General information

As the operator of this website and as a company, we come into contact with your personal data. This means all data that says something about you and can be used to identify you. In this privacy policy, we would like to explain how, for what purpose and on what legal basis we process your data.

The controller responsible for data processing on this website and in our company is:

Leafworks GmbH
Travestieg 2
22851 Norderstedt
Germany

Telephone: +494069638696
Email: kontakt@leafworks.de

General notes

SSL or TLS encryption

Whenever you enter data on websites, place online orders or send emails over the internet, you must always expect that unauthorised third parties may access your data. Complete protection against such access is not possible. However, we do everything we can to protect your data as effectively as possible and to close security gaps to the extent that this is within our power.

An important protection mechanism is the SSL or TLS encryption of our website. It ensures that data you transmit to us cannot be read by third parties. You can recognise the encryption by the padlock icon in front of the internet address entered in your browser and because our internet address begins with https:// rather than http://.

Encrypted payment transactions

Payment data, such as account or credit-card numbers, require particular protection. For this reason, payment transactions using common payment methods are carried out exclusively via an encrypted SSL or TLS connection.

How long do we store your data?

At various points in this privacy policy, we inform you how long we or the companies that process your data on our behalf store your data. If no such information is provided, we store your data until the purpose of the data processing no longer applies, you object to the data processing or you withdraw your consent to the data processing.

In the event of an objection or withdrawal, however, we may continue to process your data if at least one of the following conditions applies:

We have compelling legitimate grounds for continuing the data processing which override your interests, rights and freedoms (this applies only to an objection to data processing; where the objection concerns direct marketing, we cannot invoke legitimate grounds).

The data processing is necessary for the establishment, exercise or defence of legal claims (this does not apply where your objection concerns direct marketing).

We are legally required to retain your data.

In this case, we delete your data as soon as the relevant condition or conditions no longer apply.

Transfer of data to the USA

On our website, we also use tools provided by companies that transfer your data to the USA and store and, where applicable, further process it there. This is particularly relevant to you because your data may not enjoy the same level of protection in the USA as it does within the EU, where the General Data Protection Regulation (GDPR) applies. For example, US companies may be required to disclose personal data to security authorities without you, as the data subject, being able to take legal action against this. It is therefore possible that US authorities, such as intelligence services, process, analyse and permanently store your data on US servers for surveillance purposes. We have no influence over these processing activities.

Your rights

Right to object to data processing

IF YOU READ IN THIS PRIVACY POLICY THAT WE HAVE LEGITIMATE INTERESTS IN PROCESSING YOUR DATA AND THEREFORE BASE SUCH PROCESSING ON ART. 6(1), FIRST SENTENCE, POINT (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO IT UNDER ART. 21 GDPR. THIS ALSO APPLIES TO PROFILING BASED ON THAT PROVISION. YOU MUST STATE GROUNDS FOR THE OBJECTION RELATING TO YOUR PARTICULAR SITUATION. NO REASONS ARE REQUIRED IF THE OBJECTION CONCERNS THE USE OF YOUR DATA FOR DIRECT MARKETING.

AS A RESULT OF YOUR OBJECTION, WE MAY NO LONGER PROCESS YOUR DATA. THIS DOES NOT APPLY IF ONE OF THE FOLLOWING CONDITIONS IS MET:

• WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS.

• THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

THE EXCEPTIONS DO NOT APPLY IF YOUR OBJECTION CONCERNS DIRECT MARKETING OR PROFILING RELATED TO SUCH DIRECT MARKETING.

Other rights

Withdrawal of your consent to data processing

Many data-processing operations are based on your consent. You give this consent, for example, by ticking the relevant box in online forms before submitting the form or by allowing certain cookies when you visit our website. You can withdraw your consent at any time without giving reasons (Art. 7(3) GDPR). From the time of withdrawal, we may no longer process your data. The only exception is where we are legally required to retain the data for a certain period. Such retention periods exist in particular under tax and commercial law.

Right to lodge a complaint with the competent supervisory authority

If you believe that we are infringing the General Data Protection Regulation (GDPR), you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority. You may contact a supervisory authority in the Member State of your habitual residence, your place of work or the place where the alleged infringement occurred. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.

Right to data portability

Data that we process automatically on the basis of your consent or in performance of a contract must be provided to you or a third party in a commonly used, machine-readable format if you request this. We can transfer the data to another controller only where this is technically feasible.

Right of access, erasure and rectification

Under Art. 15 GDPR, you have the right to obtain information free of charge about the personal data we have stored about you, where the data came from, to whom we transmit it and the purpose for which it is stored. If the data is incorrect, you have a right to rectification (Art. 16 GDPR); subject to the requirements of Art. 17 GDPR, you may request that we erase the data.

Right to restriction of processing

In certain situations, you may request under Art. 18 GDPR that we restrict the processing of your data. Apart from storage, the data may then be processed only as follows:

• with your consent

• for the establishment, exercise or defence of legal claims

• to protect the rights of another natural or legal person

• for reasons of important public interest of the European Union or a Member State

The right to restriction of processing applies in the following situations:

• You have contested the accuracy of the personal data we store about you and we need time to verify it. The right applies for the duration of the verification.

• The processing of your personal data is or was unlawful. In this case, the right applies as an alternative to erasure of the data.

• We no longer need your personal data, but you require it for the establishment, exercise or defence of legal claims. In this case, the right applies as an alternative to erasure of the data.

• You have objected under Art. 21(1) GDPR and your interests and ours must now be weighed against one another. The right applies until the outcome of that balancing exercise has been determined.

Hosting and content delivery networks (CDN)

External hosting

Our website is hosted on a server operated by the following internet-service provider (host):

Kinsta Inc
8605 Santa Monica Blvd #92581
90069 West Hollywood, CA, USA

How do we process your data?

The hosting provider stores all data relating to our website. This includes all personal data collected automatically or through information you enter. This may include, in particular, your IP address, pages accessed, names, contact details and enquiries, as well as metadata and communication data. When processing data, Kinsta Inc follows our instructions and processes the data only to the extent necessary to fulfil its service obligations to us.

On what legal basis do we process your data?

Because we use our website to address potential customers and maintain contact with existing customers, processing by our hosting provider serves to initiate and perform contracts and is therefore based on Art. 6(1)(b) GDPR. In addition, as a company we have a legitimate interest in providing a professional online presence that meets the necessary requirements for security, speed and efficiency. To that extent, we also process your data on the basis of Art. 6(1)(f) GDPR.

Cloudflare

What is Cloudflare?
Content delivery network (CDN) with a domain name system (DNS)

Who processes your data?
Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA

Where can you find more information about data protection at Cloudflare?
https://www.cloudflare.com/privacypolicy/

On what basis do we transfer your data to the USA? On the basis of the European Commission's Standard Contractual Clauses (see https://www.cloudflare.com/media/pdf/cloudflare-customer-dpa.pdf)

How do we process your data?

We use Cloudflare services for our website. Its global content delivery network ensures that all content we provide online reaches you quickly even where large volumes of data must be moved over long distances. This is made possible because Cloudflare, using its technical resources and servers around the world, is positioned between our website and your browser, analyses data traffic and filters out malicious data before it reaches our server. In doing so, Cloudflare also comes into contact with personal data collected through our website. The company may also use cookies or other technologies to recognise internet users. Cloudflare processes data solely for the purpose of enabling fast data transmission.

On what legal basis do we process your data?

We have a legitimate interest in providing visitors to our website with an online service that is as fast and efficient as possible. The data processing is therefore based on Art. 6(1)(f) GDPR.

Data collection on this website

Use of cookies

Our website places cookies on your device. These are small text files used for different purposes. Some cookies are technically necessary for the website to function at all (necessary cookies). Others are required to perform particular actions or functions on the site (functional cookies). For example, without cookies it would not be possible to use the benefits of a shopping cart in an online shop. Other cookies are used to analyse user behaviour or optimise advertising. If we use third-party services on our website, for example to process payments, these companies may also place cookies on your device when you access the website (third-party cookies).

How do we process your data?

Session cookies are stored on your device only for the duration of a session. They therefore disappear automatically as soon as you close your browser. Permanent cookies, by contrast, remain on your device unless you delete them yourself. This may, for example, result in your user behaviour being analysed over a longer period. You can use your browser settings to determine how it handles cookies:

• Would you like to be informed when cookies are set?

• Would you like to exclude cookies generally or in certain cases?

• Would you like cookies to be deleted automatically when the browser is closed?

If you disable or do not allow cookies, the functionality of the website may be restricted.

If we use cookies from other companies or for analytical purposes, we will inform you about this in this privacy policy. We will also ask for your consent in this regard when you access our website.

On what legal basis do we process your data?

We have a legitimate interest in ensuring that visitors can use our online services without technical problems and that all desired functions are available to them. Necessary and functional cookies are therefore stored on your device on the basis of Art. 6(1)(f) GDPR. We use all other cookies on the basis of Art. 6(1)(a) GDPR, provided you give us the appropriate consent. You can withdraw this consent at any time with effect for the future. If, when asked for consent, you consented to the placement of necessary and functional cookies, those cookies will also be stored exclusively on the basis of your consent.

Cookie consent with CookieFirst

What is CookieFirst?
Consent management platform (CMP) for obtaining, storing and managing consent

Who processes your data?
Digital Data Solutions B.V., Plantage Middenlaan 42a, 1018 DH Amsterdam, the Netherlands

Where can you find more information about data protection at CookieFirst?
https://cookiefirst.com/legal/privacy-policy/

How do we process your data?

We use CookieFirst to obtain your consent for services that require consent, to store your settings and to document the consent you have given or withdrawn. In particular, your consent decision, the time of the decision and technical information required to assign and document the consent are processed.

CookieFirst also stores technically necessary information in your browser so that your selection can be taken into account on subsequent page views. You can change or withdraw your consent at any time through the cookie settings.

On what legal basis do we process your data?

The processing is carried out to comply with our legal obligations on the basis of Art. 6(1)(c) GDPR. Storing the consent settings on your device is necessary pursuant to Section 25(2)(2) TDDDG in order to provide the privacy settings you have selected.

Server log files

Server log files record all requests for and access to our website and record error messages. They also include personal data, in particular your IP address. However, the provider anonymises it after a short period so that we cannot associate the data with you. The data is transmitted automatically by your browser to our provider.

How do we process your data?

Our provider stores the server log files so that activities on our website can be traced and errors can be identified. The files contain the following data:

• browser type and version

• operating system used

• referrer URL

• hostname of the accessing computer

• time of the server request

• IP address (anonymised where applicable)

We do not combine this data with other data; we use it solely for statistical analysis and to improve our website.

On what legal basis do we process your data?

We have a legitimate interest in ensuring that our website functions without errors. We also have a legitimate interest in obtaining an anonymised overview of visits to our website. The data processing is therefore lawful under Art. 6(1)(f) GDPR.

Contact form

You can send us a message using the contact form on this website.

How do we process your data?

We store your message and the information from the form so that we can process your enquiry, including any follow-up questions. This also includes the contact details you provide. We do not disclose the data to other persons without your consent.

How long do we store your data?

We delete your data as soon as one of the following occurs:

• Your enquiry has been conclusively dealt with.

• You ask us to delete the data.

• You withdraw your consent to storage.

This does not apply where we are legally required to retain the data.

On what legal basis do we process your data?

If your enquiry relates to our contractual relationship or serves to carry out pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. In all other cases, we have a legitimate interest in dealing effectively with enquiries addressed to us. The legal basis for the data processing is therefore Art. 6(1)(f) GDPR. If you have consented to the storage of your data, Art. 6(1)(a) GDPR is the legal basis. In that case, you may withdraw your consent at any time with effect for the future.

Enquiries by email, telephone or fax

You can send us a message by email or fax or call us.

How do we process your data?

We store your message and the contact details you provide, or the telephone number transmitted, so that we can process your enquiry, including any follow-up questions. We do not disclose the data to other persons without your consent.

How long do we store your data?

We delete your data as soon as one of the following occurs:

• Your enquiry has been conclusively dealt with.

• You ask us to delete the data.

• You withdraw your consent to storage.

This does not apply where we are legally required to retain the data.

On what legal basis do we process your data?

If your enquiry relates to our contractual relationship or serves to carry out pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. In all other cases, we have a legitimate interest in dealing effectively with enquiries addressed to us. The legal basis for the data processing is therefore Art. 6(1)(f) GDPR. If you have consented to the storage of your data, Art. 6(1)(a) GDPR is the legal basis. In that case, you may withdraw your consent at any time with effect for the future.

Calendly

What is Calendly?
Appointment-scheduling tool

Who processes your data?
Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA

Where can you find more information about data protection at Calendly?
https://calendly.com/pages/privacy

On what basis do we transfer your data to the USA?
Calendly complies with the European Commission's Standard Contractual Clauses (see https://calendly.com/pages/dpa)

How do we process your data?

You can use the Calendly tool on our website to arrange an appointment with us. We use the data to schedule, conduct and, where applicable, follow up the appointment.

How long do we store your data?

We delete your data as soon as one of the following occurs:

• The purpose of the data processing no longer applies.

• You ask us to delete the data.

• You withdraw your consent to storage.

This does not apply where we are legally required to retain the data.

On what legal basis do we process your data?

We have a legitimate interest in making it as easy as possible to arrange appointments with customers and other interested parties. The data processing is therefore based on Art. 6(1)(f) GDPR. If you have consented to the storage of your data, Art. 6(1)(a) GDPR is the sole legal basis. In that case, you may withdraw your consent at any time with effect for the future.

HubSpot

What is HubSpot?
Customer relationship management (CRM) platform for managing customer relationships in marketing, sales and service

Who processes your data?
HubSpot Inc., 25 Street, Cambridge, MA 02141, USA

Where can you find more information about data protection at HubSpot?
https://legal.hubspot.com/privacy-policy

On what basis do we transfer your data to the USA?
HubSpot complies with the European Commission's Standard Contractual Clauses (see https://www.hubspot.de/data-privacy/privacy-shield)

How do we process your data?

We use the HubSpot CRM to record, organise and analyse customer interactions across various channels, including email, social media and telephone. We evaluate the personal data collected and use it to communicate with prospective and existing customers or for marketing activities, such as newsletter mailings. HubSpot also enables us to record and analyse the behaviour of visitors to our website.

On what legal basis do we process your data?

We have a legitimate interest in managing and communicating with customers as efficiently as possible. The data processing is therefore based on Art. 6(1)(f) GDPR. If you have consented to the storage of your data, Art. 6(1)(a) GDPR is the sole legal basis. In that case, you may withdraw your consent at any time with effect for the future.

Social media plugins

Use of social media plugins

Which social media plugins do we use?

LinkedIn

What is LinkedIn?
Social network

Who processes your data?
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland

Where can you find more information about data protection at LinkedIn?
https://www.linkedin.com/legal/privacy-policy

On what basis do we transfer your data to the USA?
On the basis of the European Commission's Standard Contractual Clauses (see https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs)

Analytics tools and advertising

We use the following tools to analyse the behaviour of visitors to our website and to show them advertising.

Google Tag Manager

What is Google Tag Manager?
Tag management system for integrating tracking codes and conversion pixels from Google Ireland Ltd.

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google Tag Manager?
https://policies.google.com/privacy

On what basis do we transfer your data to the USA?
On the basis of the European Commission's Standard Contractual Clauses (https://privacy.google.com/businesses/compliance)

How do we process your data?

We use Google Tag Manager. The tool helps us integrate, manage and deploy tracking codes and conversion pixels on our website. Google Tag Manager itself does not create user profiles, place cookies on your device or analyse your behaviour as a user. However, it records your IP address and transmits it to Google servers in the USA.

On what legal basis do we process your data?

We have a legitimate interest in quickly and easily integrating and managing various tools on our website. The use of Google Tag Manager is therefore lawful under Art. 6(1)(f) GDPR. If you have consented to the disclosure of your IP address, we process your data exclusively on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Google Analytics

What is Google Analytics?
Tool provided by Google Ireland Ltd. for analysing user behaviour

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google Analytics?
https://support.google.com/analytics/answer/6004245?hl=en

On what basis do we transfer your data to the USA?

On the basis of the European Commission's Standard Contractual Clauses (https://privacy.google.com/businesses/compliance)

How can you prevent data collection?

Among other options, by using a browser plugin: https://tools.google.com/dlpage/gaoptout?hl=en

How do we process your data?

We are always interested in optimising our online offering for visitors to our website and in placing advertising as effectively as possible. Google Analytics helps us do this. This tool analyses user behaviour and provides the data basis we need to make improvements. The tool gives us information about where our visitors come from, the pages they view, how long they stay on those pages and the operating system they use.

Standard processing

To collect the data, Google Analytics uses cookies, device fingerprinting or other technologies to recognise users. The data is transmitted to Google servers in the USA and, using the IP address that is also collected, combined into a profile that can be associated with you or your device.

You can prevent Google from processing your data by installing a browser plugin provided by Google: https://tools.google.com/dlpage/gaoptout?hl=en.

How long do we store your data?

According to its own information, Google deletes or anonymises user-level and event-level data linked to cookies, user identifiers (e.g. user IDs) or advertising IDs after ## No information provided ## (see https://support.google.com/analytics/answer/7667196?hl=en).

On what legal basis do we process your data?

As the website operator, we have a legitimate interest in analysing user behaviour in order to optimise our online offering and the advertising placed on it. The data processing is therefore lawful under Art. 6(1)(f) GDPR. If, for example, you have consented to cookies being stored or have otherwise consented to data processing by Google Analytics, Art. 6(1)(a) GDPR is the sole legal basis. You may withdraw your consent at any time with effect for the future.

Google Ads

What is Google Ads?
Online advertising programme provided by Google Ireland Ltd.

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google Ads?
https://policies.google.com/privacy?hl=en

On what basis do we transfer your data to the USA?
Google complies with the European Commission's Standard Contractual Clauses (https://privacy.google.com/businesses/compliance)

How do we process your data?

We use Google Ads. Google's advertising programme enables us to display advertisements in the Google search engine or on third-party websites when visitors to our website enter certain search terms on Google (keyword targeting). We can also use the user data available to Google, such as location data and interests, to place targeted advertisements (audience targeting). We evaluate the collected data quantitatively, for example by analysing which search terms caused our advertisements to be displayed and how many advertisements resulted in corresponding clicks.

On what legal basis do we process your data?

As the website operator, we have a legitimate interest in placing and evaluating advertisements. The data processing is therefore lawful under Art. 6(1)(f) GDPR. If, for example, you have consented to cookies being stored or have otherwise consented to data processing by Google, Art. 6(1)(a) GDPR is the sole legal basis. You may withdraw your consent at any time with effect for the future.

Google Analytics Remarketing

What is Google Analytics Remarketing?
Tool provided by Google Ireland Ltd. for personalised advertising

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google Analytics Remarketing?
https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/ads

On what basis do we transfer your data to the USA?
Google complies with the European Commission's Standard Contractual Clauses (https://privacy.google.com/businesses/compliance)

How can you prevent data processing?
By objecting to personalised advertising in your Google Account or on this page: https://www.google.com/settings/ads/onweb/

How do we process your data?

We are always interested in placing our advertising as effectively as possible. The Google Analytics remarketing function helps us do this.

Standard processing

Remarketing means that we analyse your behaviour on our website in order to assign you to a particular advertising audience and subsequently display suitable advertising messages to you when you visit other websites. We also link advertising audiences to Google's cross-device functions. This enables us to display interest-based, personalised advertising messages tailored to you on the basis of your usage and browsing behaviour on one device, such as your mobile phone, on another device, such as a tablet or PC.

Objecting to personalised advertising

You can adjust the advertising settings in your Google Account. To do so, click the following link and sign in: https://adssettings.google.com/authenticated. Outside your Google Account, you can object to personalised advertising at the following link: https://www.google.com/settings/ads/onweb/ (the setting will then apply only to the device and browser currently being used).

On what legal basis do we process your data?

As the website operator, we have a legitimate interest in effectively marketing our services and products. The data processing is therefore lawful under Art. 6(1)(f) GDPR. If, for example, you have consented to cookies being stored or have otherwise consented to data processing by Google Analytics Remarketing, Art. 6(1)(a) GDPR is the sole legal basis. You may withdraw your consent at any time with effect for the future.

Google Conversion Tracking

What is Google Conversion Tracking?
Tool provided by Google Ireland Ltd. for analysing user behaviour

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google Conversion Tracking?
https://policies.google.com/privacy?hl=en

On what basis do we transfer your data to the USA?

Google complies with the European Commission's Standard Contractual Clauses (https://privacy.google.com/businesses/compliance)

How do we process your data?

We are always interested in optimising our online offering for users and placing advertising as effectively as possible. We therefore also use Google Conversion Tracking. It enables us to record whether and how often visitors to our website click certain buttons and which products are viewed and purchased particularly frequently (conversion statistics). When collecting and storing data, we do not receive any information that enables us to identify individual visitors personally. Google itself uses cookies or comparable recognition technologies for identification.

On what legal basis do we process your data?

As the website operator, we have a legitimate interest in analysing user behaviour in order to optimise our online offering and the advertising placed on it. The data processing is therefore lawful under Art. 6(1)(f) GDPR. If, for example, you have consented to cookies being stored or have otherwise consented to data processing by Google Conversion Tracking, Art. 6(1)(a) GDPR is the sole legal basis. You may withdraw your consent at any time with effect for the future.

Google DoubleClick

What is Google DoubleClick?
Tool provided by Google Ireland Ltd. for personalised advertising

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google DoubleClick?
https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/ads

On what basis do we transfer your data to the USA?
Google complies with the European Commission's Standard Contractual Clauses (https://privacy.google.com/businesses/compliance)

How can you prevent data processing?
By objecting to personalised advertising in your Google Account or at https://www.google.com/settings/ads/onweb/

How do we process your data?

We use DoubleClick so that we can show you advertising tailored to your interests throughout the Google advertising network. The advertisements appear, for example, in Google search results or in advertising banners linked to DoubleClick. To show you suitable advertising, Google DoubleClick must be able to recognise you. The tool therefore places cookies on your computer or uses other recognition technologies, such as device fingerprinting. Google uses the data collected to create pseudonymous user profiles.

On what legal basis do we process your data?

As the website operator, we have a legitimate interest in targeted advertising. The data processing is therefore lawful under Art. 6(1)(f) GDPR. If, for example, you have consented to cookies being stored or have otherwise consented to data processing by Google DoubleClick, Art. 6(1)(a) GDPR is the sole legal basis. You may withdraw your consent at any time with effect for the future.

Facebook Pixel

What is Facebook Pixel?
Tool for analysing user behaviour and measuring the effectiveness of advertising on Facebook

Who processes your data?
Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland

Where can you find more information about data protection at Facebook Pixel?
https://www.facebook.com/about/privacy/

On what basis do we transfer your data to the USA and other third countries?
Facebook complies with the European Commission's Standard Contractual Clauses (see https://www.facebook.com/legal/EU_data_transfer_addendum and https://www.facebook.com/help/566994660333381)

How can you prevent data processing?
If you have a Facebook account: disable the “Custom Audiences” remarketing function in the advertising settings (https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen).

If you do not have a Facebook account: disable Facebook's interest-based advertising on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/uk/your-ad-choices/.

How do we process your data?

We use Facebook Pixel on our website. The analytics tool helps us learn more about the behaviour of visitors to our website after they have clicked one of our advertisements on Facebook. This allows us to measure the effectiveness of our Facebook advertising and use the insights gained to plan future advertising activities. The data that Facebook collects through the pixel is anonymous to us as the operator of this website, so we cannot identify you as a visitor. However, Facebook stores and processes the data. Through the pixel, Facebook links the data to your Facebook account and also uses it to place advertising both within and outside its network (see Facebook's Data Policy). In the course of storage and processing, Facebook also transfers the data to the USA and other third countries.

If you have a Facebook account, you can disable the “Custom Audiences” remarketing function in the advertising settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

If you do not have a Facebook account, you can disable Facebook's interest-based advertising on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/uk/your-ad-choices/.

On what legal basis do we process your data?

As the website operator, we have a legitimate interest in effective advertising activities on social networks. The data processing is therefore lawful under Art. 6(1)(f) GDPR. If, for example, you have consented to cookies being stored or have otherwise consented to data processing by Facebook, Art. 6(1)(a) GDPR is the sole legal basis. You may withdraw your consent at any time with effect for the future.

LinkedIn Insight Tag

What is LinkedIn Insight Tag?
Tool provided by LinkedIn Ireland Unlimited Company for analysing user behaviour

Who processes your data?
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland

Where can you find more information about data protection at LinkedIn Insight Tag?
https://www.linkedin.com/legal/privacy-policy#choices-oblig

On what basis do we transfer your data to the USA?
LinkedIn Insight Tag complies with the European Commission's Standard Contractual Clauses (see https://www.linkedin.com/legal/l/dpa%20and%20https://www.linkedin.com/legal/l/eu-sccs)

How can you prevent data processing?
By objecting to LinkedIn's analysis of your user behaviour and targeted advertising at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. If you have a LinkedIn account, you can also change the settings there governing the use of your personal data for advertising purposes.

How do we process your data?

We use LinkedIn Insight Tag on our website. The analytics tool helps us learn more about visitors to our website and adjust our online offering accordingly. If our visitors are registered with LinkedIn, the tool enables us to analyse professional information such as career level, company size, country, location, industry and job title. We can also measure whether they make a purchase or perform another action (conversion measurement). This data is determined across devices. Finally, LinkedIn Insight Tag provides a retargeting function that enables us to display targeted advertising to our visitors outside our website. LinkedIn states that individual advertising recipients cannot be identified in this process.

In addition to the data mentioned above, the analytics tool records the following data when you visit our website: URL, referrer URL, IP address, device and browser characteristics and the time of access. IP addresses are truncated or pseudonymised. The latter occurs where you are to be reached across devices as a LinkedIn member.

The data collected by LinkedIn is anonymous to us as the website operator, so we cannot identify you as a visitor. LinkedIn will, however, store your personal data on its servers in the USA and use it for its own advertising activities.

You can prevent LinkedIn from associating data collected on our website with your LinkedIn account by signing out of your account before continuing to browse the internet. You can also prevent the use of your data for advertising purposes through the relevant settings in your account.

If you do not have a LinkedIn account, you can object to LinkedIn's analysis of your user behaviour and targeted advertising at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

How long do we store your data?

LinkedIn deletes the direct identifiers of LinkedIn members after 7 days. The remaining pseudonymised data is deleted within 180 days.

On what legal basis do we process your data?

As the website operator, we have a legitimate interest in optimising our online offering and advertising activities. The data processing is therefore lawful under Art. 6(1)(f) GDPR. If, for example, you have consented to cookies being stored or have otherwise consented to data processing, Art. 6(1)(a) GDPR is the sole legal basis. You may withdraw your consent at any time with effect for the future.

Microsoft Clarity

What is Microsoft Clarity?
Tool for analysing user behaviour, particularly through session recordings, heatmaps and interaction data

Who processes your data?
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Where can you find more information about data protection at Microsoft Clarity?
https://privacy.microsoft.com/en-gb/privacystatement and https://learn.microsoft.com/en-us/clarity/faq

On what basis can data be transferred to the USA?
Microsoft states that, for transfers from the European Economic Area, the United Kingdom and Switzerland, it relies on the EU-US Data Privacy Framework and its extensions and, where necessary, on other recognised transfer mechanisms such as Standard Contractual Clauses. Further information is available at https://privacy.microsoft.com/en-gb/privacystatement.

How do we process your data?

We use Microsoft Clarity to understand how visitors use our website and to improve our online offering. This may include collecting clicks, scrolling and mouse movements, changes to browser-window size, page views, technical diagnostic information and information about the device and browser used. From this data, Microsoft creates session recordings and heatmaps in particular. Microsoft uses cookies or comparable technologies and pseudonymous identifiers for this purpose. According to Microsoft, sensitive input fields are masked by default.

Microsoft may also process the information collected to provide and improve its own services and for security and fraud-prevention purposes. Depending on the Microsoft services used, Microsoft may combine the data with other information.

How long do we store your data?

According to Microsoft, session recordings are generally stored for 30 days. Sessions marked as favourites or otherwise labelled, as well as heatmap and click data, may be stored for up to 9 months. Further information is available at https://learn.microsoft.com/en-us/clarity/setup-and-installation/data-retention.

On what legal basis do we process your data?

We use Microsoft Clarity only with your consent. The legal basis is Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. You can withdraw your consent at any time through the cookie settings with effect for the future.

Plugins and tools

Google Maps

What is Google Maps?
Mapping service for displaying locations and directions

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google Maps?
https://policies.google.com/privacy?hl=en

On what basis can data be transferred to the USA?
Google LLC is certified under the EU-US Data Privacy Framework. Google also states that it uses Standard Contractual Clauses approved by the European Commission. Further information is available at https://policies.google.com/privacy/frameworks?hl=en.

How do we process your data?

We embed Google Maps on selected pages. The map is loaded only if you consent to the “Functional” category through our cookie settings or click the “Load Google Maps” button. No connection to Google Maps is established before you give your consent.

When the map is loaded, your IP address, device and browser information, the time and URL of the request and the previously visited page may, in particular, be transmitted to Google. Depending on your device settings and whether you are signed in to a Google Account, Google may process further information, such as location or account data. Google may also use cookies or comparable technologies on your device.

Google operates servers worldwide. Personal data may therefore also be processed outside the European Economic Area, particularly in the USA.

On what legal basis do we process your data?

We use Google Maps to display locations and directions. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. You can withdraw your consent at any time through the cookie settings with effect for the future.

OpenStreetMap/uMap

What is OpenStreetMap/uMap?
Mapping service for the interactive display of locations and regional events

Who processes your data?
FOSSGIS e. V., Bundesallee 23, 10717 Berlin, Germany, as the operator of umap.openstreetmap.de; depending on the configuration of the map, providers of the map data and map tiles used may also receive data.

Where can you find more information about data protection?
https://www.fossgis.de/datenschutzerklärung/ and https://osmfoundation.org/wiki/Privacy_Policy

How do we process your data?

On selected pages, we embed interactive maps through uMap based on OpenStreetMap map data. When such a map is loaded, your browser establishes a connection to umap.openstreetmap.de and, where applicable, to the servers of the map-tile providers used. In particular, your IP address, information about your browser and operating system, the previously visited page, the time and URL of the request and technical log data may be transmitted. If you enable your device's location function, location data may also be processed.

On what legal basis do we process your data?

We use OpenStreetMap/uMap to present locations and regional events clearly. The legal basis for loading the interactive map is your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. You can withdraw your consent at any time through the cookie settings with effect for the future.

YouTube (privacy-enhanced mode)

What is YouTube?
Video platform

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at YouTube?
https://policies.google.com/privacy?hl=en

How do we process your data?

You can watch YouTube videos on our website. Google, as the provider of YouTube, collects and stores certain information about you. Because we use YouTube in privacy-enhanced mode, this does not occur until you start a video. Specifically, the following happens:

1. Google's servers are informed which of our pages have been visited from your device. If you are signed in to your YouTube account while browsing, Google can associate your browsing behaviour directly with your personal profile. If you do not want this, you must sign out of your YouTube account before continuing to browse the internet.
2. Google obtains information about visitors to our website through cookies, device fingerprinting or similar recognition technologies. On this basis, the company produces video statistics, makes its application more attractive to users and prevents attempted fraud.
   
3. Your data may also be processed in other ways. However, we are not aware of the details and cannot influence the processing.
   

Even if you do not start a YouTube video on our website, Google establishes a connection to its DoubleClick network and possibly to other partners. Privacy-enhanced mode therefore does not mean that Google processes no data about you at all when you visit our website.

On what legal basis do we process your data?

By embedding YouTube videos, we aim to make our website and our services and offerings more appealing. This is our legitimate interest as a company and is therefore lawful under Art. 6(1)(f) GDPR.

If you have consented to the data processing, we process your data exclusively on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time. From the time of withdrawal, we may no longer process your data.

Google Web Fonts (local hosting)

We use fonts from the US company Google on our website. We have installed the fonts locally, so no connection to Google's servers is established when you visit our website.

Further information about Google Web Fonts is available at https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy?hl=en.

Google reCAPTCHA

What is Google reCAPTCHA?
Test tool provided by Google Ireland Ltd. for distinguishing humans from computers

Who processes your data?
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Where can you find more information about data protection at Google?
https://policies.google.com/privacy?hl=en

On what basis do we transfer your data to the USA?
Google complies with the European Commission's Standard Contractual Clauses (https://privacy.google.com/businesses/compliance)

How do we process your data?

We use Google reCAPTCHA to check whether data entered into forms on our website originates from a person or a computer. For you, this means that the test tool analyses your behaviour as a visitor to our website on the basis of various characteristics. The analysis begins not only when you use the test tool but as soon as you access our website. Various data is collected, such as the IP address, the time spent on our website and mouse movements. The data is forwarded to Google.

On what legal basis do we process your data?

As a company, we have a legitimate interest in protecting our online services against spam and abusive scanning. The data processing is therefore lawful under Art. 6(1)(f) GDPR.

If you have consented to the data processing, we process your data exclusively on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time. From the time of withdrawal, we may no longer process your data.

Zendesk

What is Zendesk?
Cloud-based customer-support platform offering helpdesk ticketing, self-service and customer-service support functions

Who processes your data?
Zendesk Inc., 1019 Market Street, San Francisco, CA 94103, USA

Where can you find more information about data protection at Zendesk?
https://www.zendesk.com/company/agreements-and-terms/privacy-notice/

On what basis do we transfer your data to the USA?
Zendesk complies with the European Commission's Standard Contractual Clauses (see https://www.zendesk.de/company/privacy-and-data-protection/#gdpr-sub)

How do we process your data?

We use Zendesk to communicate with our customers. If you send us an enquiry through the platform, you need provide only your email address. We store your message and email address until the statutory retention period expires. If no such period exists, we delete your data when you ask us to do so or once your enquiry has been conclusively dealt with. The same applies if you ask your question through the chat window, except that your IP address is stored instead of your email address.

On what legal basis do we process your data?

As a company, we have a legitimate interest in processing customer enquiries quickly and efficiently. The processing of your data is therefore based on Art. 6(1)(f) GDPR.

E-commerce and payment providers

Customer and contract data

How do we process your data?

When we enter into a contract with you, we require certain personal data from you. We collect, process and use this data only to the extent necessary to establish, define or amend our legal relationship. If you can use our services only through our website or if the services are billed through the website, we also collect usage data to the extent necessary to enable you to use our offering or to invoice the service used.

How long do we store your data?

We store your data until our legal relationship ends, unless we are legally required to retain the data for longer.

On what legal basis do we process your data?

We store your data to perform the contract with you or to take pre-contractual measures. The legal basis for the data processing is therefore Art. 6(1)(b) GDPR.

Data transfer when services and digital content are used

How do we process your data?

To process payment, we transmit your data to a payment service or to the financial institution commissioned to process the payment. We disclose only data that is strictly necessary for the payment process. If we wish to disclose additional data, we will obtain your consent.

On what legal basis do we process your data?

We disclose your data in order to perform the contract we have entered into with you. The legal basis for the data processing is therefore Art. 6(1)(b) GDPR. If you have consented to the disclosure of your data, the data processing is based on Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Payment services

To enable you to pay conveniently for purchases on our website, we use payment services, i.e. external companies that process payments on our behalf. The specific services we use are listed at the end of this section.

How do we process your data?

For the payment process, you must provide certain personal data, such as your name, bank details or credit-card number. We pass this data on to the relevant payment service. The contractual terms and privacy provisions of the respective service apply to the transaction itself.

On what legal basis do we process your data?

We disclose your data in order to perform the contract we have entered into with you. The legal basis for the data processing is therefore Art. 6(1)(b) GDPR. We also have a legitimate interest in processing purchases as quickly, conveniently and securely as possible. To that extent, the legal basis is also Art. 6(1)(f) GDPR. If you have consented to the disclosure of your data, the data processing is based on Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Which payment services do we use?

Stripe

What is Stripe?
Online payment service

Who processes your data?
Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

Where can you find more information about data protection at Stripe?
https://stripe.com/privacy

On what basis do we transfer your data to the USA?
Stripe complies with the European Commission's Standard Contractual Clauses (see https://stripe.com/privacy and https://stripe.com/guides/general-data-protection-regulation)

Audio and video conferences

As a company, we are in contact with many people: customers, business partners, service providers and others. In addition to other means of communication, we use online-conferencing tools for these exchanges. Information relevant to data protection about the provider or providers of the tools we use can be found at the end of this section. If you communicate with us through such a tool, both we and, in particular, the provider of the relevant tool process your personal data.

How do we process your data?

Online-conferencing tools collect and store various personal data to enable participation in and the smooth running of an online conference. In addition to registration, conference and technical data, this also includes certain communication content.

Registration data: your email address and/or telephone number and, where applicable, other data you provide when registering for the conference.

Conference data: the beginning, end and duration of your participation in the conference, the number of participants and other conference metadata.

Technical data: IP address, MAC address, device ID, device type, operating system and version, client version, camera type, microphone or speakers and the type of connection.

Communication content: cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service.

For details of the data processing, please consult the privacy policies of the relevant conferencing-tool provider.

How long do we store your data?

As your communication partner, we delete your data from our systems as soon as one of the following occurs:

The purpose of the data processing no longer applies.

You ask us to delete the data.

You withdraw your consent to storage.

This does not apply where we are legally required to retain the data.

Cookies remain on your device until you delete them.

Conferencing-tool providers also store your data for their own purposes. Please ask the providers directly what this means for the period for which your data is stored.

On what legal basis do we process your data?

If we are already contractually connected or you wish to enter into a contract with us, we use conferencing tools to perform the contract or to inform you about our services or products. To that extent, the data processing is based on Art. 6(1)(b) GDPR. Otherwise, conferencing tools are used for simple and rapid communication, without which we could not operate our company efficiently. We therefore also have a legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR. A further legal basis may be your consent. In this case, Art. 6(1)(a) GDPR applies. This basis ceases to apply for the future if you withdraw your consent.

Which online-conferencing tools do we use?

Zoom

What is Zoom?
Communication platform for video meetings, voice communication, webinars and chats via desktop computers, telephones, mobile devices and conference-room systems

Who processes your data?
Zoom Communications Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA

Where can you find more information about data protection at Zoom?
https://explore.zoom.us/en/privacy/

On what basis do we transfer your data to the USA?
Zoom Communications Inc. complies with the European Commission's Standard Contractual Clauses (see https://explore.zoom.us/en/privacy/)

Our own services / other matters

Handling applicant data

If you would like to work for us, we will be pleased to receive your application. We treat all personal data transmitted to us as strictly confidential. This also applies to data that we collect only later in the application process.

How do we process your data?

We store all data that we collect during the application process and use it to the extent necessary to decide whether to establish an employment relationship. In addition to contact and communication data and application documents, this includes, for example, notes that we make during job interviews. Within our company, we disclose your data only to persons involved in processing your application.

If your application is successful, we store the data required to manage the employment relationship in our data-processing systems.

If we are unable to offer you a suitable position at present, we will be pleased to include your data in our applicant pool with your consent. This gives us the opportunity to contact you if a position matching your profile becomes available.

How long do we store your data?

If we cannot offer you a position, you decline an offer or you withdraw your application, we reserve the right to retain your documents and other application data for up to 6 months after the end of the application process. The reason is that we may need the data as evidence in the event of a legal dispute. At the end of that period, we delete the data and destroy the documents. If a legal dispute is imminent or already pending, we delete the data and documents when they are no longer required as evidence.

We delete data in the applicant pool no later than 2 years after consent has been given. If you withdraw your consent before that period expires, we delete it earlier.

Deletion of your data always requires that we are not legally obliged to retain it for longer.

On what legal basis do we process your data?

We process your applicant data on the basis of Section 26 of the German Federal Data Protection Act (BDSG) (initiation of an employment relationship) and Art. 6(1)(b) GDPR (general steps prior to entering into a contract).

The same applies if your application is successful.

If we cannot offer you a position, you decline an offer or you withdraw your application, we have a legitimate interest in using your data as evidence in a possible legal dispute. The data processing is therefore based on Art. 6(1)(f) GDPR.

If you have expressly consented to the storage of your data, we process your data on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.