Data protection declaration

As of: December 21, 2023

Overview of contents

Responsible person

Overview of processing operations

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed Data

  • Contact data.
  • Content data.
  • Usage data.
  • Meta, communication and procedural data.

< h3>Categories of data subjects

  • Communication partners.
  • Users.

Purposes of processing

  • Contact inquiries and communication.
  • Security measures.
  • Management and answering of inquiries.
  • Feedback.
  • Provision of our online offering and user-friendliness.
  • li>
  • Information technology infrastructure.

Relevant legal bases

Relevant legal bases according to the GDPR: You will find the following an overview of the legal basis of the GDPR on the basis of which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of these in the data protection declaration.

  • Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) – The data subject has given their consent to the processing of personal data concerning them for a specific purpose or There are several specific purposes.
  • Contract performance and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b) GDPR) – The processing is for the fulfillment of a contract, whose The contracting party is the data subject, or is necessary to carry out pre-contractual measures at the request of the data subject.
  • Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR)< /strong> – Processing is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh them.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes in particular the law to protect against misuse of personal data during data processing (Federal Data Protection Act – BDSG). The BDSG contains in particular special regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases, including profiling. Furthermore, the state data protection laws of the individual federal states may apply.

Note on the validity of the GDPR and Swiss GDPR: This data protection notice serves to provide information in accordance with the Swiss federal law on data protection (Swiss GDPR) and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that the terms of the GDPR are used due to the broader spatial application and comprehensibility. In particular, instead of the terms „processing“ of „personal data“, „overriding interest“ and „particularly sensitive personal data“ used in the Swiss DSG, the terms „processing“ of „personal data“ as well as „legitimate interest“ and „special categories“ used in the GDPR are used of data“. However, the legal meaning of the terms will continue to be determined according to the Swiss DSG within the scope of the Swiss DSG.

Security measures

We take measures in accordance with the legal requirements, taking the standard into accountDepending on the technology, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, appropriate technical and organizational measures are required to ensure a level of protection appropriate to the risk.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, transfer, securing availability and its separation. We have also set up procedures to ensure that the rights of those affected are exercised, the deletion of data and responses to threats to data. We also take the protection of personal data into account when developing or selecting hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

Transmission of personal data

As part of our processing of personal data, the data may be transmitted to other bodies, companies, legally independent organizational units or persons or disclosed to them become. The recipients of this data can include: B. Service providers commissioned with IT tasks or providers of services and content that are integrated into a website are included. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International data transfers

Data processing in third countries: If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or If the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other people, bodies or companies, this will only take place in accordance with the legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers only take place if the level of data protection is otherwise secured, in particular through standard contractual clauses (Art. 46 Para. 2 lit. c) GDPR), express consent or in the case of contractual or legally required transfer (Art. 49 Para. 1 GDPR). . We will also inform you about the basics of third-country transfers to the individual third-country providers, with the adequacy decisions taking precedence as the basics. Information on third country transfers and existing adequacy decisions can be found in the EU Commission’s information offering: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de.

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection as secure for certain companies from the USA as part of the adequacy decision of July 10, 2023 The list of certified companies and further information about the DPF can be found on the US Department of Commerce website at https://www. dataprivacyframework.gov/ (in English). We will inform you in the data protection information which service providers we use are certified under the Data Privacy Framework.

Rights of the data subjects

Rights of the data subjects from the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

  • Right to object: You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you based on Art. 6 Para. 1 lit. e or f GDPR, you have to lodge an objection; This also applies to profiling based on these provisions. If your personal data is processed for the purpose of direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also appliesch for profiling, insofar as it is connected to such direct advertising.
  • Right to revoke consent: You have the right to revoke your consent at any time.</li >
  • Right to information: You have the right to request confirmation as to whether the data in question is being processed and to receive information about this data as well as further information and a copy of the data in accordance with the legal requirements. li>
  • Right to rectification: In accordance with legal requirements, you have the right to request that the data concerning you be completed or that incorrect data concerning you be corrected.
  • < strong>Right to deletion and restriction of processing: In accordance with the legal requirements, you have the right to demand that data concerning you be deleted immediately, or alternatively, in accordance with the legal requirements, to restrict the processing of the data request.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, common and machine-readable format in accordance with legal requirements or to request that it be transmitted to another person responsible.
  • Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your jurisdiction your usual place of residence, your place of work or the place of the alleged violation, if you believe that the processing of personal data concerning you violates the requirements of the GDPR.

Use of cookies

Cookies are small text files or other storage notes that store information on end devices and read information from the end devices. For example, to save the login status in a user account, the contents of a shopping cart in an e-shop, the content accessed or the functions used of an online offer. Cookies can also be used for different purposes, e.g. B. for the purposes of the functionality, security and convenience of online offerings as well as the creation of analyzes of visitor flows.

Notes on consent: We use cookies in accordance with legal regulations. We therefore obtain prior consent from users, unless this is not required by law. In particular, consent is not necessary if the storage and reading of the information, including cookies, is absolutely necessary in order to provide users with a telemedia service that they have expressly requested (i.e. our online offering). Strictly necessary cookies generally include cookies with functions related to the display and operability of the online offering, load balancing, security, storage of users‘ preferences and selection options, or similar to the provision of the main and secondary functions requested by users Online offerings serve related purposes. The revocable consent is clearly communicated to the users and contains information on the respective cookie usage.

Notes on data protection legal bases: On which data protection legal basis we process users‘ personal data with the help of cookies depends on whether we ask users for consent. If users agree, the legal basis for processing your data is their declared consent. Otherwise, the data processed using cookies will be processed on the basis of our legitimate interests (e.g. in operating our online offering and improving its usability) or, if this is within the scope of fulfilling our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. We will explain the purposes for which cookies are processed by us in the course of this data protection declaration or as part of our consent and processing processes.

Storage period:With regard to the storage period, a distinction is made between the following types of cookies:

    • Temporary cookies (also: session cookies) : Tempor__ae_re cookies are deleted as soon as possible after a user has left an online offer and their end deviceae_t (e.g. browser or mobile application) has been closed.
    • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. User data collected using cookies can also be used to measure reach. Unless we provide users with explicit information about the type and storage period of cookies (e.g. when obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.

< /ul>

General information on revocation and objection (so-called “opt-out”): Users can revoke the consent they have given at any time and object to the processing in accordance with the legal requirements. To do this, users can, among other things, restrict the use of cookies in their browser settings (which may also limit the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be made via the websites https://optout.aboutads.info< /a> and https://www.youronlinechoices.com/ are explained.

      • Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR). Consent (Art. 6 Para. 1 S. 1 lit. a) GDPR).

Further information on processing processes, procedures and services:

< ul class=“m-elements“>

  • Processing of cookie data based on consent: We use a cookie consent management process, in which the users‘ consent to the Use of cookies, or the processing and providers mentioned as part of the cookie consent management process, can be obtained and managed and revoked by users. The declaration of consent is saved in order not to have to repeat the query again and to be able to prove consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or using comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual information about the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. Here, a pseudonymous user identifier is created and stored with the time of consent, information about the scope of the consent (e.g. which categories of cookies and/or service providers) as well as the browser, system and end device used; Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a) GDPR).
  • BorlabsCookie: Cookie consent management; Service provider: Execution on servers and/or computers under their own data protection responsibility; Website: https://de.borlabs.io/borlabs-cookie/< /a>. Further information: An individual user ID, language as well as types of consent and the time of their submission are stored on the server side and in the cookie on the user’s device.

Provision of the online offering and web hosting

We process users‘ data in order to be able to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, consent status).
  • Affected persons: Users (e.g. website visitors, Users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).). Security measures.
  • Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR).

< p>Further information on processing processes, procedures and services:

  • Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. The server log files can include the address and name of the websites and files accessed, date and time of access, amounts of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP address. Addresses and the requesting provider belong__oe_ren. The server log files can be used for security purposes, e.g. B. to avoid overloading the servers (particularly in the case of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilization of the servers and their stability; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further storage is necessary for evidentiary purposes is exempt from deletion until the respective incident has been finally resolved.

Contact and inquiry management

When contacting us (e.g. by post, contact form, email, telephone or via social media) as well as within the framework of existing user requests and business relationships, the information of the inquiring persons is processed to the extent that this is necessary to answer the contact inquiries and any requested measures.

  • Types of data processed: Contact details (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, consent status).
  • Affected persons: Communication partners.
  • Purposes of processing: Contact requests and communication; managing and responding to inquiries; Feedback (e.g. collecting feedback via online form). Provision of our online offering and user-friendliness.
  • Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR). Fulfillment of the contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further information on processing processes, procedures and services:</ p>

  • Contact form: If users __ue_contact us via our contact form, email or other communication channels, we process what is communicated to us in this context Data for processing the communicated request; Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b) GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit . f) GDPR).