Privacy Policy (information on data protection regarding our data processing in accordance with Articles 12, 13, 14 and 21 General Data Protection Regulation)
Thank you for visiting our website and for your interest in our company. The protection of your personal data is important to us. Below we inform you in accordance with Articles 12, 13, 14 and 21 General Data Protection Regulation (“GDPR”) about the handling of your personal data when using our website https://instawerk.de (hereinafter “website“) as well as our web application at https://fraesen.instawerk.de (hereinafter “web app“).
Personal data is individual information about the personal or factual circumstances of an identified or identifiable natural person. This includes information such as name, address, telephone number and date of birth.
A. General information
I. Controller
Instawerk GmbH
Zettachring 12A
70567 Stuttgart
phone: +49 (0) 711-2637-56-02
email: info@instawerk.de
II. Hosting
We host the content of our website with the following provider:
IONOS SE
Elgendorfer Straße 57
56410 Montabaur
We host the content of our web app with the following provider:
Microsoft Deutschland GmbH
Walter-Gropius-Straße 5
80807 München
III. General information on the legal bases of data processing on the website
If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, insofar as special categories of personal data are processed in accordance with Art. 9 para. 1 GDPR. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 para. 1 lit. a GDPR. If you have consented to the storage of cookies or access to information in your end device (e.g., via device fingerprinting), the data processing is also carried out on the basis of sec. 25 para. 1 German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – “TDDDG”). Consent can be withdrawn at any time. If your data is required to fulfil the contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR. Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.
B. Use of our website: Purposes and legal basis of data processing
I. Informational use of the website
You can visit our website without providing any personal data. If you only use our website for informational purposes, that is, if you do not sign up, place an order, or otherwise provide us with personal information, we do not process any personal data, with the exception of the data your browser transmits to enable you to visit the website, as well as information transmitted to us through the use of cookies.
1. Technical provision of the website
a) Log files/provision of website
For the purposes of the technical provision of the website, our system (i.e., the web server) automatically collects information from your browser each time you visit the website.
Our system needs to store your IP address temporarily in order to deliver the website to your computer. To do this, your IP address must necessarily be stored for the duration of the session.
IP addresses are stored in the log files to ensure that our website functions properly. We also use this data to optimise the website and to ensure the security of our IT systems (e.g., attack detection).
The following information is collected in the process:
· IP address;
· Browser type/version (e.g., Firefox 59.0.2 (64 bit));
· Browser language (e.g., German);
· Operating system used;
· Internal resolution of the browser window;
· Screen resolution;
· JavaScript enabled;
· Java enabled/disabled;
· Cookies On / Off;
· Colour depth;
· Time of the request.
We also use cookies to make certain technical features of our website available to you. Some features of our website cannot be provided without the use of cookies. You can find further information about cookies in the Consent Management section.
We process your personal data for the technical provision of our website on the following legal bases:
· To fulfil a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR, provided that you visit our website to find out about our company and our products/services; and
· to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in order to make the website technically available to you. Our legitimate interest is to provide you with an appealing, technically functioning and user-friendly website and to take measures to protect our website from cyber risks and to prevent our website from posing cyber risks to third parties.
b) Consent Management
On our website, we use the CookieFirst consent manager. The provider of this technology is Digital Data Solutions B.V. (CookieFirst), Plantage Middenlaan 42a, 1018DH, Amsterdam, Netherlands (hereinafter “Consent Manager”).
We use the Consent Manager to obtain your consent to specific data processing that requires consent (e.g., analytics, tracking, etc.). By using the Consent Manager, we can inform you about the individual cookies and tools we use. You can use the Consent Manager to choose which cookies and tools you wish to allow or reject categorically. The Consent Manager also provides an overview of the cookies used, as well as the option to amend or withdraw your consents. This enables you to make an informed decision about the transfer of your data and allows us to use cookies and tools in a transparent and documented manner that complies with data protection regulations.
The Consent Manager processes your personal data in order to record your decision regarding your consent to cookies and tools and to save it for a return visit to our website. This includes, amongst other things, the relevant cookie containing your (consent) decision, as well as other usage data, e.g., IP address, domain name, time of the request, server data (including data transmission types, server status, etc.), country, browser and operating system.
Further information and the Consent Manager’s privacy policy can be found at: https://cookiefirst.com/de/cookies-erklaerung/ or https://cookiefirst.com/legal/privacy-policy/.
We process your personal data for the technical provision of our website on the following legal bases:
· For the technical provision of our website and consent management in accordance with sec. 25 para. 2 no. 2 TDDDG, as the processing of the above-mentioned data is absolutely necessary so that we can enable you to use our website as expressly requested by you (i.e., also without or with cookies);
· to fulfil a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR, insofar as you visit our website to conclude a contract with us (e.g., for products or services) or to find out about our products or services;
· for the use of cookie management in order to comply with a legal obligation to which we as the controller are subject pursuant to Art. 6 para. 1 lit. c GDPR. The legal obligation lies in informing you about the cookies we use and obtaining and documenting your consent to data processing; and
· to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in order to be able to provide you with technical cookie management. Our legitimate interest is to be able to provide you with an appealing, technically functioning and user-friendly cookie management system, as well as to take measures to protect cookie management against cyber risks and to prevent cookie management from posing cyber risks to third parties.
2. Analysis and tracking
For the purpose of analysing and tracking the use of our website, we or the service providers working for us use cookies and tools that enable an evaluation of your browsing behaviour. This enables us to improve the quality of our website and its content. We learn how the website is used and can thus constantly optimize our offer.
For more information about the cookies, their purposes and functions, the data processed in each case, the data recipients, the place of processing or transfer to so-called third countries (outside the EU/EEA), as well as the storage periods, please look at the Consent Manager.
We process your personal data on the following legal bases:
· Your consent pursuant to Art. 6 para. 1 lit. a GDPR and sec. 25 para. 1 TDDDG. Consent can be withdrawn at any time.
· For other plugins and tools, processing is carried out on the basis of Art. 6 para. 1 lit f GDPR. The website operator has a legitimate interest in the quick and easy integration and management of various tools on its website.
In addition to the cookies listed in the Consent Manager, we use the following tools and services:
a) Google Tag Manager
We use Google Tag Manager on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google Tag Manager”).
Google Tag Manager is a tool that enables us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out any independent analysis. Its use is limited to managing and running the tools integrated through it. However, Google Tag Manager does collect your IP address, which may also be transferred to Google’s parent company in the United States.
Data is transferred to the USA on the basis of an adequacy decision pursuant to Art. 46 GDPR. Google is certified under the so-called Data Privacy Framework. For further information, see: https://www.dataprivacyframework.gov/list.
We process your personal data on the following legal bases:
· For the technical provision of the tag manager and the cookies you have expressly selected, in accordance with sec. 25 para. 2 no. 2 TDDDG.
· Furthermore, Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website.
b) Google Analytics
This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google Analytics”).
Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used and the user’s location. This data is associated with the user’s respective end device. It is not linked to a user ID.
Google Analytics uses technologies that enable users to be recognised for the purpose of analysing user behaviour (e.g., cookies or device fingerprinting). The information collected by Google regarding the use of this website is usually transferred to a Google server in the USA and stored there.
The use of Google Analytics is based on Art. 6 para. 1 lit. a GDPR and sec. 25 para. 1 TDDDG, insofar as consent covers the storage of cookies or access to information on the user’s end device within the meaning of the TDDDG. Consent can be withdrawn at any time.
Data is transferred to the USA on the basis of an adequacy decision pursuant to Art. 46 GDPR. Google is certified under the so-called Data Privacy Framework. For further information, see: https://www.dataprivacyframework.gov/list.
We have enabled the IP anonymisation feature on this website. This means that your IP address will be truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.
You can prevent Google from collecting and processing your data by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
For more information on how Google Analytics handles user data, please see Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=de.
We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities when using Google Analytics.
c) Google Ads and Google Conversion-Tracking
We use Google Ads and Google Conversion Tracking.
Google Ads is an online advertising programme provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google Ads”). Google Ads enables us to display advertisements on the Google search engine or on third-party websites when users enter specific search terms into Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on user data held by Google (e.g., location data and interests) (audience targeting). As the website operator, we can evaluate this data quantitatively by, for example, analysing which search terms led to our advertisements being displayed and how many advertisements resulted in corresponding clicks.
The use of Google Ads is based on Art. 6 para. 1 lit. a GDPR and sec. 25 para. 1 TDDDG, insofar as consent covers the storage of cookies or access to information on the user’s end device within the meaning of the TDDDG. Consent can be withdrawn at any time.
Data is transferred to the USA on the basis of an adequacy decision pursuant to Art. 46 GDPR. Google is certified under the so-called Data Privacy Framework. For further information, see: https://www.dataprivacyframework.gov/list.
Conversion cookies are used to generate conversion statistics for AdWords customers who use conversion tracking. AdWords customers can see how many users have clicked on their advert and been redirected to pages with a conversion tracking tag. However, AdWords customers do not receive any information that would allow them to personally identify users. If you do not wish to participate in tracking, you can opt out. To do so, you must disable the conversion cookie in your browser’s user settings. This will ensure that you are not included in the conversion tracking statistics. Further details on Google AdWords and Google Conversion Tracking can be found in Google’s Privacy Policy: https://www.google.de/policies/privacy/. Using a modern web browser, you can monitor, restrict or prevent the setting of cookies. Disabling cookies may result in limited functionality on our website.
d) Microsoft Clarity
We use features of the web analytics service Clarity provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (hereinafter “Clarity”). Clarity enables us to analyse how our website is used. It records mouse movements and clicks with the aim of identifying potential improvements to the website. The information collected is transmitted to Clarity and stored there. According to Microsoft, this information may also be used for advertising purposes. Clarity also uses cookies. You can find out more about the use of cookies in the Consent Manager. Further information is available at https://clarity.microsoft.com. Clarity’s privacy policy can be found at: https://privacy.microsoft.com/de-de/privacystatement. You can exercise your right to object and opt out here: https://choice.microsoft.com/de-DE/opt-out. To ensure full compliance with statutory data protection requirements, we have entered into a data processing agreement with Microsoft.
The use of Microsoft Clarity is based on Art. 6 para. 1 lit. a GDPR and sec. 25 para. 1 TDDDG, insofar as consent covers the storage of cookies or access to information on the user’s end device within the meaning of the TDDDG. Consent can be withdrawn at any time.
Data is transferred to the USA on the basis of an adequacy decision pursuant to Art. 46 GDPR. Microsoft is certified under the so-called Data Privacy Framework. For further information, see: https://www.dataprivacyframework.gov/list.
3. Plugins and Tools
a) Google Fonts
This website uses web fonts from Google Fonts to ensure consistent display of certain typefaces. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google Fonts”).
When you visit this website, your browser loads the necessary fonts directly from Google Fonts so that they can be displayed correctly on your end device. In doing so, your browser establishes a connection to Google’s servers in the USA. As a result, Google Fonts becomes aware that this website has been accessed via your IP address.
The use of Google Fonts is based on Art. 6 para. 1 lit. a GDPR and sec. 25 para. 1 TDDDG, insofar as consent covers the storage of cookies or access to information on the user’s end device within the meaning of the TDDDG. Consent can be revoked at any time. Furthermore, the use of this information is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to be able to provide you with a visually appealing website.
Data is transferred to the USA on the basis of an adequacy decision pursuant to Art. 46 GDPR. Google Fonts is certified under the so-called Data Privacy Framework. For further information, see: https://www.dataprivacyframework.gov/list.
For further information on Google Fonts, please visit: https://fonts.google.com/.
4. Social links
The website contains links to the Facebook, X (formerly Twitter), LinkedIn, YouTube and Instagram services. After clicking on the link, you will be redirected to another website, i.e., only then will user information be transferred to the respective page. For information on the handling of your data when using the social media pages, please refer to the privacy policies:
· Facebook: https://de-de.facebook.com/policy.php
· X, formerly Twitter: https://x.com/en/privacy
· LinkedIn: https://de.linkedin.com/legal/privacy-policy
· YouTube: https://policies.google.com/privacy?hl=de
· Instagram: https://about.instagram.com/safety/privacy
II. Active use of the website
In addition to the purely informational use of our website, you can also actively use our website to order one of our products, download information, sign up for a newsletter or an event, or get in touch with us. In addition to the processing of your personal data described above for purely informational use, we will then also process other personal data from you which we need, e.g., to process your order.
1. User inquiries
In order to be able to process and respond to your inquiries to us, e.g., via contact forms, to our e-mail address or via chat, we process the personal data you provide in this context. This always includes your name and e-mail address in order to send you a reply, as well as any other information that you send us as part of your message.
For the contact form, we use the open-source tool ‘Contact Form 7’, which is integrated directly into our website via WordPress.
We process your personal data to respond to user inquiries on the following legal basis:
· To safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in responding appropriately to user inquiries;
· if the inquiry is aimed at the conclusion of a contract, the additional legal basis is Art. 6 para. 1 lit b GDPR;
· if the inquiry is aimed at the assertion of your rights as a data subject, the additional legal basis is Art. 6 para. 1 lit. c GDPR, as the processing of your data is necessary for the fulfilment of legal obligations.
In addition to the above-mentioned contact method, it is also possible to contact us via the chat functions of Facebook, Instagram and YouTube. Further information on data collection in relation to Facebook, Instagram and YouTube can be found in Sec. C.
2. Registration and user account
You can register on our website or via the web app to create a user account, which you can then use to place orders or request a quotation in our online shop, commission and use services, or manage your orders, services and the details in your user account (e.g., billing and delivery addresses). In these cases, you must enter personal data into an input form and submit it to us.
The purpose of registration and login is to provide access to our online shop, our services and the associated functions (ordering/request for quotation/commissioning/using services), as well as to provide a corresponding user account and the ability to manage it. The user account makes it easier, for example, to place future orders by avoiding the need to re-enter contact details. Your data may also be stored by us in other CRM tools for this purpose.
For this purpose, you must provide your email address and a password of your choice. In addition, you can provide the following data on a voluntary basis:
· Salutation
· First name and surname
· Private or business customer status
· Company name for business customers
· VAT number / CHE number for deliveries outside Germany
· Billing and delivery address
· Telephone number
· Order and inquiry number
· Instawerk supplier number
· Email addresses of colleagues who should also receive offers and correspondence
· Email correspondence regarding the order
· Department
· Industry
· VAT number / CHE number for deliveries within Germany
· Additional billing information
· Additional delivery information
We also store information relating to the customer’s domain name in our ERP system, to the extent that this is necessary for business correspondence.
We process your data for the above purpose on the following legal basis:
· To fulfil a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR, as registration and the login area are necessary for the fulfilment of the (user) contract or for carrying out pre-contractual measures.
3. Online shop and ordering and request for quotation process
Through our online shop, we enable you to place an order or request a quotation from our range of products or services. You can select products and services from our range in the online shop and add them to your cart. All products and services, along with their quantities, are saved in your cart. To make placing your order easier, we also save any orders that have not yet been completed, so that you can finalise them on your next visit.
The ordering and request for quotation process serves the purpose of entering into a contract with us. Data processing within the ordering and request for quotation system and form therefore serves to conclude, fulfil and/or terminate your contract.
The following data is collected as part of the ordering and request for quotation process:
· Salutation
· First name and surname
· Private or business customer status
· Company name for business customers
· VAT number / CHE number for deliveries outside Germany
· Billing and delivery address
· Telephone number
· Technical specifications of the order/request
· Number of products
You may provide the following data on a voluntary basis:
· Company name for business customers
· Order and inquiry number
· Instawerk supplier number
· Email addresses of colleagues who should also receive offers and correspondence
· Email correspondence regarding the order
· Department
· Industry
· VAT number / CHE number for deliveries within Germany
· Additional billing information
· Additional delivery information
· Customer item numbers
· Inquiry and order documents
· Further files and documents relevant to production
We process your data for the above purpose on the following legal basis:
● To fulfil a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR.
4. Marketing purposes, e.g., newsletters, document downloads
With your consent, we use your data for marketing purposes, e.g., sending our newsletter or customer magazine, conducting marketing surveys, sending product information, inviting you to events that may be of interest to you, follow-ups, status updates, market research and other marketing and promotional campaigns. In doing so, we collect mandatory details such as your email address, as well as information that you provide to us voluntarily. We use the voluntary information to continuously improve our customer relationship.
If you have provided us with your email address in connection with the purchase of goods or services, we may subsequently use it to send you a newsletter. In such cases, the newsletter will contain only direct marketing for our own similar goods or services.
We process your data for the purpose of sending newsletters, surveys, etc., and to personalise our communications with you, on the following legal basis:
· Provided that you have given us your consent, in accordance with Art. 6 para. 1 lit. a GDPR;
· provided that you have supplied us with your email address in connection with the purchase of goods or services, or if we send you personalised advertising, in order to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with sec. 7 para. 3 Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb – UWG); our legitimate interest is based on our commercial interests in carrying out advertising activities and target-group-oriented advertising.
Right to object when used in the context of concluding a contract
If we receive your email address in connection with the conclusion of a contract and the provision of our products, and you have not objected to this, we reserve the right to send you regular offers for similar products from our range by email. You may object to this use of your email address at any time by contacting us via the contact details provided below or via a link provided for this purpose in the newsletter email, without incurring any costs other than the transmission costs charged at standard rates.
5. Application
If you apply for a job with us, we will process the data you provide in order to process your application and carry out the recruitment process.
If we enter into an employment contract with you, the data you provide will be stored for the purpose of establishing and carrying out the employment relationship, in accordance with the relevant legal provisions (e.g., in your personnel file, where necessary for the employment relationship). If your application is rejected, we will automatically delete your application documents and the data they contain once the decision to reject your application has been communicated to you, provided that there are no other legitimate interests preventing such deletion. Other legitimate interests may exist, for example, if we are subject to a duty to provide evidence in proceedings under the German General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz – AGG).
Data may also be retained for a longer period if you have given your consent in accordance with Art. 6 para. 1 lit. a GDPR, or if statutory retention obligations prevent the data from being erased.
We process your personal data on the following legal bases:
· In accordance with Art. 6 para. 1 lit. b GDPR for the purposes of establishing, carrying out and terminating an employment relationship (where applicable, in conjunction with country-specific legislation in the case of a job application outside Germany);
· for the storage of your candidate profile beyond the scope of a specific application, subject to your consent, Art. 6 para. 1 lit. a GDPR.
Processing of special categories of personal data
Special categories of personal data, as defined in Art. 9 GDPR, are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs (e.g., details of religious affiliation or denomination) or trade union membership, as well as the processing of biometric data for the purpose of uniquely identifying an individual (e.g., photographs), health data (e.g., details of the degree of severe disability) or data relating to sex life or sexual orientation. If your CV contains special categories of personal data, we do not intentionally collect such data. We expressly ask you not to send us such data.
If, as part of your application documents, you voluntarily provide us with special categories of personal data as defined in Art. 9 para. 1 GDPR (e.g., your photograph or details of your religious affiliation/denomination, where applicable), contrary to our express request, we will store this data on the basis of your consent in accordance with Art. 9 para. 2 lit. a GDPR. This also applies if you provide us with further special categories of personal data during the course of the application process. By voluntarily providing this data, you consent to the storage of these special categories of personal data as part of the application process.
As a general rule, we do not take these special categories of personal data into account when making a selection decision, unless it is required or necessary to collect and take these special categories of personal data into account due to a legal obligation. For example, in some job advertisements, it is possible that people with disabilities may be given preferential treatment in accordance with the applicable laws. In such cases, the provision of this information is always voluntary and takes place with your express consent, which you give by voluntarily submitting this data.
We process your special categories of personal data on the following legal bases:
· In accordance with Art. 9 para. 2 lit. a GDPR, on the basis of your consent;
· where legal provisions require the processing of special categories of personal data for the purposes of the application in the specific case, Art. 9 para. 2 lit. b GDPR in conjunction with the relevant legal provision;
III. Assertion and enforcement of legal claims
We also process your personal data on our website in order to assert our rights and enforce our legal claims. We also process your personal data in order to be able to defend ourselves against legal claims. Finally, we process your personal data insofar as this is necessary for the prevention or prosecution of criminal offenses.
We process your personal data for this purpose on the following legal basis:
· To safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, insofar as we assert legal claims or defend ourselves in legal disputes or prevent or investigate criminal offences.
IV. Compliance with legal regulations
We also process your personal data on our website in order to fulfil other legal obligations. These may apply to us in connection with the processing of the order or business communication. These include, in particular, retention periods under commercial, trade or tax law.
We process your personal data on the following legal basis:
· To fulfil a legal obligation to which we are subject pursuant to Art. 6 para. 1 lit. c GDPR in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data.
V. Company sales/mergers, etc.
We may process your personal data in order to complete a (partial) sale of business or merger (or similar transaction such as a takeover in the context of liquidation, insolvency, dissolution, etc.) with another company. In the event that another company acquires or intends to acquire the assets from us, which may include your personal data, or we carry out or seek to carry out a merger with another company, we may have to grant this company access to your personal data stored by us or transfer it for the purpose of examining and carrying out the company sale/merger (e.g., to determine the value of the company or business risks, to transfer the data/assets, etc.).
We process your personal data on the following legal basis:
· To safeguard our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR in order to organize and implement a planned company sale or a planned merger.
VI. Links
Some sections of our website contain links to third-party websites. These websites are subject to their own data protection principles. We are not responsible for their operation, including data handling. If you send information to or via such third-party sites, you should check the data protection declarations of these sites before you send them information that can be assigned to you personally.
VII. Categories of recipients
Initially, only our employees receive knowledge of your personal data.
Your data will only be passed on to third parties if this is permitted or required by law or if you have given your consent. We also share your data to the extent necessary with the service providers we use in order to provide our services. We limit the transfer of data to what is necessary to provide our services to you. In some cases, our service providers receive your data as processors and are then strictly bound by our instructions when handling your data. In some cases, the recipients act independently with your data that we transmit to them.
The categories of recipients of your data are listed below:
· IT service providers who e.g., store data, support the administration and maintenance of systems, document archiving and document destruction service providers as well as providers of social media platforms;
· Debt collection agencies and legal advisors in the assertion and enforcement of our claims;
· Public bodies and institutions, insofar as we are legally obliged to do so;
· Payment service providers and banks for collecting outstanding payments or paying refunds;
· Agencies, printing companies and mail-merge service providers who assist us in carrying out advertising campaigns, raffles, promotions, etc.;
· Logistics service providers to deliver goods, etc.; and
· Credit reference agencies when requesting a credit report.
VIII. Third country transfer
Data is only transferred to countries outside the EU or the EEA (hereinafter “third country/countries”) if this is necessary as part of the processing of our contractual relationships or required by law (e.g., tax reporting obligations), if you have given us your consent or as part of order processing.
In connection with the use of cookies and similar applications, we transfer your IP address, or your truncated IP address, and, in some cases, other data to countries outside the EU. The transfer of data is based either on adequacy decisions by the European Commission or on the standard contractual clauses drafted and made available by the European Commission, which we have agreed with the relevant providers.
Furthermore, where service providers in a third country are engaged and we are able to influence this, they are obliged, in addition to written instructions, to comply with European data protection standards by means of the EU Standard Contractual Clauses. Alternatively, we transfer the data on the basis of Binding Corporate Rules or an adequacy decision by the European Commission. Further information is available from our Data Protection Officer.
Otherwise, we do not transfer your personal data to countries outside the EU or the EEA or to international organizations.
IX. SSL or TLS encryption
This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries that you send to us as the website operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
X. Duration of storage
1. Informational use of the website
If you use our website purely for informational purposes, we store your personal data on our servers exclusively for the duration of your visit to our website. Once you have left our website, your personal data will be deleted immediately.
Cookies installed by us are usually deleted once you leave our website. However, some cookies are stored for longer; you can find more information about the retention periods for the cookies and tools we use via the Consent Manager. You also have the option of deleting installed cookies yourself at any time.
2. Active use of the website
When you actively use our website, we initially store your personal data for the duration of the response to your inquiry or for the duration of our business relationship. This also includes the potential future and actual initiation of a contract (pre-contractual legal relationship) and the execution of a contract.
We process your data for the duration of your subscription to our newsletter, the receipt of other advertising communication or for the duration of our marketing campaigns or until you withdraw your consent to receive such communications or participate in such campaigns. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract.
In addition, we then store your personal data until any legal claims arising from the relationship with you become time-barred, in order to use it as evidence if necessary. The statutory limitation period is usually between one and three years, but can also be up to 30 years.
We delete your personal data when the statutory limitation period expires, unless there is a statutory retention obligation, for example under the German Commercial Code (Handelsgesetzbuch – “HGB”; secs. 238 and 257 para. 4 HGB) or the German Fiscal Code (Abgabenordnung – “AO”; sec. 147 paras. 3 and 4 AO). These retention obligations can last from two to ten years. For this period, the data is processed again solely in the event of an audit by the tax authorities.
XI. Scope of your obligations to provide data
In principle, you are not obliged to provide us with your personal data. However, if you do not do so, we will not be able to make our website available to you, answer your inquiries, send you information etc. or enter into a contract with you.
XII. Profiling / automated decision-making
We do not carry out any profiling and do not use any purely automated decision-making processes in accordance with Art. 22 GDPR. Should we use further procedures in individual cases in the future, we will inform you of this separately.
C. Data processing for social media use
To present our company and communicate directly with you, we use social media platforms from providers such as LinkedIn, Facebook and others (hereinafter “Provider(s)”), through which we maintain our social media presence (e.g., in the context of company and employee profiles) and process your data.
I. Shared responsibility
If data is collected on our social media presence that both the Provider and we process and use for joint purposes (e.g., in the context of analysis or advertising), the Provider and we are joint controllers. It is often not possible for us to deactivate this function. You can therefore contact both the respective Provider and us with your request. We currently use the following Providers:
· Facebook and Instagram, as products of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Meta”);
· X, operated by X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland;
· LinkedIn (including LinkedIn Sales Navigator) operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (address of the German branch: LinkedIn Germany GmbH, Sendlinger Str. 12, 80333 Munich); and
· YouTube, operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (address of the German branch: Google Germany GmbH, ABC-Straße 19, 20354 Hamburg).
Below you will find the links to the data protection declarations and information of the respective Providers:
· Facebook: https://de-de.facebook.com/policy.php
· Instagram: https://about.instagram.com/safety/privacy
· LinkedIn: https://de.linkedin.com/legal/privacy-policy
· YouTube: https://policies.google.com/privacy?hl=de
II. Data protection officer of the Providers
In addition to our data protection officer, you can also contact the following data protection officers of the respective Providers:
· LinkedIn: https://www.linkedin.com/help/linkedin/ask/TSO-DPO
· Meta: https://help.meta.com/support/privacy/
· X: https://help.x.com/en/forms
· Google: https://support.google.com/policies/contact/general_privacy_form
III. Purposes and legal basis of data processing
1. Informational use of our social media presence
a) Provision of the social media presence
For the purpose of the technical provision of the social media presence, our system (i.e., the web server) automatically collects information from your browser each time you access the social media presence.
You can visit our social media presence without providing any personal data. If you only use our social media presence for informational purposes, i.e., if you do not register or otherwise provide us with information about yourself, we do not process any personal data, with the exception of the data that the operator collects within the framework of its platform and the cookies it uses and, if applicable, transmits to us.
We or the Provider process your personal data for the technical provision of our social media presence on the basis of the following legal bases:
· To fulfil a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR, insofar as you visit our social media presence to find out about our company and our products/services; and
· to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in order to make our social media presence technically available to you. Our legitimate interest is to be able to provide you with an appealing, technically functioning and user-friendly social media presence and to take measures to protect our social media presence from cyber risks and to prevent our social media presence from posing cyber risks to third parties.
b) Analysis and tracking
For the purpose of analysing and tracking the use of its social media platform and our social media presence, the Provider uses cookies that enable an evaluation of your browsing behaviour. This allows us to improve the quality of the platform and our social media presence and their content. We learn how the platform and our social media presence are used and can thus constantly optimise our offer.
However, we have no influence on the data collected and data processing procedures, nor are we aware of the full extent of the data collection, the exact purposes of the processing or the storage periods. We also have no information on the deletion of the data collected by the platform operator.
Web analysis is the collection, compilation and evaluation of data about the behavior of visitors to websites. Among other things, a web analysis service collects data about the website from which a data subject came to a website (so-called referrer), which subpages of the website were accessed or how often and for how long a subpage was viewed. Web analysis is regularly used to optimize a website and for the cost-benefit analysis of internet advertising. It may also happen that the information obtained as part of the analysis and tracking of our social media presence is merged with your other data collected when you use our social media presence and the platform. If you register on the platform, the operator may link data relating to your platform activities with your personal details (e.g., name/email address) on the basis of your consent, thus collecting personal data and informing you individually and in a targeted manner about your preferred topics, among other things.
With regard to statistics provided to us by the platform operator, we can only influence these to a limited extent and cannot switch them off. However, we make sure that no additional optional statistics are made available to us.
We process your personal data on the following legal bases:
· Your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you gave to the Provider when registering for the respective social media platform.
2. Active use of our social media presence
In addition to the purely informational use of our social media presence, you can also actively use our social media presence to contact us. In addition to the processing of your personal data described above in the case of purely informational use, we will then also process other personal data from you that we require, for example, to process your inquiry. This also applies in the event that we actively use our social media presence, e.g., to contact you on our own initiative or to initiate business contacts with you.
a) Sharing, publishing and interacting with posts, reviews, photos, etc.
You can comment on, share or otherwise interact with (like, recommend, review, etc.) posts, photos, videos, etc. created by us on the Provider’s platform and on our social media presence. We may share your content on our social media presence if this is a function of the operator’s platform and communicate with you via the platform. Public messages etc. may be published by the operator, but will not be used or processed by us for any other purpose beyond this.
In the case of reviews, we may publish a response (e.g., to clarify a problem, goodwill actions, etc.) to your message and ask you to contact us again. The personal data you voluntarily publish in the review may be processed in the process.
We also reserve the right to delete content if this should be necessary.
We process your personal data on the following legal basis:
· To safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR. Data processing is carried out in the interests of our public relations work and communication.
b) User inquiries
In order to process your inquiries to us, e.g., via contact forms, a chat or our e-mail address, to answer them specifically and to provide you with the requested information, we process the personal data provided by you in this context. This includes your contact details in order to send you an answer or to make any necessary queries, as well as any other information that you send us in this context.
If you send us an inquiry via the platform, we may also refer you to other secure communication channels that guarantee confidentiality, depending on the required response. You always have the option of sending us confidential inquiries to our addresses stated in the legal notice or in this privacy policy. We may contact you electronically, by telephone or by post, depending on the subject of the inquiry, the availability of your contact details and the necessity of doing so.
We process your personal data to respond to user inquiries, requests for materials, etc. on the basis of the following legal basis:
· To safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the proper response to and execution of user inquiries;
· if the inquiry is aimed at the conclusion of a contract or concerns a complaint or otherwise relates to a contractual and/or business relationship between us and you, the additional legal basis is Art. 6 para. 1 lit. b GDPR;
· with your consent in the context of using the chat, Art. 6 para. 1 lit. a GDPR.
IV. Assertion and enforcement of legal claims
We also process your personal data in order to assert our rights and enforce our legal claims. We also process your personal data in order to be able to defend ourselves against legal claims. Finally, we process your personal data insofar as this is necessary for the prevention or prosecution of criminal offences.
We process your personal data for this purpose on the following legal basis:
· To safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, insofar as we assert legal claims or defend ourselves in legal disputes or prevent or investigate criminal offences.
V. Compliance with legal regulations
We also process your personal data on our social media presence in order to fulfil other legal obligations. These may apply to us in connection with the processing of orders or business communication, among other things. These include, in particular, statutory retention obligations under commercial, trade or tax law.
We process your personal data on the following legal bases:
· To fulfil a legal obligation to which we are subject pursuant to Art. 6 para. 1 lit. c GDPR in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data.
VI. Company sales/mergers, etc.
We may process your personal data in order to complete a (partial) sale of a business or merger (or similar transaction such as a takeover in the context of liquidation, insolvency, dissolution, etc.) with another company. In the event that another company acquires or intends to acquire the assets from us, which may include your personal data, or we carry out or seek to carry out a merger with another company, we may have to grant this company access to your personal data stored by us or transfer it for the purpose of examining and carrying out the company sale/merger (e.g., to determine the value of the company or business risks, to transfer the data/assets, etc.).
We process your personal data on the following legal bases:
· To safeguard our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR in order to organise and implement a planned company sale or a planned merger.
VII. Third country transfer
In the context of social media use, your data may be transferred to countries outside the European Union, including the USA. We have no influence on this. Further information can be found in the linked privacy policies of the platform operators.
VIII. Storage duration
When you use our social media presence, the operator stores your personal data on its servers. Personal data and installed cookies are usually deleted by the operator. Unfortunately, we do not know the exact storage and deletion periods, but you may be able to find them in the respective linked privacy policies.
IX. Profiling / Automated decision making
It is possible that the operator of a social media platform may process your data in a partially automated manner with the aim of evaluating certain personal aspects (profiling). This may be done in order to provide you with targeted information and advice about products and services. This enables communication and advertising tailored to your needs, including market and opinion research.
D. Rights of data subjects
If your personal data is processed, you are a “data subject” within the meaning of the GDPR. You have the following rights with respect to us as the controller, which you may also exercise with respect to our social media presence by contacting the operator of the respective platform. Please note that we do not have full influence on the operator’s data processing operations. Our options depend largely on the company policy of the respective operator. Your rights as a data subject are as follows:
· Right to information: You can request information about whether we process your personal data. If this is the case, you have a right of access to this personal data and to further information related to the processing (Art. 15 GDPR). Please note that this right to information may be restricted or excluded in certain cases.
· Right to rectification: In the event that personal data concerning you is not (or no longer) accurate or incomplete, you may request that this data be rectified and, if necessary, completed (Art. 16 GDPR).
· Right to erasure or restriction of processing: If the legal requirements are met, you can request the erasure of your personal data (Art. 17 GDPR) or the restriction of the processing of this data (Art. 18 GDPR). However, the right to erasure pursuant to Art. 17 para. 1, 2 GDPR does not apply if, among other things, the processing of personal data is necessary for compliance with a legal obligation (Art. 17 para. 3 lit. b GDPR).
· Right to object: For reasons arising from your particular situation, you can also object to the processing of your personal data by us at any time (Art. 21 GDPR). If the legal requirements are met, we will then no longer process your personal data.
· Right to data portability: You are entitled, under the conditions of Art. 20 GDPR, to request that we provide you with the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format.
· Right to withdraw consent under data protection law: You have the right to withdraw your consent at any time. The withdrawal is only effective for the future; this means that the withdrawal does not affect the legality of the processing carried out on the basis of the consent until the withdrawal.
· Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, a data subject (you) has the right to lodge a complaint with a supervisory authority – in particular in the member state of your habitual residence – if you consider that the processing of your personal data by us infringes the GDPR.
· The supervisory authority responsible for us is
The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Phone: 0711/61 55 41 – 0
Fax: 0711/61 55 41 – 15
Email:
poststelle@lfdi.bwl.de
The social media platform operators have their registered office and therefore also the competent supervisory authority in another EU Member State. This is usually the Irish data protection authority (Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland). However, you can also address your complaints to the following competent German supervisory authorities:
· Meta: The Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 7th floor, 20459 Hamburg;
· X: n/a; as the company has no branch in Germany, you can generally contact the supervisory authority in your federal state;
· LinkedIn: The Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach;
· Google (including YouTube): The Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 7th floor, 20459 Hamburg;
If possible, your requests to exercise your aforementioned rights should be addressed in writing to the address given above.
I. Right to object (Art. 21 GDPR)
You have the right to object at any time to the processing of your data on the basis of Art. 6 para. 1 lit. f GDPR (data processing on the basis of a balancing of interests) or Art. 6 para. 1 lit. e GDPR (data processing in the public interest) if there are reasons for this arising from your particular situation. This also applies to profiling based on this provision within the meaning of Art. 4 no. 4 GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
We also process your personal data in individual cases for direct marketing purposes. If you do not wish to receive advertising, you have the right to object to this at any time; this also applies to profiling insofar as it is associated with such direct advertising. We will observe this objection for the future.
We will no longer process your data for direct marketing purposes if you object to processing for these purposes.
The objection can be made in any form and should be sent to the addresses listed under Sec. D.
II. Right of revocation regarding consent given
Many data processing operations are only possible with your express consent. You can withdraw your consent at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
Unless stated otherwise, the revocation can be made in any form and should be sent to the addresses stated under Sec. D.
E. Changes
We reserve the right to amend this privacy policy at any time. Any changes will be announced by publishing the amended privacy policy on our website. Unless otherwise specified, such changes will take effect immediately. Please therefore check this privacy policy regularly to view the latest version.
Last updated: September 2026.