest arising from the purpose stated above and Recital 47 of the GDPR.

Defense against claims:

If data subjects assert claims of any kind against this controller, the data are processed as follows:

1. The controller receives the request and stores all related data.

2. The controller uses these data to examine the request. If necessary, it seeks external legal advice.

3. If the request is justified, the controller uses the data to comply with it. Otherwise, it uses the data to inform the data subjects.

4. The controller retains the data generated through the processing described in points 1 to 3 for three years, beginning on December 31 of the calendar year in which step 3 took place. The legitimate interest for points 1 to 3 arises from the data subjects’ interest in having their claims addressed and the controller’s interest in avoiding claims and sanctions. The legitimate interest for point 4 arises from the controller’s need to be able to defend itself at a later date against civil claims and allegations of regulatory or criminal offenses. This interest in retaining the data under point 4 ends upon expiry of the limitation period under Sections 193 and 195 of the German Civil Code (BGB). The following data are processed: name, contact details, and the content of communications. The legal basis is Article 6(1), first sentence, point (f) of the GDPR, with the legitimate interest arising from the purpose stated above.

Form

The controller provides a form tool on the website. The tool enables communication between data subjects and the controller, with the data subjects’ entries being recorded and transmitted to the controller. The following data are processed: data about the content, nature, and extent of the entries made in the relevant form. The purpose is to take steps prior to entering into contracts and/or to perform contracts. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

Appointment booking

If data subjects wish to schedule a meeting with this controller, they can view available appointments and simply select one through an appointment booking portal embedded on this website. This controller then receives a notification from the appointment booking portal. The following data are processed: all data collected when the appointment is booked (generally name, email address, and appointment details). The purpose is to take steps prior to entering into contracts and/or to perform contracts. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

Payment

Data subjects visit the website and make declarations (for example, by selecting checkboxes or making shopping cart selections) with a view to entering into a contract that requires payment. The controller provides an online payment option for this purpose. Data subjects are directed to a payment provider that receives the payment order, executes it, and sends the controller confirmation that payment has been completed. The following data are processed: payment status. The purpose is to take steps prior to entering into contracts and/or to perform contracts. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

Automation of contract-related communications

The controller has automated parts of its communications with you in connection with entering into, performing, and/or ending contracts. In doing so, it processes all of the data subjects’ communication data that trigger automated responses from this controller, such as delivery of a product or service. In this context, it manages

1. the collection of your personal data during the steps prior to entering into the relevant contract,

2. the communications with data subjects (particularly by email) necessary to enter into, perform, and/or end the contract, and

3. the delivery of products and/or services.

The following data are processed: (1) all contact and order data you enter, (2) payment data, where applicable, (3) delivery data, and (4) data about the exercise of data subjects’ rights and this controller’s response. The purpose is to take steps prior to entering into contracts and/or to perform contracts. The legal basis is Article 6(1), first sentence, point (b) of the GDPR.

Affiliate (passiv)

External referrers (known as affiliates) recommend the controller’s products and services. They use their own online channels (social media profiles, websites, etc.) to publish ads or links that lead directly to this controller’s website. The controller collects this referral information and may link it to information about whether a contract has been entered into with the data subjects so that it can pay the affiliate a commission, where applicable. The purpose is to document successful referrals with the aim of acquiring new customers. This also constitutes the legitimate interest. The following data are processed: referral status, contract status, and the link to the affiliate’s identity. Article 6(1), first sentence, point (f) of the GDPR applies, with the legitimate interest arising from the purpose stated above.

Social media/networks

The controller uses social media platforms and social networks. It has no influence over the data collected or the data processing operations, nor does it have full knowledge of the scope of data collection, the purposes of processing, retention periods, or the circumstances in which personal data are erased. When data subjects visit the controller’s company and product pages on social media or view advertisements (ads), the providers of social media platforms and networks may store the data collected about them as usage profiles and use those profiles for advertising, market research, and/or tailoring their websites to users’ needs. Data subjects have the right to object to the creation of these user profiles and must contact the relevant provider to exercise that right. To the extent that this controller can influence the nature and scope of the associated processing of personal data, its purpose is to present the controller, analyze the data subjects’ usage behavior in their interactions with the company and/or product page maintained there, and communicate with the data subjects through that social network, including for marketing purposes where applicable.

If and to the extent that the controller analyzes visitors’ interactions with its company page, both the controller and the relevant provider of the social network or social media platform are joint controllers for that processing under Article 26 of the GDPR. In all other cases, the relevant provider of the social network or social media platform is engaged under Article 28 of the GDPR.

In addition to the general information about the legal basis, the following applies: If data subjects maintain their own profiles on the relevant social network or social media platform, the legal basis also includes the consent within the meaning of Article 6(1), first sentence, point (a) of the GDPR that they have given to the provider of the relevant social network.

The following data are processed: cookie- or pixel-based data about interactions with the website and the controller’s company and/or product pages, and, where applicable, email address, name, and communication data.

Video playback

A video playback tool is used to show data subjects the controller’s videos and/or third-party videos on this website and, where applicable, on the controller’s channel. When data subjects start these videos, both the provider of the video playback solution and the controller record this so that they can subsequently show the data subjects information and ads tailored to their interests. The following data are processed: cookie-based data containing (1) information that the data subjects have visited this website (and, where applicable, the specific subpage) and (2) information that a particular video was clicked. The legal basis is the data subjects’ consent (Article 6(1), first sentence, point (a) of the GDPR).

Useful information by email

The controller may process data subjects’ data in order to send them useful marketing information by email. This takes the form of an electronic newsletter sent at regular and irregular intervals. Initially, data subjects provide the controller with the data it requests for registration. Once the double opt-in process has been completed, the controller uses these data to send the data subjects marketing communications through these emails. The following data are processed: the data that data subjects voluntarily provide to the controller for this purpose (generally email address and name), the data it needs to demonstrate that consent has been given (opt-in status data), and, where applicable, data relating to withdrawal of consent.

External fonts

External font directories are accessed in connection with the website. This involves transferring data to external providers, which use the data to evaluate the performance and success of particular typefaces in order to optimize the fonts they offer. Specifically, the following occurs: As soon as data subjects visit this website, their browsers send HTTP requests to the external font providers. Among other things, the URL requested identifies the font families for which the user wishes to load fonts. These data are logged so that the external provider can determine how often a particular font family is requested. The font is also adapted to the relevant browser type, which in turn requires data about the browser type to be collected and stored. These data are processed to generate aggregate usage statistics that measure the popularity of font families. This also produces statistics that are used to optimize the fonts. Finally, the referring URL is logged so that the data can be used to perform production maintenance and generate an aggregate report on the top integrations based on the number of font requests. The retention period depends on the relevant provider. The following data are processed: cookie-based data about interactions (in particular, their sequence and the time spent on the website).

After active use ends:

After active use ends, the data are stored until the end of their respective retention periods and then erased. The purpose of erasure is compliance with a legal obligation within the meaning of Article 5(1)(a) and (e) of the GDPR. The legal basis is Article 6(1), first sentence, point (c) of the GDPR.

The following retention periods apply:

6. The questionnaire responses and the resulting findings are stored for 12 months after the questionnaire is submitted or until a justified objection from the data subjects is received, whichever occurs first. The legal basis is Article 6(1), first sentence, point (f) of the GDPR. The legitimate interest in processing arises from the need to be able to access the questionnaire results at a later date if they are lost. Other retention obligations remain unaffected.

Processors and third parties that receive data

The following third-party providers receive personal data:

Third-party provider: The web hosting service “raidboxes” from Raidboxes GmbH (Germany – EU), which has also been engaged under Article 28 of the GDPR, is used.

Third-party provider: The social network “Facebook” from Meta Platforms Ireland Limited (Ireland – EU) is used. However, a transfer of data to, or involvement of, its parent company, Meta Platforms Inc. (United States), cannot be ruled out. To the extent that the controller and the provider of the social network or social media platform described here are joint controllers, their agreement can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum. It contains all information about the scope of application and the allocation of responsibilities. In all other cases, the provider of the social network or social media platform has been engaged under Article 28 of the GDPR. The fact that a transfer of data to, or involvement of, the parent company based in the United States cannot be ruled out does not preclude the use of this third-party provider. The fact that Meta Plattforms, Inc. is based outside the EU does not preclude this transfer. For all data other than employee data, the transfer is justified under Article 45 of the GDPR. For employee data, the sub-processor has committed to the EU standard contractual clauses, so the transfer is justified under Article 46 of the GDPR. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary).

Third-party provider: The social network “Instagram” from Meta Platforms Ireland Limited (Ireland – EU) is used. However, a transfer of data to, or involvement of, its parent company, Meta Platforms Inc. (United States), cannot be ruled out. To the extent that the controller and the provider of the social network or social media platform described here are joint controllers, their agreement can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum. It contains all information about the scope of application and the allocation of responsibilities. In all other cases, the provider of the social network or social media platform has been engaged under Article 28 of the GDPR. The fact that a transfer of data to, or involvement of, the parent company based in the United States cannot be ruled out does not preclude the use of this third-party provider. The fact that Meta Plattforms, Inc. is based outside the EU does not preclude this transfer. For all data other than employee data, the transfer is justified under Article 45 of the GDPR. For employee data, the sub-processor has committed to the EU standard contractual clauses, so the transfer is justified under Article 46 of the GDPR. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary).

Third-party provider: The social network “LinkedIn” from LinkedIn Ireland Unlimited Company (Ireland – EU) is used. However, a transfer of data to, or involvement of, its parent company, LinkedIn Corporation (United States), cannot be ruled out. The fact that a transfer of data to, or involvement of, the parent company based in the United States cannot be ruled out does not preclude the use of this third-party provider. The parent company has committed to the EU standard contractual clauses, so the transfer is justified under Article 46 of the GDPR. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary).

Third-party provider: The social network “X” from Twitter International Company (Ireland – EU) is used. However, a transfer of data to, or involvement of, its parent company, X Corp. (United States), cannot be ruled out. Further details about how this third-party provider processes data are available here: https://twitter.com/de/privacy. The fact that a transfer of data to, or involvement of, the parent company based in the United States cannot be ruled out does not preclude the use of this third-party provider. The parent company has committed to the EU standard contractual clauses, so the transfer is justified under Article 46 of the GDPR. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary).

Third-party provider: The social network “Xing” from New Work SE (Germany – EU) is used. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary).

Third-party provider:The social network “TikTok,” jointly provided by TikTok Technology Limited (EU – Ireland) and TikTok Information Technologies UK Limited (United Kingdom of Great Britain and Northern Ireland), is used. However, the providers’ privacy notice states that they also share data with other companies in their “corporate group” without specifying which companies belong to that group. Despite public statements to the contrary, it therefore cannot be ruled out that data are transferred to and processed by companies in the United States and/or the People’s Republic of China, in particular the parent company Beijing Bytedance Technology Ltd. (People’s Republic of China). To the extent that the controller and the third-party providers of the social network or social media platform described here are joint controllers, they have entered into a joint controllership arrangement under Article 26 of the GDPR. In all other cases, the provider of the social network or social media platform has been engaged under Article 28 of the GDPR. The fact that transfers of data to either the United States or the People’s Republic of China cannot be ruled out does not preclude the use of this third-party provider. The transfer takes place only if the data subject has explicitly consented to it in the individual case, so the transfer is justified under Article 49(1)(a) of the GDPR. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary). The fact that transfers of data to either the United States or the People’s Republic of China cannot be ruled out does not preclude the use of this third-party provider. The transfer takes place only if the data subject has explicitly consented to it in the individual case, so the transfer is justified under Article 49(1)(a) of the GDPR. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary).

Third-party provider: Es wird das soziale Netzwerk „Pinterest“ der Pinterest Europe Ltd. (Irland – EU) eingesetzt. Es ist jedoch nicht auszuschließen, dass eine Datenübermittlung zur oder eine Einbindung der Muttergesellschaft, der Pinterest Inc. (USA) stattfindet. The social network “Pinterest” from Pinterest Europe Ltd. (Ireland – EU) is used. However, a transfer of data to, or involvement of, its parent company, Pinterest Inc. (United States), cannot be ruled out. The fact that a transfer of data to, or involvement of, the parent company based in the United States cannot be ruled out does not preclude the use of this third-party provider. Personal data are processed through this tool only if the data subjects consent to the associated data transfer to the United States (see Article 49(1)(a) of the GDPR). Consent is given to this controller to the extent that it controls the data processing. If the provider of the social network or social media platform described here controls the processing (for example, when data subjects visit the social network independently of any action on this website), there is no transfer to the United States by the controller, so this controller does not need to provide any additional safeguard within the meaning of Article 44 et seq. of the GDPR. In that case, the relationship between this controller and the provider of the social network is, at most, one within the meaning of Article 26 of the GDPR. The following additional information applies to this provider: The controller maintains a company page with this third-party provider (see Glossary).

Third-party provider: The video playback tool “YouTube” from Google Ireland Ltd. (Ireland – EU), which has been engaged under Article 28 of the GDPR, is used. However, a transfer of data to, or involvement of, its parent company, Google LLC (United States), cannot be ruled out. The fact that data are transferred to the United States, possibly with the involvement of Google LLC (United States), does not preclude the processing, as the transfer is justified under Article 45 of the GDPR. The following can also be noted about this third-party provider: The controller has its own channel on this video platform. Media recordings are created and published there.

Third-party provider:“Woocommerce” from Automattic Inc. (United States) is used as the online store system. The fact that the third-party provider is based outside the European Union does not preclude its engagement, as the transfer is justified under Article 45 of the GDPR.

Third-party provider: The automation tool “Brevo” from Brevo GmbH (Germany – EU), which has been engaged under Article 28 of the GDPR, is used for contract-related communications.

Third-party provider: The “Google Fonts” directory from Google Ireland Ltd. (Ireland – EU), which has been engaged under Article 28 of the GDPR, is used to provide the external font. The following additional information applies: IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent, and referring URL). Access to these data is restricted and strictly controlled. Google does not use any information collected by Google Fonts to create profiles of end users. Only the fonts (one year) and the associated CSS files (one day) are stored on the user’s device. The fact that data are transferred to the United States, possibly with the involvement of Google LLC (United States), does not preclude the processing, as the transfer is justified under Article 45 of the GDPR.

Third-party provider:The payment tool “Mollie” from Mollie B.V (Netherlands – EU) may be used for payments.

Glossary

Topic: Basic terms

Personal data:Any information that directly or indirectly allows inferences to be drawn about natural persons, i.e., human beings.

Processing of personal data:Any active or passive handling of personal data, from collection through the main processing operations to erasure.

Consent: A demonstrable indication of wishes, freely given before personal data are processed, that permits specific processing of the personal data of the data subject giving consent.

Topic: Social media

Topic: Embedded videos

Own channel: This term means that the controller operates its own channel on the video platform.

Publication of media recordings:This term means that the controller uploads media recordings of data subjects (photographs, audio recordings, and/or video recordings) to the relevant video platform and publishes them there.